Block execution of failed 'crossorigin' <script>s.

Source/core/html/HTMLImportLoader.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 93 matching lines @@
         m_resource = 0;
     }
 
     ASSERT(!document() || !document()->parsing());
     root()->importWasDisposed();
 }
 
 HTMLImportLoader::State HTMLImportLoader::startWritingAndParsing(const ResourceResponse& response)
 {
     // Current canAccess() implementation isn't sufficient for catching cross-domain redirects: http://crbug.com/256976
-    if (!parent()->document()->fetcher()->canAccess(m_resource.get()))
+    if (!parent()->document()->fetcher()->canAccess(m_resource.get(), PotentiallyCORSEnabled))
         return StateError;
 
     DocumentInit init = DocumentInit(response.url(), 0, root()->document()->contextDocument(), this)
         .withRegistrationContext(root()->document()->registrationContext());
     m_importedDocument = HTMLDocument::create(init);
     m_importedDocument->initContentSecurityPolicy(ContentSecurityPolicyResponseHeaders(response));
     m_writer = DocumentWriter::create(m_importedDocument.get(), response.mimeType(), response.textEncodingName());
 
     return StateLoading;
 }
@@ skipping 69 matching lines @@
 }
 
 bool HTMLImportLoader::isProcessing() const
 {
     if (!m_importedDocument)
         return !isDone();
     return m_importedDocument->parsing();
 }
 
 } // namespace WebCore