Consider "mixed content XHR" as mixed script instead of mixed display.

Source/core/fetch/ResourceFetcher.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
     Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 284 matching lines @@
 ResourcePtr<RawResource> ResourceFetcher::fetchRawResource(FetchRequest& request)
 {
     return static_cast<RawResource*>(requestResource(Resource::Raw, request).get());
 }
 
 ResourcePtr<RawResource> ResourceFetcher::fetchMainResource(FetchRequest& request)
 {
     return static_cast<RawResource*>(requestResource(Resource::MainResource, request).get());
 }
 
-bool ResourceFetcher::checkInsecureContent(Resource::Type type, const KURL& url) const
+bool ResourceFetcher::checkInsecureContent(Resource::Type type, const KURL& url, MixedRawContentBlockingOption mixedRawContentBlockingOption) const
 {
+    bool checkAsActiveContent = false;
+    bool checkAsPassiveContent = false;
+
     switch (type) {
     case Resource::Script:
     case Resource::XSLStyleSheet:
     case Resource::SVGDocument:
     case Resource::CSSStyleSheet:
     case Resource::ImportResource:
         // These resource can inject script into the current document (Script,
         // XSL) or exfiltrate the content of the current document (CSS).
+        checkAsActiveContent = true;
+        break;
+
+    case Resource::TextTrack:
+    case Resource::Shader:
+    case Resource::Image:
+    case Resource::Font:
+        // These resources can corrupt only the frame's pixels.
+        checkAsPassiveContent = true;
+        break;
+
+    case Resource::Raw:
+        // These resources could be either. Check the option for clarification.
+        if (mixedRawContentBlockingOption == TreatAsActiveContent)
+            checkAsActiveContent = true;
+        else
+            checkAsPassiveContent = true;
+        break;
+
+    case Resource::MainResource:
+    case Resource::LinkPrefetch:
+    case Resource::LinkSubresource:
+        // These cannot affect the current document.
+        break;
+    }
+
+    if (checkAsActiveContent) {
         if (Frame* f = frame()) {
             if (!f->loader()->mixedContentChecker()->canRunInsecureContent(m_document->securityOrigin(), url))
                 return false;
         }
-
-        break;
-    case Resource::TextTrack:
-    case Resource::Shader:
-    case Resource::Raw:
-    case Resource::Image:
-    case Resource::Font: {
-        // These resources can corrupt only the frame's pixels.
+    }

[abarth-chromium, 2013/08/30 06:37:08]

Should this be "else if" ?  I don't think we ever want to call both of these
functions.

+    if (checkAsPassiveContent) {
         if (Frame* f = frame()) {
             Frame* top = f->tree()->top();
             if (!top->loader()->mixedContentChecker()->canDisplayInsecureContent(top->document()->securityOrigin(), url))
                 return false;
         }
-        break;
-    }
-    case Resource::MainResource:
-    case Resource::LinkPrefetch:
-    case Resource::LinkSubresource:
-        // Prefetch cannot affect the current document.
-        break;
     }
     return true;
 }
 
 bool ResourceFetcher::canRequest(Resource::Type type, const KURL& url, const ResourceLoaderOptions& options, bool forPreload)
 {
     if (document() && !document()->securityOrigin()->canDisplay(url)) {
         if (!forPreload)
             FrameLoader::reportLocalLoadFailed(frame(), url.elidedString());
         LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not allowed by SecurityOrigin::canDisplay");
@@ skipping 79 matching lines @@
         if (!shouldBypassMainWorldContentSecurityPolicy && !m_document->contentSecurityPolicy()->allowMediaFromSource(url))
             return false;
         break;
     }
 
     // Last of all, check for insecure content. We do this last so that when
     // folks block insecure content with a CSP policy, they don't get a warning.
     // They'll still get a warning in the console about CSP blocking the load.
 
     // FIXME: Should we consider forPreload here?
-    if (!checkInsecureContent(type, url))
+    if (!checkInsecureContent(type, url, options.mixedRawContentBlockingOption))
         return false;
 
     return true;
 }
 
 bool ResourceFetcher::canAccess(Resource* resource)
 {
     // Redirects can change the response URL different from one of request.
     if (!canRequest(resource->type(), resource->response().url(), resource->options(), false))
         return false;
@@ skipping 838 matching lines @@
 }
 #endif
 
 const ResourceLoaderOptions& ResourceFetcher::defaultResourceOptions()
 {
     DEFINE_STATIC_LOCAL(ResourceLoaderOptions, options, (SendCallbacks, SniffContent, BufferData, AllowStoredCredentials, ClientRequestedCredentials, AskClientForCrossOriginCredentials, DoSecurityCheck, CheckContentSecurityPolicy, UseDefaultOriginRestrictionsForType, DocumentContext));
     return options;
 }
 
 }