CSP: Fix 'strict-dynamic' with multiple policies.

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

Index: third_party/WebKit/Source/core/dom/ScriptLoader.cpp
diff --git a/third_party/WebKit/Source/core/dom/ScriptLoader.cpp b/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
index 615c19e836a29b4b965b1fc01fea35da0ada5464..291c178c4f1c1c25c85c5e4466a9807214be58e7 100644
--- a/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
@@ -345,21 +345,14 @@ bool ScriptLoader::fetchScript(const String& sourceUrl,
                                           crossOrigin);
     request.setCharset(scriptCharset());
 
-    // Skip fetch-related CSP checks if dynamically injected script is
-    // whitelisted and this script is not parser-inserted.
-    bool scriptPassesCSPDynamic =
-        (!isParserInserted() &&
-         elementDocument->contentSecurityPolicy()->allowDynamic());
-
-    if (ContentSecurityPolicy::isNonceableElement(m_element.get()))
+    if (ContentSecurityPolicy::isNonceableElement(m_element.get())) {
       request.setContentSecurityPolicyNonce(
           m_element->fastGetAttribute(HTMLNames::nonceAttr));
-
-    if (scriptPassesCSPDynamic) {
-      UseCounter::count(elementDocument->frame(),
-                        UseCounter::ScriptPassesCSPDynamic);
-      request.setContentSecurityCheck(DoNotCheckContentSecurityPolicy);
     }
+
+    request.setParserDisposition(isParserInserted() ? ParserInserted
+                                                    : NotParserInserted);
+
     request.setDefer(defer);
 
     String integrityAttr =