ResourceLoaderOptions also must be updated by updateRequestForAccessControl()

Source/core/loader/DocumentThreadableLoader.h

 /*
  * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 78 matching lines @@
         void makeCrossOriginAccessRequest(const ResourceRequest&);
         // Loads m_actualRequest.
         void loadActualRequest();
         // Clears m_actualRequest and reports access control check failure to
         // m_client.
         void handlePreflightFailure(const String& url, const String& errorDescription);
         // Investigates the response for the preflight request. If successful,
         // the actual request will be made later in handleSuccessfulFinish().
         void handlePreflightResponse(unsigned long identifier, const ResourceResponse&);
 
-        void loadRequest(const ResourceRequest&);
+        void loadRequest(const ResourceRequest&, ResourceLoaderOptions);
         bool isAllowedRedirect(const KURL&) const;
         bool isAllowedByPolicy(const KURL&) const;
+        // Returns DoNotAllowStoredCredentials
+        // if m_forceDoNotAllowStoredCredentials is set. Otherwise, just
+        // returns allowCredentials value of m_resourceLoaderOptions.
+        StoredCredentials effectiveAllowCredentials() const;
 
         SecurityOrigin* securityOrigin() const;
 
         ThreadableLoaderClient* m_client;
         Document& m_document;
 
         const ThreadableLoaderOptions m_options;
+        // Some items may be overridden by m_forceDoNotAllowStoredCredentials
+        // and m_securityOrigin. In such a case, build a ResourceLoaderOptions
+        // with up-to-date values from them and this variable, and use it.
         const ResourceLoaderOptions m_resourceLoaderOptions;
 
-        StoredCredentials m_allowCredentials;
+        bool m_forceDoNotAllowStoredCredentials;
         RefPtr<SecurityOrigin> m_securityOrigin;
 
         bool m_sameOriginRequest;
         bool m_simpleRequest;
         bool m_async;
-        OwnPtr<ResourceRequest> m_actualRequest; // non-null during Access Control preflight checks
+
+        // Holds the original request and options for it during preflight
+        // request handling phase.
+        OwnPtr<ResourceRequest> m_actualRequest;
+        OwnPtr<ResourceLoaderOptions> m_actualOptions;
+
         HTTPHeaderMap m_simpleRequestHeaders; // stores simple request headers in case of a cross-origin redirect.
         Timer<DocumentThreadableLoader> m_timeoutTimer;
     };
 
 } // namespace WebCore
 
 #endif // DocumentThreadableLoader_h