Deprecate support for xhr.withCredentials for synchronous requests

Source/core/xml/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 17 matching lines @@
 #include "core/dom/ContextFeatures.h"
 #include "core/dom/DOMImplementation.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/XMLDocument.h"
 #include "core/editing/markup.h"
 #include "core/events/Event.h"
 #include "core/fetch/CrossOriginAccessControl.h"
 #include "core/fileapi/Blob.h"
 #include "core/fileapi/File.h"
 #include "core/fileapi/Stream.h"
+#include "core/frame/Settings.h"
+#include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/DOMFormData.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/parser/TextResourceDecoder.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/loader/ThreadableLoader.h"
-#include "core/frame/Settings.h"
 #include "core/xml/XMLHttpRequestProgressEvent.h"
 #include "core/xml/XMLHttpRequestUpload.h"
 #include "platform/Logging.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/SharedBuffer.h"
 #include "platform/blob/BlobData.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/network/ParsedContentType.h"
 #include "platform/network/ResourceError.h"
 #include "platform/network/ResourceRequest.h"
@@ skipping 423 matching lines @@
     }
 }
 
 void XMLHttpRequest::setWithCredentials(bool value, ExceptionState& exceptionState)
 {
     if (m_state > OPENED || m_loader) {
         exceptionState.throwDOMException(InvalidStateError,  "The value may only be set if the object's state is UNSENT or OPENED.");
         return;
     }
 
+    // FIXME: According to XMLHttpRequest Level 2 we should throw InvalidAccessError exception here.
+    // However for time being only print warning message to warn web developers.
+    if (!m_async && executionContext()->isDocument())

[sof, 2014/06/18 08:16:06]

No need to check isDocument(), just pass in executionContext() to count() (or
countDeprecation().)

That has the added benefit of also making the non-Document (i.e., Workers) case
eventually work.

[maheshkk, 2014/06/18 15:55:08]

You are right. Once http://code.google.com/p/chromium/issues/detail?id=376039 is
done it will make much more sense. 

+        UseCounter::countDeprecation(document(), UseCounter::SyncXHRWithCredentials);

[sof, 2014/06/18 08:16:06]

With https://codereview.chromium.org/337283003 adding a global syncXHR use
counter, should we turn this into a count() for SyncXHRWithCredentials initially
& return once data for that has settled?

[maheshkk, 2014/06/18 15:55:08]

IMO, printing deprecated message will serve as early warning without waiting for
useCount. Because blink doesn't match other browsers and spec. And remove the
support once useCount is less after significant time provided to developers with
deprecated warning message. Thoughts? 

[sof, 2014/06/18 16:13:36]

I understand what you hope is the side-effect of also emitting the deprecation
message. I could be interpreting this wrongly, but I don't think we're quite
there yet here wrt deprecation and removal -- what if the usage data (and other
considerations) show that we cannot go ahead with this, wouldn't it be
counterproductive to have emitted a deprecation message for a while?

[maheshkk, 2014/06/18 23:53:07]

Agreed. We could go by only adding UseCounter now and iterate again after
obtaining the use count to deprecate. 
Mozilla, however throws exception. So web developers who might be using this
already have split in browsers behavior. I understand that it would be much
safer to deprecate after getting use count.

+
     m_includeCredentials = value;
 }
 
 bool XMLHttpRequest::isAllowedHTTPMethod(const String& method)
 {
     return !equalIgnoringCase(method, "TRACE")
         && !equalIgnoringCase(method, "TRACK")
         && !equalIgnoringCase(method, "CONNECT");
 }
 
@@ skipping 959 matching lines @@
 {
     visitor->trace(m_responseBlob);
     visitor->trace(m_responseStream);
     visitor->trace(m_responseDocument);
     visitor->trace(m_progressEventThrottle);
     visitor->trace(m_upload);
     XMLHttpRequestEventTarget::trace(visitor);
 }
 
 } // namespace WebCore