Enable SRI only for same origin and CORS content.

Source/core/fetch/Resource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 291 matching lines @@
 
 void Resource::finish()
 {
     ASSERT(!m_resourceToRevalidate);
     ASSERT(!errorOccurred());
     finishOnePart();
     if (!errorOccurred())
         m_status = Cached;
 }
 
-bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin)
+bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin) const
 {
     String ignoredErrorDescription;
     return passesAccessControlCheck(context, securityOrigin, ignoredErrorDescription);
 }
 
-bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin, String& errorDescription)
+bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin, String& errorDescription) const
 {
     return blink::passesAccessControlCheck(context, m_response, resourceRequest().allowStoredCredentials() ? AllowStoredCredentials : DoNotAllowStoredCredentials, securityOrigin, errorDescription);
 }
 
+bool Resource::isEligibleForIntegrityCheck(ExecutionContext* source) const
+{
+    String errorDescription;
+    return source->securityOrigin()->canRequest(resourceRequest().url()) || passesAccessControlCheck(source, source->securityContext().securityOrigin(), errorDescription);
+}
+
 static double currentAge(const ResourceResponse& response, double responseTimestamp)
 {
     // RFC2616 13.2.3
     // No compensation for latency as that is not terribly important in practice
     double dateValue = response.date();
     double apparentAge = std::isfinite(dateValue) ? std::max(0., responseTimestamp - dateValue) : 0;
     double ageValue = response.age();
     double correctedReceivedAge = std::isfinite(ageValue) ? std::max(apparentAge, ageValue) : apparentAge;
     double residentTime = currentTime() - responseTimestamp;
     return correctedReceivedAge + residentTime;
@@ skipping 721 matching lines @@
         return "ImportResource";
     case Resource::Media:
         return "Media";
     }
     ASSERT_NOT_REACHED();
     return "Unknown";
 }
 #endif // !LOG_DISABLED
 
 }