Code: void MediaElementAudioSourceHandler::OnCurrentSrcChanged(
    const KURL& current_src) {
  DCHECK(IsMainThread());
  Locker<MediaElementAudioSourceHandler> locker(*this);
 
  passes_current_src_cors_access_check_ =
      PassesCurrentSrcCORSAccessCheck(current_src);
 
  maybe_print_cors_message_ = !passes_current_src_cors_access_check_;
  current_src_string_ = current_src.GetString();
}

Vulnerability Type: Bypass 
CWE ID: CWE-20
Summary: Insufficient policy enforcement in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Commit Message: Redirect should not circumvent same-origin restrictions

Check whether we have access to the audio data when the format is set.
At this point we have enough information to determine this. The old approach
based on when the src was changed was incorrect because at the point, we
only know the new src; none of the response headers have been read yet.

This new approach also removes the incorrect message reported in 619114.

Bug: 826552, 619114
Change-Id: I95119b3a1e399c05d0fbd2da71f87967978efff6
Reviewed-on: https://chromium-review.googlesource.com/1069540
Commit-Queue: Raymond Toy <rtoy@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#564313}