CSP: Fire 'SecurityPolicyViolation' on the offending element.

third_party/WebKit/Source/web/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 449 matching lines @@
   return v8::Local<v8::Object>::Cast(v8value);
 }
 
 WebString WebPluginContainerImpl::executeScriptURL(const WebURL& url,
                                                    bool popupsAllowed) {
   LocalFrame* frame = m_element->document().frame();
   if (!frame)
     return WebString();
 
   if (!m_element->document().contentSecurityPolicy()->allowJavaScriptURLs(
-          m_element->document().url(), OrdinalNumber()))
+          m_element, m_element->document().url(), OrdinalNumber())) {
     return WebString();
+  }
 
   const KURL& kurl = url;
   DCHECK(kurl.protocolIs("javascript"));
 
   String script = decodeURLEscapeSequences(
       kurl.getString().substring(strlen("javascript:")));
 
   UserGestureIndicator gestureIndicator(
       popupsAllowed ? UserGestureToken::create(UserGestureToken::NewGesture)
                     : nullptr);
@@ skipping 488 matching lines @@
     // frame view.
     computeClipRectsForPlugin(m_element, windowRect, clipRect, unobscuredRect);
   }
   getPluginOcclusions(m_element, this->parent(), frameRect(), cutOutRects);
   // Convert to the plugin position.
   for (size_t i = 0; i < cutOutRects.size(); i++)
     cutOutRects[i].move(-frameRect().x(), -frameRect().y());
 }
 
 }  // namespace blink