The patch for bug #154122 hardcoded the directive names "img-src" and "media-src" in the implementation of ContentSecurityPolicySourceList::isProtocolAllowedByStar(). Instead we should make use of the constants in ContentSecurityPolicyDirectiveList.cpp.
I will fix this bug as part of the refactoring in the patch for bug #155842.
Fixed in <http://trac.webkit.org/changeset/198657>.