Fix our handling of mixed SSL / non-SSL content....

webkit/glue/resource_handle_impl.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file replaces WebCore/platform/network/win/ResourceHandleWin.cpp with a
 // platform-neutral implementation that simply defers almost entirely to
 // ResouceLoaderBridge.
 //
 // This uses the same ResourceHandle.h header file that the rest of WebKit
 // uses, allowing us to avoid complicated changes. Our specific things are
@@ skipping 398 matching lines @@
       headerBuf.append(crlf);
     headerBuf.append((*it).first + sep + (*it).second);
   }
 
   // TODO(jcampan): in the non out-of-process plugin case the request does not
   // have a origin_pid. Find a better place to set this.
   int origin_pid = request_.originPid();
   if (origin_pid == 0)
     origin_pid = base::GetCurrentProcId();
 
-  bool mixed_content =
-      webkit_glue::KURLToGURL(request_.mainDocumentURL()).SchemeIsSecure() &&
-      !url.SchemeIsSecure();
-
   if (url.SchemeIs("data")) {
     if (sync_load_response) {
       // This is a sync load. Do the work now.
       sync_load_response->url = url;
       std::string data;
       GetInfoFromDataUrl(sync_load_response->url, sync_load_response,
                          &sync_load_response->data,
                          &sync_load_response->status);
     } else {
       pending_ = true;
       job_->ref();  // to be released when we get a OnCompletedRequest.
       job_->ref();  // to be released when HandleDataUrl is completed.
       MessageLoop::current()->PostTask(FROM_HERE,
           data_url_factory_.NewRunnableMethod(
               &ResourceHandleInternal::HandleDataUrl));
     }
     return true;
   }
 
+  Frame* frame = request_.frame();
+  std::string frame_origin = webkit_glue::FrameToOrigin(frame);
+  std::string main_frame_origin =
+      webkit_glue::FrameToOrigin(frame ? frame->tree()->top() : NULL);
+
   // TODO(darin): is latin1 really correct here?  It is if the strings are
   // already ASCII (i.e., if they are already escaped properly).
   // TODO(brettw) this should take parameter encoding into account when
   // creating the GURLs.
   bridge_.reset(ResourceLoaderBridge::Create(
       webframe,
       webkit_glue::CStringToStdString(method),
       url,
       policy_url,
       referrer,
+      frame_origin,
+      main_frame_origin,
       webkit_glue::CStringToStdString(headerBuf.latin1()),
       load_flags_,
       origin_pid,
-      FromTargetType(request_.targetType()),
-      mixed_content));
+      FromTargetType(request_.targetType())));
   if (!bridge_.get())
     return false;
 
   if (request_.httpBody()) {
     // GET and HEAD requests shouldn't have http bodies.
     DCHECK(method != "GET" && method != "HEAD");
     const Vector<FormDataElement>& elements = request_.httpBody()->elements();
     size_t n = elements.size();
     for (size_t i = 0; i < n; ++i) {
       const FormDataElement& e = elements[static_cast<unsigned>(i)];
@@ skipping 309 matching lines @@
   // if the request cannot be serviced from cache.  We force the 'DontLoad'
   // cache policy at this point to ensure that we never hit the network for
   // this request.
   //
   DCHECK(request.httpMethod() == "POST");
   request.setCachePolicy(ReturnCacheDataDontLoad);
   return true;
 }
 
 }  // namespace WebCore