Consider "mixed content XHR" as mixed script instead of mixed display.

Source/core/fetch/ResourceFetcher.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
     Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 284 matching lines @@
 ResourcePtr<RawResource> ResourceFetcher::fetchRawResource(FetchRequest& request)
 {
     return static_cast<RawResource*>(requestResource(Resource::Raw, request).get());
 }
 
 ResourcePtr<RawResource> ResourceFetcher::fetchMainResource(FetchRequest& request)
 {
     return static_cast<RawResource*>(requestResource(Resource::MainResource, request).get());
 }
 
-bool ResourceFetcher::checkInsecureContent(Resource::Type type, const KURL& url) const
+bool ResourceFetcher::checkInsecureContent(Resource::Type type, const KURL& url, MixedContentBlockingTreatment treatment) const
 {
-    switch (type) {
-    case Resource::Script:
-    case Resource::XSLStyleSheet:
-    case Resource::SVGDocument:
-    case Resource::CSSStyleSheet:
-    case Resource::ImportResource:
-        // These resource can inject script into the current document (Script,
-        // XSL) or exfiltrate the content of the current document (CSS).
+    if (treatment == TreatAsDefaultForType) {
+        switch (type) {
+        case Resource::Script:
+        case Resource::XSLStyleSheet:
+        case Resource::SVGDocument:
+        case Resource::CSSStyleSheet:
+        case Resource::ImportResource:
+            // These resource can inject script into the current document (Script,
+            // XSL) or exfiltrate the content of the current document (CSS).
+            treatment = TreatAsActiveContent;
+            break;
+
+        case Resource::TextTrack:
+        case Resource::Shader:
+        case Resource::Raw:
+        case Resource::Image:
+        case Resource::Font:
+            // These resources can corrupt only the frame's pixels.
+            treatment = TreatAsPassiveContent;
+            break;
+
+        case Resource::MainResource:
+        case Resource::LinkPrefetch:
+        case Resource::LinkSubresource:
+            // These cannot affect the current document.
+            treatment = TreatAsAlwaysAllowedContent;
+            break;
+        }
+    }
+    if (treatment == TreatAsActiveContent) {
         if (Frame* f = frame()) {
             if (!f->loader()->mixedContentChecker()->canRunInsecureContent(m_document->securityOrigin(), url))
                 return false;
         }
-
-        break;
-    case Resource::TextTrack:
-    case Resource::Shader:
-    case Resource::Raw:
-    case Resource::Image:
-    case Resource::Font: {
-        // These resources can corrupt only the frame's pixels.
+    } else if (treatment == TreatAsPassiveContent) {
         if (Frame* f = frame()) {
             Frame* top = f->tree()->top();
             if (!top->loader()->mixedContentChecker()->canDisplayInsecureContent(top->document()->securityOrigin(), url))
                 return false;
         }
-        break;
-    }
-    case Resource::MainResource:
-    case Resource::LinkPrefetch:
-    case Resource::LinkSubresource:
-        // Prefetch cannot affect the current document.
-        break;
+    } else {
+        ASSERT(treatment == TreatAsAlwaysAllowedContent);
     }
     return true;
 }
 
 bool ResourceFetcher::canRequest(Resource::Type type, const KURL& url, const ResourceLoaderOptions& options, bool forPreload)
 {
     if (document() && !document()->securityOrigin()->canDisplay(url)) {
         if (!forPreload)
             FrameLoader::reportLocalLoadFailed(frame(), url.elidedString());
         LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not allowed by SecurityOrigin::canDisplay");
@@ skipping 79 matching lines @@
         if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowMediaFromSource(url))
             return false;
         break;
     }
 
     // Last of all, check for insecure content. We do this last so that when
     // folks block insecure content with a CSP policy, they don't get a warning.
     // They'll still get a warning in the console about CSP blocking the load.
 
     // FIXME: Should we consider forPreload here?
-    if (!checkInsecureContent(type, url))
+    if (!checkInsecureContent(type, url, options.mixedContentBlockingTreatment))
         return false;
 
     return true;
 }
 
 bool ResourceFetcher::canAccess(Resource* resource)
 {
     // Redirects can change the response URL different from one of request.
     if (!canRequest(resource->type(), resource->response().url(), resource->options(), false))
         return false;
@@ skipping 838 matching lines @@
 }
 #endif
 
 const ResourceLoaderOptions& ResourceFetcher::defaultResourceOptions()
 {
     DEFINE_STATIC_LOCAL(ResourceLoaderOptions, options, (SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientRequestedCredentials, AskClientForCrossOriginCredentials, DoSecurityCheck, CheckContentSecurityPolicy, UseDefaultOriginRestrictionsForType, DocumentContext));
     return options;
 }
 
 }