diff --git a/preload/subresource-integrity.html b/preload/subresource-integrity.html
index a1c867e2911cba..f4ff950924e300 100644
--- a/preload/subresource-integrity.html
+++ b/preload/subresource-integrity.html
@@ -309,6 +309,51 @@
{integrity: "sha256-deaddeadbeefYHFvsYdWumweeFAw0hJDTFt9seErghA="}
)
+ SRIPreloadTest(
+ true,
+ true,
+ `Same-origin ${destination} with matching digest does not reuse preload without digest.`,
+ 2,
+ destination,
+ same_origin_prefix + destination + ext + `?${token()}`,
+ {},
+ {integrity: sha256}
+ )
+
+ // This is an acceptable failure
+ SRIPreloadTest(
+ true,
+ true,
+ `[Tentative] Same-origin ${destination} with matching digest does not reuse preload with matching but stronger digest.`,
+ 2,
+ destination,
+ same_origin_prefix + destination + ext + `?${token()}`,
+ {integrity: sha384},
+ {integrity: sha256},
+ )
+
+ SRIPreloadTest(
+ true,
+ true,
+ `Same-origin ${destination} with matching digest does not reuse preload with matching but weaker digest.`,
+ 2,
+ destination,
+ same_origin_prefix + destination + ext + `?${token()}`,
+ {integrity: sha256},
+ {integrity: sha384},
+ )
+
+ SRIPreloadTest(
+ true,
+ false,
+ `Same-origin ${destination} with non-matching digest reuses preload with no digest but fails.`,
+ 2,
+ destination,
+ same_origin_prefix + destination + ext + `?${token()}`,
+ {},
+ {integrity: "sha256-sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"},
+ )
+
} // if.
} // for-of.
diff --git a/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html b/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
index f1ff7ae59a7deb..28c3071804767b 100644
--- a/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
+++ b/service-workers/service-worker/fetch-canvas-tainting-video-with-range-request.https.html
@@ -63,12 +63,11 @@
// (3) Range responses come from multiple origins. The first response comes from
// cross-origin (and without CORS sharing, so is opaque). Subsequent
-// responses come from same-origin. The canvas should be tainted (but in
-// Chrome this is a LOAD_ERROR since it disallows range responses from
-// multiple origins, period).
+// responses come from same-origin. This should result in a load error, as regardless of canvas
+// loading range requests from multiple opaque origins can reveal information across those origins.
range_request_test(
'resources/range-request-to-different-origins-worker.js',
- 'TAINTED',
+ 'LOAD_ERROR',
'range responses from multiple origins (cross-origin first)');
// (4) Range responses come from multiple origins. The first response comes from