CSP: Fire 'SecurityPolicyViolation' on the offending element.

third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

Index: third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
index 3f4d6b33e573d7ba9b44cedc90a9d22e4a78f319..c32e0ed4a57cc677b02865580e13470ff555c45d 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
@@ -331,7 +331,8 @@ bool ScriptController::canExecuteScripts(
   return allowed;
 }
 
-bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url) {
+bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url,
+                                                    Element* element) {
   if (!protocolIsJavaScript(url))
     return false;
 
@@ -340,8 +341,10 @@ bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url) {
   if (!frame()->page() ||
       (!shouldBypassMainWorldContentSecurityPolicy &&
        !frame()->document()->contentSecurityPolicy()->allowJavaScriptURLs(
-           frame()->document()->url(), eventHandlerPosition().m_line)))
+           element, frame()->document()->url(),
+           eventHandlerPosition().m_line))) {
     return true;
+  }
 
   bool progressNotificationsNeeded =
       frame()->loader().stateMachine()->isDisplayingInitialEmptyDocument() &&