Use a FrameAssociatedLoader when downloading image resources.

content/renderer/fetchers/multi_resolution_image_resource_fetcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/fetchers/multi_resolution_image_resource_fetcher.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "content/child/image_decoder.h"
 #include "content/public/renderer/resource_fetcher.h"
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
+#include "third_party/WebKit/public/web/WebURLLoaderOptions.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/geometry/size.h"
 
 using blink::WebFrame;
+using blink::WebURLLoaderOptions;
 using blink::WebURLRequest;
 using blink::WebURLResponse;
 
 namespace content {
 
 MultiResolutionImageResourceFetcher::MultiResolutionImageResourceFetcher(
     const GURL& image_url,
     WebFrame* frame,
     int id,
     WebURLRequest::RequestContext request_context,
     const Callback& callback)
     : callback_(callback),
       id_(id),
       http_status_code_(0),
       image_url_(image_url) {
   fetcher_.reset(ResourceFetcher::Create(image_url));
+
+  WebURLLoaderOptions options;
+  options.allowCredentials = true;

[Nate Chapin, 2015/01/06 18:18:42]

I don't feel qualified to approve a change to favicon credential behavior. Would
you mind doing this as part of a separate patch, with a broader set of
reviewers?

[mlamouri (slow - plz ping), 2015/01/07 10:08:06]

This is actually not changing any behaviour. The previous loader
(PLATFORM_LOADER) would send credentials and allow cross origin requests. This
is why I'm passing those options to the FrameAssociatedLoader. If you look at
bug 114082 you will see attempts to make favicon requests not using credentials.

I understand that my CL description is a bit confusing and might suggest that I
change the behaviour. I will update that.

+  options.crossOriginRequestPolicy =
+      WebURLLoaderOptions::CrossOriginRequestPolicyAllow;
+  fetcher_->SetLoaderOptions(options);
+
   fetcher_->Start(
       frame,
       request_context,
       WebURLRequest::FrameTypeNone,
-      ResourceFetcher::PLATFORM_LOADER,
+      ResourceFetcher::FRAME_ASSOCIATED_LOADER,

[mlamouri (slow - plz ping), 2015/01/06 17:32:50]

If exposing all image loading in the devtools can be a problem, we could use the
FRAME_ASSOCIATED_LOADER when the request type is FAVICON.

       base::Bind(&MultiResolutionImageResourceFetcher::OnURLFetchComplete,
                  base::Unretained(this)));
 }
 
 MultiResolutionImageResourceFetcher::~MultiResolutionImageResourceFetcher() {
 }
 
 void MultiResolutionImageResourceFetcher::OnURLFetchComplete(
     const WebURLResponse& response,
     const std::string& data) {
@@ skipping 10 matching lines @@
     // If we get here, it means no image from server or couldn't decode the
     // response as an image. The delegate will see an empty vector.
 
   // Take a reference to the callback as running the callback may lead to our
   // destruction.
   Callback callback = callback_;
   callback.Run(this, bitmaps);
 }
 
 }  // namespace content