Enable SRI only for same origin and CORS content.

Source/core/fetch/Resource.cpp

Index: Source/core/fetch/Resource.cpp
diff --git a/Source/core/fetch/Resource.cpp b/Source/core/fetch/Resource.cpp
index d9f095be6eb240bcc03c74ddf77786d8049eb94e..9f998c657602123dc6374278e5538390f3a53560 100644
--- a/Source/core/fetch/Resource.cpp
+++ b/Source/core/fetch/Resource.cpp
@@ -311,17 +311,23 @@ void Resource::finish()
         m_status = Cached;
 }
 
-bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin)
+bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin) const
 {
     String ignoredErrorDescription;
     return passesAccessControlCheck(context, securityOrigin, ignoredErrorDescription);
 }
 
-bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin, String& errorDescription)
+bool Resource::passesAccessControlCheck(ExecutionContext* context, SecurityOrigin* securityOrigin, String& errorDescription) const
 {
     return blink::passesAccessControlCheck(context, m_response, resourceRequest().allowStoredCredentials() ? AllowStoredCredentials : DoNotAllowStoredCredentials, securityOrigin, errorDescription);
 }
 
+bool Resource::isEligibleForIntegrityCheck(ExecutionContext* source) const
+{
+    String errorDescription;
+    return source->securityOrigin()->canRequest(resourceRequest().url()) || passesAccessControlCheck(source, source->securityContext().securityOrigin(), errorDescription);
+}
+
 static double currentAge(const ResourceResponse& response, double responseTimestamp)
 {
     // RFC2616 13.2.3