Block execution of failed 'crossorigin' <script>s.

Source/core/fetch/ResourceFetcher.cpp

Index: Source/core/fetch/ResourceFetcher.cpp
diff --git a/Source/core/fetch/ResourceFetcher.cpp b/Source/core/fetch/ResourceFetcher.cpp
index 4570574720574e4d0f0cd1bd2b1c0ea15a3159d9..ac420cdaa8b7347a43d9023245e3c92daebe5759 100644
--- a/Source/core/fetch/ResourceFetcher.cpp
+++ b/Source/core/fetch/ResourceFetcher.cpp
@@ -532,7 +532,7 @@ bool ResourceFetcher::canRequest(Resource::Type type, const KURL& url, const Res
     return true;
 }
 
-bool ResourceFetcher::canAccess(Resource* resource)
+bool ResourceFetcher::canAccess(Resource* resource, bool isPotentiallyCORSEnabled)
 {
     // Redirects can change the response URL different from one of request.
     if (!canRequest(resource->type(), resource->response().url(), resource->options(), false))
@@ -542,7 +542,7 @@ bool ResourceFetcher::canAccess(Resource* resource)
     switch (resource->type()) {
     case Resource::Script:
     case Resource::ImportResource:
-        if (resource->options().requestOriginPolicy == PotentiallyCrossOriginEnabled
+        if (isPotentiallyCORSEnabled

[abarth-chromium, 2013/11/14 16:34:48]

What's the reason for this part of the change?  What's wrong with looking at the
resource's options?  Is the issue that a single resource might be requested with
different options?  If so, does that mean we need to rip requestOriginPolicy out
of the options struct?

[sof, 2013/11/14 17:12:03]

Yes, that's why. See the test
LayoutTests/http/tests/security/script-crossorigin-loads-correctly-credentials-2.html
for an example.

There are two remaining uses of requestOriginPolicy - style resource loading +
XSLT. I didn't investigate if removal was possible, but it struck my mind as a
desirable outcome of this change. (I could certainly investigate separately.)

             && !m_document->securityOrigin()->canRequest(resource->response().url())
             && !resource->passesAccessControlCheck(m_document->securityOrigin(), error)) {
             if (frame() && frame()->document())