Enable SRI only for same origin and CORS content.

Source/core/fetch/CSSStyleSheetResource.h

Index: Source/core/fetch/CSSStyleSheetResource.h
diff --git a/Source/core/fetch/CSSStyleSheetResource.h b/Source/core/fetch/CSSStyleSheetResource.h
index 01da2164af51667a669bbb9929b47c3f10effc70..b0783fac9c848eaff15d68e8f2414272adb02237 100644
--- a/Source/core/fetch/CSSStyleSheetResource.h
+++ b/Source/core/fetch/CSSStyleSheetResource.h
@@ -51,6 +51,9 @@ public:
     PassRefPtrWillBeRawPtr<StyleSheetContents> restoreParsedStyleSheet(const CSSParserContext&);
     void saveParsedStyleSheet(PassRefPtrWillBeRawPtr<StyleSheetContents>);
 
+    void setCORSNeededAndFailed() { m_corsNeededAndFailed = true; }
+    bool isCORSNeededAndFailed() const { return m_corsNeededAndFailed; }

[Mike West, 2015/02/26 08:44:52]

"CORS needed" for what? CORS isn't needed to load the resource, it's only needed
for the SRI check, right? Can you rename this to something like
"eligibleForIntegrityValidation"? It might be worth pushing that all the way up
to Resource, actually; that might simplify the script check.

[jww, 2015/03/06 02:16:42]

Agreed and done (that is, moved to Resource).

+
 protected:
     virtual bool isSafeToUnlock() const override;
     virtual void destroyDecodedDataIfPossible() override;
@@ -63,6 +66,8 @@ private:
     String m_decodedSheetText;
 
     RefPtrWillBeMember<StyleSheetContents> m_parsedStyleSheetCache;
+
+    bool m_corsNeededAndFailed;
 };
 
 DEFINE_RESOURCE_TYPE_CASTS(CSSStyleSheet);