[HTML Import] Respect Content Security Policy Model

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 69c36ad35b5583cd08a0bf2d927ceba7fe50c16c..7a2e3f07e09d2cb4f7cc612f70e03046db7c9e8f 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -4114,6 +4114,9 @@ void Document::finishedParsing()
 
     // Parser should have picked up all preloads by now
     m_fetcher->clearPreloads();
+
+    if (m_import)
+        m_import->didFinishParsing();
 }
 
 void Document::sharedObjectPoolClearTimerFired(Timer<Document>*)
@@ -4213,7 +4216,7 @@ void Document::initSecurityContext(const DocumentInit& initializer)
         return;
     }
 
-    if (!initializer.frame()) {
+    if (!initializer.hasSecurityContext()) {
         // No source for a security context.
         // This can occur via document.implementation.createDocument().
         m_cookieURL = KURL(ParsedURLString, emptyString());
@@ -4285,12 +4288,11 @@ void Document::initSecurityContext(const DocumentInit& initializer)
     setSecurityOrigin(ownerFrame->document()->securityOrigin());
 }
 
-void Document::initContentSecurityPolicy()
+void Document::initContentSecurityPolicy(const ContentSecurityPolicyResponseHeaders& headers)
 {
-    if (!m_frame->tree()->parent() || (!shouldInheritSecurityOriginFromOwner(m_url) && !isPluginDocument()))
-        return;
-
-    contentSecurityPolicy()->copyStateFrom(m_frame->tree()->parent()->document()->contentSecurityPolicy());
+    if (m_frame && m_frame->tree()->parent() && (shouldInheritSecurityOriginFromOwner(m_url) || isPluginDocument()))
+        contentSecurityPolicy()->copyStateFrom(m_frame->tree()->parent()->document()->contentSecurityPolicy());
+    contentSecurityPolicy()->didReceiveHeaders(headers);
 }
 
 void Document::didUpdateSecurityOrigin()