Measure how many pages are using cross-origin XHR with withCredentials set to true

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 856 matching lines @@
         InspectorInstrumentation::asyncTaskScheduled(&executionContext, "XMLHttpRequest.send", this, true);
         dispatchProgressEvent(EventTypeNames::loadstart, 0, 0);
         if (httpBody && m_upload) {
             uploadEvents = m_upload->hasEventListeners();
             m_upload->dispatchEvent(ProgressEvent::create(EventTypeNames::loadstart, false, 0, 0));
         }
     }
 
     m_sameOriginRequest = getSecurityOrigin()->canRequestNoSuborigin(m_url);
 
+    if (m_sameOriginRequest && m_includeCredentials)

[yhirano, 2016/04/14 04:26:02]

!m_sameOriginRequest?

[tyoshino (SeeGerritForStatus), 2016/04/14 04:42:45]

My bad... Fixed

+        UseCounter::count(&executionContext, UseCounter::XMLHttpRequestCrossOriginWithCredentials);
+
     // We also remember whether upload events should be allowed for this request in case the upload listeners are
     // added after the request is started.
     m_uploadEventsAllowed = m_sameOriginRequest || uploadEvents || !FetchUtils::isSimpleRequest(m_method, m_requestHeaders);
 
     ResourceRequest request(m_url);
     request.setHTTPMethod(m_method);
     request.setRequestContext(WebURLRequest::RequestContextXMLHttpRequest);
     request.setFetchCredentialsMode(m_includeCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsModeSameOrigin);
     request.setSkipServiceWorker(m_isolatedWorldSecurityOrigin);
     request.setExternalRequestStateFromRequestorAddressSpace(executionContext.securityContext().addressSpace());
@@ skipping 817 matching lines @@
     visitor->trace(m_responseArrayBuffer);
     visitor->trace(m_progressEventThrottle);
     visitor->trace(m_upload);
     visitor->trace(m_blobLoader);
     XMLHttpRequestEventTarget::trace(visitor);
     DocumentParserClient::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink