Recommit Enable SRI only for same origin and CORS content

Source/core/dom/ScriptLoader.cpp

Index: Source/core/dom/ScriptLoader.cpp
diff --git a/Source/core/dom/ScriptLoader.cpp b/Source/core/dom/ScriptLoader.cpp
index 3a958ad19594839403ad96db6918c898161ffae7..e5f117d0674de95638fcd0353c74521e05d32d9b 100644
--- a/Source/core/dom/ScriptLoader.cpp
+++ b/Source/core/dom/ScriptLoader.cpp
@@ -351,9 +351,6 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
             UseCounter::count(frame, UseCounter::BlockedSniffingImageToScript);
             return;
         }
-
-        if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), sourceCode.resource()->mimeType()))
-            return;
     }
 
     // FIXME: Can this be moved earlier in the function?
@@ -361,6 +358,17 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
     if (!frame)
         return;
 
+    AccessControlStatus corsCheck = NotSharableCrossOrigin;
+    if (!m_isExternalScript || (sourceCode.resource() && sourceCode.resource()->passesAccessControlCheck(&m_element->document(), m_element->document().securityOrigin())))
+        corsCheck = SharableCrossOrigin;
+
+    if (m_isExternalScript) {
+        const KURL resourceUrl = sourceCode.resource()->resourceRequest().url();
+        if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), sourceCode.resource()->mimeType(), *sourceCode.resource())) {
+            return;
+        }
+    }
+
     const bool isImportedScript = contextDocument != elementDocument;
     // http://www.whatwg.org/specs/web-apps/current-work/#execute-the-script-block step 2.3
     // with additional support for HTML imports.
@@ -369,10 +377,6 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode, double* com
     if (isHTMLScriptLoader(m_element))
         contextDocument->pushCurrentScript(toHTMLScriptElement(m_element));
 
-    AccessControlStatus corsCheck = NotSharableCrossOrigin;
-    if (!m_isExternalScript || (sourceCode.resource() && sourceCode.resource()->passesAccessControlCheck(&m_element->document(), m_element->document().securityOrigin())))
-        corsCheck = SharableCrossOrigin;
-
     // Create a script from the script element node, using the script
     // block's source and the script block's type.
     // Note: This is where the script is compiled and actually executed.