Consider "mixed content XHR" as mixed script instead of mixed display.

Source/core/fetch/ResourceLoaderOptions.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 72 matching lines @@
 
 // APIs like XMLHttpRequest and EventSource let the user decide
 // whether to send credentials, but they're always sent for
 // same-origin requests. Additional information is needed to handle
 // cross-origin redirects correctly.
 enum CredentialRequest {
     ClientRequestedCredentials,
     ClientDidNotRequestCredentials
 };
 
+enum MixedRawContentBlockingOption {
+    TreatAsPassiveContent,
+    TreatAsActiveContent

[abarth-chromium, 2013/08/30 06:37:08]

I'd recommend making this a three-state enum.  The extra value would be
TreatAsDefaultForType, which would give you the default value.  Then these two
values would force the check to be either passive or active, regardless of the
type.  We can then add ASSERTs in checkInsecureContent, for example, to make
sure we never get TreatAsDefaultForType for Raw resources.

+};
+
 struct ResourceLoaderOptions {
     ResourceLoaderOptions()
         : sendLoadCallbacks(DoNotSendCallbacks)
         , sniffContent(DoNotSniffContent)
         , dataBufferingPolicy(BufferData)
         , allowCredentials(DoNotAllowStoredCredentials)
         , credentialsRequested(ClientDidNotRequestCredentials)
         , crossOriginCredentialPolicy(DoNotAskClientForCrossOriginCredentials)
         , securityCheck(DoSecurityCheck)
         , contentSecurityPolicyOption(CheckContentSecurityPolicy)
         , requestOriginPolicy(UseDefaultOriginRestrictionsForType)
         , requestInitiatorContext(DocumentContext)
+        , mixedRawContentBlockingOption(TreatAsPassiveContent)
     {
     }
 
     ResourceLoaderOptions(
         SendCallbackPolicy sendLoadCallbacks,
         ContentSniffingPolicy sniffContent,
         DataBufferingPolicy dataBufferingPolicy,
         StoredCredentials allowCredentials,
         CredentialRequest credentialsRequested,
         ClientCrossOriginCredentialPolicy crossOriginCredentialPolicy,
         SecurityCheckPolicy securityCheck,
         ContentSecurityPolicyCheck contentSecurityPolicyOption,
         RequestOriginPolicy requestOriginPolicy,
         RequestInitiatorContext requestInitiatorContext)
         : sendLoadCallbacks(sendLoadCallbacks)
         , sniffContent(sniffContent)
         , dataBufferingPolicy(dataBufferingPolicy)
         , allowCredentials(allowCredentials)
         , credentialsRequested(credentialsRequested)
         , crossOriginCredentialPolicy(crossOriginCredentialPolicy)
         , securityCheck(securityCheck)
         , contentSecurityPolicyOption(contentSecurityPolicyOption)
         , requestOriginPolicy(requestOriginPolicy)
         , requestInitiatorContext(requestInitiatorContext)
+        , mixedRawContentBlockingOption(TreatAsPassiveContent)
     {
     }
     SendCallbackPolicy sendLoadCallbacks;
     ContentSniffingPolicy sniffContent;
     DataBufferingPolicy dataBufferingPolicy;
     StoredCredentials allowCredentials; // Whether HTTP credentials and cookies are sent with the request.
     CredentialRequest credentialsRequested; // Whether the client (e.g. XHR) wanted credentials in the first place.
     ClientCrossOriginCredentialPolicy crossOriginCredentialPolicy; // Whether we will ask the client for credentials (if we allow credentials at all).
     SecurityCheckPolicy securityCheck;
     ContentSecurityPolicyCheck contentSecurityPolicyOption;
     FetchInitiatorInfo initiatorInfo;
     RequestOriginPolicy requestOriginPolicy;
     RequestInitiatorContext requestInitiatorContext;
+    MixedRawContentBlockingOption mixedRawContentBlockingOption;
 };
 
 } // namespace WebCore
 
 #endif // ResourceLoaderOptions_h