CSP: Dedicated workers always inherit policy.

third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/resources/testharness-helper.js

 function assert_no_csp_event_for_url(test, url) {
   self.addEventListener("securitypolicyviolation", test.step_func(e => {
     if (e.blockedURI !== url)
       return;
     assert_unreached("SecurityPolicyViolation event fired for " + url);
   }));
 }
 
 function assert_no_event(test, obj, name) {
   obj.addEventListener(name, test.unreached_func("The '" + name + "' event should not have fired."));
 }
 
 function waitUntilCSPEventForURL(test, url) {
   return new Promise((resolve, reject) => {
     self.addEventListener("securitypolicyviolation", test.step_func(e => {
       if (e.blockedURI == url)
         resolve(e);
     }));
   });
 }
 
+function waitUntilCSPEventForEval(test, line) {
+  return new Promise((resolve, reject) => {
+    self.addEventListener("securitypolicyviolation", test.step_func(e => {
+      if (e.blockedURI == "eval" && e.lineNumber == line)
+        resolve(e);
+    }));
+  });
+}
+
 function waitUntilEvent(obj, name) {
   return new Promise((resolve, reject) => {
     obj.addEventListener(name, resolve);
   });
 }
 
 // Given the URL of a worker that pings its opener upon load, this
 // function builds a test that asserts that the ping is received,
 // and that no CSP event fires.
 function assert_worker_is_loaded(url, description) {
@@ skipping 89 matching lines @@
       waitUntilCSPEventForURL(t, reportedURL)
         .then(t.step_func_done(e => {
           assert_equals(e.blockedURI, reportedURL);
           assert_equals(e.violatedDirective, "worker-src");
           assert_equals(e.effectiveDirective, "worker-src");
         })),
       promise_rejects(t, "SecurityError", navigator.serviceWorker.register(url, { scope: url }))
     ]);
   }, description);
 }