Require the entire document-tree of an SVGImage to be single-origin

Source/core/svg/graphics/SVGImage.cpp

Index: Source/core/svg/graphics/SVGImage.cpp
diff --git a/Source/core/svg/graphics/SVGImage.cpp b/Source/core/svg/graphics/SVGImage.cpp
index 9805fd3a9c37945614fe4895cf4c62c85b18db8c..3299c7214dd067360add5621ceba6bca8d67ad4f 100644
--- a/Source/core/svg/graphics/SVGImage.cpp
+++ b/Source/core/svg/graphics/SVGImage.cpp
@@ -99,10 +99,13 @@ bool SVGImage::currentFrameHasSingleSecurityOrigin() const
     while (Node* node = walker.get()) {
         if (node->hasTagName(SVGNames::foreignObjectTag))
             return false;
-        if (node->hasTagName(SVGNames::imageTag))
-            return toSVGImageElement(node)->currentFrameHasSingleSecurityOrigin();
-        if (node->hasTagName(SVGNames::feImageTag))
-            return toSVGFEImageElement(node)->currentFrameHasSingleSecurityOrigin();
+        if (node->hasTagName(SVGNames::imageTag)) {
+            if (!toSVGImageElement(node)->currentFrameHasSingleSecurityOrigin())
+                return false;
+        } else if (node->hasTagName(SVGNames::feImageTag)) {
+            if (!toSVGFEImageElement(node)->currentFrameHasSingleSecurityOrigin())
+                return false;
+        }
         walker.next();
     }