Enable SRI only for same origin and CORS content.

Source/core/dom/ScriptLoader.cpp

Index: Source/core/dom/ScriptLoader.cpp
diff --git a/Source/core/dom/ScriptLoader.cpp b/Source/core/dom/ScriptLoader.cpp
index 47eed35b9c66d5d76acb6767b51c6b2bb20ee712..b45a7415b2fd5969ebea60b062f4bcd2c64be20e 100644
--- a/Source/core/dom/ScriptLoader.cpp
+++ b/Source/core/dom/ScriptLoader.cpp
@@ -351,9 +351,6 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
             UseCounter::count(frame, UseCounter::BlockedSniffingImageToScript);
             return;
         }
-
-        if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), sourceCode.resource()->mimeType()))
-            return;
     }
 
     // FIXME: Can this be moved earlier in the function?
@@ -373,6 +370,15 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
     if (!m_isExternalScript || (sourceCode.resource() && sourceCode.resource()->passesAccessControlCheck(&m_element->document(), m_element->document().securityOrigin())))
         corsCheck = SharableCrossOrigin;
 
+    if (m_isExternalScript) {
+        bool canRequest = m_element->document().securityOrigin()->canRequest(sourceCode.resource()->resourceRequest().url());
+        if (!canRequest && corsCheck == NotSharableCrossOrigin && m_element->fastHasAttribute(HTMLNames::integrityAttr)) {
+            contextDocument->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Cannot enforce integrity on non-CORS enabled resource."));

[Mike West, 2015/02/26 08:44:52]

So we continue loading the resource if the CORS check fails? This isn't what we
do for other CORS-related checks, like `<script crossorigin>`... was this an
intentional decision? I'm willing to defer to the folks actually editing the
spec, but I'd like to know it was a conscious decision.

[jww, 2015/03/06 02:16:42]

You're right, I misread the algorithm (as you point out in a more detailed
comment later). I'm changing this to kill the resource.

+        } else if ((canRequest || corsCheck == SharableCrossOrigin) && !SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), sourceCode.resource()->mimeType())) {
+            return;
+        }
+    }
+
     // Create a script from the script element node, using the script
     // block's source and the script block's type.
     // Note: This is where the script is compiled and actually executed.