Fix bug where a second CSP without script-src would cause failure

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

Index: third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 71b01c8aaf560a5c8ef420f5fb029ad373eaff51..2fa82b78f4880dc1eca819c39ba992077ea1d8de 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -391,7 +391,7 @@ bool isAllowedByAllWithContextAndContent(const CSPDirectiveListVector& policies,
     return isAllowed;
 }
 
-template<bool (CSPDirectiveList::*allowed)(const String&) const>
+template<CSPDirectiveList::NoncePolicyDisposition (CSPDirectiveList::*allowed)(const String&) const>
 bool isAllowedByAllWithNonce(const CSPDirectiveListVector& policies, const String& nonce)
 {
     bool isExplicitlyAllowed = false;
@@ -402,9 +402,11 @@ bool isAllowedByAllWithNonce(const CSPDirectiveListVector& policies, const Strin
         // better fix would be to delay the nonce processing until such time as the whitelist
         // processing fails. https://crbug.com/611652
         if (policy.get()->headerType() == ContentSecurityPolicyHeaderTypeEnforce) {
-            if (!(policy.get()->*allowed)(nonce))
+            CSPDirectiveList::NoncePolicyDisposition policyDisposition = (policy.get()->*allowed)(nonce);
+            if (policyDisposition == CSPDirectiveList::NoncePolicyDisposition::Denied)
                 return false;
-            isExplicitlyAllowed = true;
+            if (policyDisposition == CSPDirectiveList::NoncePolicyDisposition::Allowed)
+                isExplicitlyAllowed = true;
         }
     }
     return isExplicitlyAllowed;