good first issuetopic: canvas
描述
Rejects the promise with a "SecurityError" DOMException if the script is not allowed to access the image data of the source image (e.g. a video that is CORS-cross-origin, or a canvas being drawn on by a script in a worker from another origin).
Creating Bitmap image from CORS-cross-origin source shouldn't be an issue. Especially there's a origin-clean logic in createImageBitmap