Enable SRI only for same origin and CORS content.

Source/core/dom/ScriptLoader.cpp

Index: Source/core/dom/ScriptLoader.cpp
diff --git a/Source/core/dom/ScriptLoader.cpp b/Source/core/dom/ScriptLoader.cpp
index 3a958ad19594839403ad96db6918c898161ffae7..ffc0b26199a168c63900d811f55f0130f12f5c36 100644
--- a/Source/core/dom/ScriptLoader.cpp
+++ b/Source/core/dom/ScriptLoader.cpp
@@ -351,9 +351,6 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
             UseCounter::count(frame, UseCounter::BlockedSniffingImageToScript);
             return;
         }
-
-        if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), sourceCode.resource()->mimeType()))
-            return;
     }
 
     // FIXME: Can this be moved earlier in the function?
@@ -373,6 +370,13 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
     if (!m_isExternalScript || (sourceCode.resource() && sourceCode.resource()->passesAccessControlCheck(&m_element->document(), m_element->document().securityOrigin())))
         corsCheck = SharableCrossOrigin;
 
+    if (m_isExternalScript) {
+        const KURL resourceUrl = sourceCode.resource()->resourceRequest().url();
+        if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), sourceCode.resource()->mimeType(), *sourceCode.resource())) {
+            return;
+        }
+    }
+
     // Create a script from the script element node, using the script
     // block's source and the script block's type.
     // Note: This is where the script is compiled and actually executed.