Add CORS support for <link> elements.

Source/core/loader/LinkLoader.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 80 matching lines @@
 void LinkLoader::didSendLoadForPrerender()
 {
     m_client->didSendLoadForLinkPrerender();
 }
 
 void LinkLoader::didSendDOMContentLoadedForPrerender()
 {
     m_client->didSendDOMContentLoadedForLinkPrerender();
 }
 
-bool LinkLoader::loadLink(const LinkRelAttribute& relAttribute, const String& type, const KURL& href, Document& document)
+bool LinkLoader::loadLink(const LinkRelAttribute& relAttribute, const String& crossOriginMode, const String& type, const KURL& href, Document& document)
 {
     if (relAttribute.isDNSPrefetch()) {
         Settings* settings = document.settings();
         // FIXME: The href attribute of the link element can be in "//hostname" form, and we shouldn't attempt
         // to complete that as URL <https://bugs.webkit.org/show_bug.cgi?id=48857>.
         if (settings && settings->dnsPrefetchingEnabled() && href.isValid() && !href.isEmpty())
             prefetchDNS(href.host());
     }
 
     // FIXME(crbug.com/323096): Should take care of import.
     if ((relAttribute.isLinkPrefetch() || relAttribute.isLinkSubresource()) && href.isValid() && document.frame()) {
         if (!m_client->shouldLoadLink())
             return false;
         Resource::Type type = relAttribute.isLinkSubresource() ?  Resource::LinkSubresource : Resource::LinkPrefetch;
         FetchRequest linkRequest(ResourceRequest(document.completeURL(href)), FetchInitiatorTypeNames::link);
+        if (!crossOriginMode.isNull()) {
+            StoredCredentials allowCredentials = equalIgnoringCase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials;

[abarth-chromium, 2014/01/28 06:38:45]

It's even twice in this CL.  :)

+            linkRequest.setCrossOriginAccessControl(document.securityOrigin(), allowCredentials);
+        }
         setResource(document.fetcher()->fetchLinkResource(type, linkRequest));
     }
 
     if (relAttribute.isLinkPrerender()) {
         if (!m_prerender) {
             m_prerender = PrerenderHandle::create(document, this, href);
         } else if (m_prerender->url() != href) {
             m_prerender->cancel();
             m_prerender = PrerenderHandle::create(document, this, href);
         }
     } else if (m_prerender) {
         m_prerender->cancel();
         m_prerender.clear();
     }
     return true;
 }
 
 void LinkLoader::released()
 {
     // Only prerenders need treatment here; other links either use the Resource interface, or are notionally
     // atomic (dns prefetch).
     if (m_prerender) {
         m_prerender->cancel();
         m_prerender.clear();
     }
 }
 
 }