The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/252f1fc5dd59522b7c1164cb421203f40a28f49b

commit 252f1fc5dd59522b7c1164cb421203f40a28f49b
Author: Takeshi Yoshino <tyoshino@chromium.org>
Date: Fri Jun 09 05:40:45 2017

Clean up a layout test helper cors-script.php

- Change the order of logics for readability.
- Use single quotation where we can.
- Fix indentation.

Bug:  730912 
Change-Id: Ifa704381610bc1a0caf164c3b9dd0e6114db344e
Reviewed-on: https://chromium-review.googlesource.com/527723
Commit-Queue: Takeshi Yoshino <tyoshino@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#478209}
[modify] https://crrev.com/252f1fc5dd59522b7c1164cb421203f40a28f49b/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-script.php

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33

commit 01f09fba7a7f4510b216ecb16c55ff52d2a2ba33
Author: Takeshi Yoshino <tyoshino@chromium.org>
Date: Fri Jun 09 05:57:54 2017

Fix handling of the unsafe-credentials policy of the Suborigin

Factor out the logic to handle the unsafe-credentials policy of the
Suborigin into a method on the SecurityOrigin class.

Fix FetchParameters::SetCrossOriginAccessControl() not to touch origin
when it's nullptr.

The member variable include_credentials_ of XMLHttpRequest is renamed
to with_credentials_ as it's confusing with the local variable
include_credentials in CreateRequest().

Pass with_credentials_, not include_credentials to probe::willLoadXHR()
since it'll be used to set .withCredentials to replay the XHR.

ResourceRequest::SetFetchCredentialsMode() call and
ResourceLoaderOptions::credentials_requested setting must not be
affected by the result of suborigin policy check since it's equivalent
to the credentials mode. So, it should be set based on:
- XMLHttpRequest: the value set to withCredentials
- FetchManager: Request::Credentials()
- FetchParameters: CrossOriginAttributeValue

Add a note about why |cors_flag| is still used in
FetchManager::PerformHTTPFetch().

Bonus:
- Renamed FetchManager::PerformBasicFetch() to PerformSchemeFetch()
  based on the up-to-date terminology and fixed links to the spec.
- Refactored some related SecurityOrigin methods for readability.

Bug:  730912 ,  695808 
Change-Id: Ifece2a5c6a84cc4695bfdb0d1f3757083f7cac0b
Reviewed-on: https://chromium-review.googlesource.com/526212
Commit-Queue: Takeshi Yoshino <tyoshino@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#478214}
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/LayoutTests/http/tests/security/suborigins/suborigin-unsafe-credentials.php
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/Source/platform/loader/fetch/FetchParameters.cpp
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/Source/platform/weborigin/SecurityOrigin.cpp
[modify] https://crrev.com/01f09fba7a7f4510b216ecb16c55ff52d2a2ba33/third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0ae54aecb40296d0f2304176ffec747e01bc5643

commit 0ae54aecb40296d0f2304176ffec747e01bc5643
Author: Takeshi Yoshino <tyoshino@chromium.org>
Date: Fri Jun 09 09:37:50 2017

Clean up a layout test suborigin-cors-eventsource.php

EventSourceInit.withCredentials is a boolean member. Set a boolean to
it.

Remove unused parameter from xorigin_ineligible_event_source().

Bug:  730912 
Change-Id: I7a2bd1311d99ff01289459a95d76274f0513d87c
Reviewed-on: https://chromium-review.googlesource.com/527863
Commit-Queue: Takeshi Yoshino <tyoshino@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#478238}
[modify] https://crrev.com/0ae54aecb40296d0f2304176ffec747e01bc5643/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-eventsource.php

Apologies, applied the wrong component in bulk.

Marking WontFix as the Suborigin has been unshipped for now. CC-ing stakeholders FYI.