Block mixed <picture> and <img srcset> by default.

Source/core/loader/ImageLoader.cpp

Index: Source/core/loader/ImageLoader.cpp
diff --git a/Source/core/loader/ImageLoader.cpp b/Source/core/loader/ImageLoader.cpp
index 5173f9a94d191e1d76cd595ec511127305f34104..c336ec8c298885c2204f124d3912fb19e05859fb 100644
--- a/Source/core/loader/ImageLoader.cpp
+++ b/Source/core/loader/ImageLoader.cpp
@@ -183,7 +183,11 @@ void ImageLoader::doUpdateFromElement(bool bypassMainWorldCSP)
     KURL url = imageURL();
     ResourcePtr<ImageResource> newImage = 0;
     if (!url.isNull()) {
-        FetchRequest request(ResourceRequest(url), element()->localName());
+        // Unlike raw <img>, we block mixed content inside of <picture> or <img srcset>.
+        ResourceLoaderOptions resourceLoaderOptions;
+        if (isHTMLPictureElement(element()->parentNode()) || !element()->fastGetAttribute(HTMLNames::srcsetAttr).isEmpty())
+            resourceLoaderOptions.mixedContentBlockingTreatment = TreatAsActiveContent;
+        FetchRequest request(ResourceRequest(url), element()->localName(), resourceLoaderOptions);
         if (bypassMainWorldCSP)
             request.setContentSecurityCheck(DoNotCheckContentSecurityPolicy);