Set requestor origin from referrer in WebAssociatedURLLoader

Some callers, notablly flash, with |grant_universal_access| want to
have an origin matching with referrer.

Bug: 935662
Change-Id: I99fc48266015d1a6ef611102f2cfbe2330ccc465
Reviewed-on: https://chromium-review.googlesource.com/c/1496125Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#636746}

third_party/blink/renderer/core/exported/web_associated_url_loader_impl.cc

@@ -395,8 +395,10 @@ void WebAssociatedURLLoaderImpl::LoadAsynchronously(
       const auto mode = new_request.GetFetchRequestMode();
       DCHECK(mode == network::mojom::FetchRequestMode::kNoCors ||
              mode == network::mojom::FetchRequestMode::kNavigate);
-      scoped_refptr<SecurityOrigin> origin =
-          SecurityOrigin::CreateUniqueOpaque();
+      // Some callers, notablly flash, with |grant_universal_access| want to
+      // have an origin matching with referrer.
+      KURL referrer(request.HttpHeaderField(http_names::kReferer));
+      scoped_refptr<SecurityOrigin> origin = SecurityOrigin::Create(referrer);
       origin->GrantUniversalAccess();
       new_request.ToMutableResourceRequest().SetRequestorOrigin(origin);
     }