Enable SRI only for same origin and CORS content.

Source/core/fetch/Resource.cpp

Index: Source/core/fetch/Resource.cpp
diff --git a/Source/core/fetch/Resource.cpp b/Source/core/fetch/Resource.cpp
index f07b957b6510ace325e75d9006c63f29b7c06dfb..ae0fb39db3c3c545d21e7d2785bc4fcb886420b6 100644
--- a/Source/core/fetch/Resource.cpp
+++ b/Source/core/fetch/Resource.cpp
@@ -309,17 +309,23 @@ void Resource::finish()
         m_status = Cached;
 }
 
-bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin)
+bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin) const
 {
     String ignoredErrorDescription;
     return passesAccessControlCheck(context, securityOrigin, ignoredErrorDescription);
 }
 
-bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin, String& errorDescription)
+bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin, String& errorDescription) const
 {
     return blink::passesAccessControlCheck(context, m_response, resourceRequest().allowStoredCredentials() ? AllowStoredCredentials : DoNotAllowStoredCredentials, securityOrigin, errorDescription);
 }
 
+bool Resource::isEligibleForIntegrityCheck(ExecutionContext* source) const
+{
+    String errorDescription;
+    return source->securityOrigin()->canRequest(resourceRequest().url()) || passesAccessControlCheck(source, source->securityContext().securityOrigin(), errorDescription);
+}
+
 static double currentAge(const ResourceResponse& response, double responseTimestamp)
 {
     // RFC2616 13.2.3