ResourceLoaderOptions also must be updated by updateRequestForAccessControl()

Source/core/loader/DocumentThreadableLoader.h

Index: Source/core/loader/DocumentThreadableLoader.h
diff --git a/Source/core/loader/DocumentThreadableLoader.h b/Source/core/loader/DocumentThreadableLoader.h
index 46299625af30433d7034d976bcc9dd17af5b219f..54e8b2494bb2917e80d0bc2e53a717cb5d448473 100644
--- a/Source/core/loader/DocumentThreadableLoader.h
+++ b/Source/core/loader/DocumentThreadableLoader.h
@@ -96,9 +96,13 @@ class DocumentThreadableLoader FINAL : public ThreadableLoader, private Resource
         // the actual request will be made later in handleSuccessfulFinish().
         void handlePreflightResponse(unsigned long identifier, const ResourceResponse&);
 
-        void loadRequest(const ResourceRequest&);
+        void loadRequest(const ResourceRequest&, ResourceLoaderOptions);
         bool isAllowedRedirect(const KURL&) const;
         bool isAllowedByPolicy(const KURL&) const;
+        // Returns DoNotAllowStoredCredentials
+        // if m_forceDoNotAllowStoredCredentials is set. Otherwise, just
+        // returns allowCredentials value of m_resourceLoaderOptions.
+        StoredCredentials effectiveAllowCredentials() const;
 
         SecurityOrigin* securityOrigin() const;
 
@@ -106,15 +110,23 @@ class DocumentThreadableLoader FINAL : public ThreadableLoader, private Resource
         Document& m_document;
 
         const ThreadableLoaderOptions m_options;
+        // Some items may be overridden by m_forceDoNotAllowStoredCredentials
+        // and m_securityOrigin. In such a case, build a ResourceLoaderOptions
+        // with up-to-date values from them and this variable, and use it.
         const ResourceLoaderOptions m_resourceLoaderOptions;
 
-        StoredCredentials m_allowCredentials;
+        bool m_forceDoNotAllowStoredCredentials;
         RefPtr<SecurityOrigin> m_securityOrigin;
 
         bool m_sameOriginRequest;
         bool m_simpleRequest;
         bool m_async;
-        OwnPtr<ResourceRequest> m_actualRequest; // non-null during Access Control preflight checks
+
+        // Holds the original request and options for it during preflight
+        // request handling phase.
+        OwnPtr<ResourceRequest> m_actualRequest;
+        OwnPtr<ResourceLoaderOptions> m_actualOptions;
+
         HTTPHeaderMap m_simpleRequestHeaders; // stores simple request headers in case of a cross-origin redirect.
         Timer<DocumentThreadableLoader> m_timeoutTimer;
     };