Merge 51854 - Add a note that the code sample is broken until the bug is fixe...

chrome/common/extensions/docs/static/xhr.html

 <div id="pageData-name" class="pageData">Cross-Origin XMLHttpRequest</div>
 
 <!-- BEGIN AUTHORED CONTENT -->
 <p id="classSummary">
 Regular web pages can use the
 <a href="http://www.w3.org/TR/XMLHttpRequest/">XMLHttpRequest</a>
 object to send and receive data from remote servers,
 but they're limited by the
 <a href="http://en.wikipedia.org/wiki/Same_origin_policy">same origin policy</a>.
 Extensions aren't so limited.
@@ skipping 18 matching lines @@
 in a <code>config_resources</code> folder, the extension can retrieve the file's contents like
 this:</p>
 
 <pre>
 var xhr = new XMLHttpRequest();
 xhr.onreadystatechange = handleStateChange; // Implemented elsewhere.
 xhr.open("GET", chrome.extension.getURL('/config_resources/config.json'), true);
 xhr.send();
 </pre>
 
+<p class="caution">
+<b>Bug note:</b>
+Until <a href="http://crbug.com/41024">bug 41024</a> is fixed,
+the preceding code won't work.
+</p>
+
 <p>If the extension attempts to use a security origin other than itself,
 say http://www.google.com,
 the browser disallows it
 unless the extension has requested the appropriate cross-origin permissions.
 </p>
 
 <h2 id="requesting-permission">Requesting cross-origin permissions</h2>
 
 <p>By adding hosts or host match patterns (or both) to the
 <a href="manifest.html#permissions">permissions</a> section of the
@@ skipping 104 matching lines @@
 </pre>
 <p>
 Additionally, be especially careful of resource retrieved via HTTP.  If your
 extension is used on a hostile network, an network attacker (aka a <a
 href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">"man-in-the-middle"</a>)
 could modify the response and, potentially, attack your extension.  Instead,
 prefer HTTPS whenever possible.
 </p>
 
 <!-- END AUTHORED CONTENT -->