<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
<script src="dump-securitypolicyviolation-and-notify-done.js"></script>
</head>
<body>
<script>
function done()
{
    if (window.testRunner)
        testRunner.notifyDone();
}

var xhr = new XMLHttpRequest;
xhr.onload = function () {
    alert("FAIL: load was not blocked");
    done()
};

window.setTimeout(done, 2000);

try {
    var isAsynchronous = document.location.search.startsWith("?asynchronous");
    xhr.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/access-control-basic-allow-star.cgi", isAsynchronous);
} catch (ex) {
    // Firefox raises an exception, which is one way to make this detectable.
    done();
}
xhr.send(null);
</script>
</body>
</html>
