Block mixed <picture> and <img srcset> by default.

Source/core/loader/ImageLoader.cpp

Index: Source/core/loader/ImageLoader.cpp
diff --git a/Source/core/loader/ImageLoader.cpp b/Source/core/loader/ImageLoader.cpp
index 82f635a5d9da63656a0d33a042f3846bfd4774bd..5f561b7b105ce871113b55b8ef7bf8098f68195e 100644
--- a/Source/core/loader/ImageLoader.cpp
+++ b/Source/core/loader/ImageLoader.cpp
@@ -183,7 +183,11 @@ void ImageLoader::doUpdateFromElement(bool bypassMainWorldCSP)
     KURL url = imageURL();
     ResourcePtr<ImageResource> newImage = 0;
     if (!url.isNull()) {
-        FetchRequest request(ResourceRequest(url), element()->localName());
+        // Unlike raw <img>, we block mixed content inside of <picture> or <img srcset>.
+        ResourceLoaderOptions resourceLoaderOptions = ResourceFetcher::defaultResourceOptions();
+        if (isHTMLPictureElement(element()->parentNode()) || !element()->fastGetAttribute(HTMLNames::srcsetAttr).isEmpty())
+            resourceLoaderOptions.mixedContentBlockingTreatment = TreatAsActiveContent;
+        FetchRequest request(ResourceRequest(url), element()->localName(), resourceLoaderOptions);
         if (bypassMainWorldCSP)
             request.setContentSecurityCheck(DoNotCheckContentSecurityPolicy);