Consider "mixed content XHR" as mixed script instead of mixed display.

Source/core/fetch/ResourceLoaderOptions.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 72 matching lines @@
 
 // APIs like XMLHttpRequest and EventSource let the user decide
 // whether to send credentials, but they're always sent for
 // same-origin requests. Additional information is needed to handle
 // cross-origin redirects correctly.
 enum CredentialRequest {
     ClientRequestedCredentials,
     ClientDidNotRequestCredentials
 };
 
+enum MixedContentBlockingTreatment {
+    TreatAsDefaultForType,
+    TreatAsPassiveContent,
+    TreatAsActiveContent,
+    TreatAsAlwaysAllowedContent
+};
+
 struct ResourceLoaderOptions {
     ResourceLoaderOptions()
         : sendLoadCallbacks(DoNotSendCallbacks)
         , sniffContent(DoNotSniffContent)
         , dataBufferingPolicy(BufferData)
         , allowCredentials(DoNotAllowStoredCredentials)
         , credentialsRequested(ClientDidNotRequestCredentials)
         , crossOriginCredentialPolicy(DoNotAskClientForCrossOriginCredentials)
         , securityCheck(DoSecurityCheck)
         , contentSecurityPolicyOption(CheckContentSecurityPolicy)
         , requestOriginPolicy(UseDefaultOriginRestrictionsForType)
         , requestInitiatorContext(DocumentContext)
+        , mixedContentBlockingTreatment(TreatAsDefaultForType)
     {
     }
 
     ResourceLoaderOptions(
         SendCallbackPolicy sendLoadCallbacks,
         ContentSniffingPolicy sniffContent,
         DataBufferingPolicy dataBufferingPolicy,
         StoredCredentials allowCredentials,
         CredentialRequest credentialsRequested,
         ClientCrossOriginCredentialPolicy crossOriginCredentialPolicy,
         SecurityCheckPolicy securityCheck,
         ContentSecurityPolicyCheck contentSecurityPolicyOption,
         RequestOriginPolicy requestOriginPolicy,
         RequestInitiatorContext requestInitiatorContext)
         : sendLoadCallbacks(sendLoadCallbacks)
         , sniffContent(sniffContent)
         , dataBufferingPolicy(dataBufferingPolicy)
         , allowCredentials(allowCredentials)
         , credentialsRequested(credentialsRequested)
         , crossOriginCredentialPolicy(crossOriginCredentialPolicy)
         , securityCheck(securityCheck)
         , contentSecurityPolicyOption(contentSecurityPolicyOption)
         , requestOriginPolicy(requestOriginPolicy)
         , requestInitiatorContext(requestInitiatorContext)
+        , mixedContentBlockingTreatment(TreatAsDefaultForType)
     {
     }
+
     SendCallbackPolicy sendLoadCallbacks;
     ContentSniffingPolicy sniffContent;
     DataBufferingPolicy dataBufferingPolicy;
     StoredCredentials allowCredentials; // Whether HTTP credentials and cookies are sent with the request.
     CredentialRequest credentialsRequested; // Whether the client (e.g. XHR) wanted credentials in the first place.
     ClientCrossOriginCredentialPolicy crossOriginCredentialPolicy; // Whether we will ask the client for credentials (if we allow credentials at all).
     SecurityCheckPolicy securityCheck;
     ContentSecurityPolicyCheck contentSecurityPolicyOption;
     FetchInitiatorInfo initiatorInfo;
     RequestOriginPolicy requestOriginPolicy;
     RequestInitiatorContext requestInitiatorContext;
+    MixedContentBlockingTreatment mixedContentBlockingTreatment;
 };
 
 } // namespace WebCore
 
 #endif // ResourceLoaderOptions_h