CSP: Fire 'SecurityPolicyViolation' on the offending element.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 396 matching lines @@
             "' because the form's frame is sandboxed and the 'allow-forms' "
             "permission is not set."));
     return;
   }
 
   if (protocolIsJavaScript(submission->action())) {
     if (!document().contentSecurityPolicy()->allowFormAction(
             submission->action()))
       return;
     document().frame()->script().executeScriptIfJavaScriptURL(
-        submission->action());
+        submission->action(), this);
     return;
   }
 
   Frame* targetFrame = document().frame()->findFrameForNavigation(
       submission->target(), *document().frame());
   if (!targetFrame) {
     if (!LocalDOMWindow::allowPopUp(*document().frame()) &&
         !UserGestureIndicator::utilizeUserGesture())
       return;
     targetFrame = document().frame();
@@ skipping 378 matching lines @@
   for (const auto& control : associatedElements()) {
     if (!control->isFormControlElement())
       continue;
     if (toHTMLFormControlElement(control)->canBeSuccessfulSubmitButton())
       toHTMLFormControlElement(control)->pseudoStateChanged(
           CSSSelector::PseudoDefault);
   }
 }
 
 }  // namespace blink