`chrome-extension` resources should bypass Content Security Policy.

chrome/browser/extensions/extension_resource_request_policy_apitest.cc

Index: chrome/browser/extensions/extension_resource_request_policy_apitest.cc
diff --git a/chrome/browser/extensions/extension_resource_request_policy_apitest.cc b/chrome/browser/extensions/extension_resource_request_policy_apitest.cc
index 7d64210bafdb829677bcfaa775e523441174a7b0..ea1a9aaff141328d440c59df5cf1c762005b7da6 100644
--- a/chrome/browser/extensions/extension_resource_request_policy_apitest.cc
+++ b/chrome/browser/extensions/extension_resource_request_policy_apitest.cc
@@ -217,6 +217,26 @@ IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest,
   EXPECT_EQ("Loading CER:// failed.", result);
 }
 
+IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest,
+                       WebAccessibleResourcesWithCSP) {
+  std::string result;
+  ASSERT_TRUE(test_server()->Start());
+  ASSERT_TRUE(LoadExtension(test_data_dir_
+      .AppendASCII("extension_resource_request_policy")
+      .AppendASCII("web_accessible")));
+
+  GURL accessible_resource_with_csp(
+      test_server()->GetURL(
+          "files/extensions/api_test/extension_resource_request_policy/"
+          "web_accessible/accessible_resource_with_csp.html"));
+  ui_test_utils::NavigateToURL(browser(), accessible_resource_with_csp);
+  ASSERT_TRUE(content::ExecuteJavaScriptAndExtractString(
+    chrome::GetActiveWebContents(browser())->GetRenderViewHost(), L"",
+      L"window.domAutomationController.send(document.title)",
+    &result));
+  EXPECT_EQ("Loaded", result);
+}
+
 IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest, Iframe) {
   // Load another extension, which the test one shouldn't be able to get
   // resources from.