Adjust the <script nonce>-hiding experiment

third_party/WebKit/Source/core/svg/SVGScriptElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGScriptElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGScriptElement.cpp b/third_party/WebKit/Source/core/svg/SVGScriptElement.cpp
index c0f801a411d0977f340d5889417a038bcf6e6cb0..96455cdd83e3836f3a58f23a22348cf22f22d3e6 100644
--- a/third_party/WebKit/Source/core/svg/SVGScriptElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGScriptElement.cpp
@@ -27,6 +27,7 @@
 #include "core/dom/ScriptLoader.h"
 #include "core/dom/ScriptRunner.h"
 #include "core/events/Event.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 
 namespace blink {
 
@@ -36,13 +37,7 @@ inline SVGScriptElement::SVGScriptElement(Document& document,
     : SVGElement(SVGNames::scriptTag, document),
       SVGURIReference(this),
       m_loader(
-          ScriptLoader::create(this, wasInsertedByParser, alreadyStarted)) {
-  if (fastHasAttribute(HTMLNames::nonceAttr)) {
-    m_nonce = fastGetAttribute(HTMLNames::nonceAttr);
-    if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled())
-      removeAttribute(HTMLNames::nonceAttr);
-  }
-}
+          ScriptLoader::create(this, wasInsertedByParser, alreadyStarted)) {}
 
 SVGScriptElement* SVGScriptElement::create(Document& document,
                                            bool insertedByParser) {
@@ -56,6 +51,14 @@ void SVGScriptElement::parseAttribute(
         EventTypeNames::error,
         createAttributeEventListener(this, params.name, params.newValue,
                                      eventParameterName()));
+  } else if (params.name == HTMLNames::nonceAttr) {
+    if (params.newValue == ContentSecurityPolicy::getNonceReplacementString())
+      return;
+    setNonce(params.newValue);
+    if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled()) {
+      setAttribute(HTMLNames::nonceAttr,
+                   ContentSecurityPolicy::getNonceReplacementString());
+    }
   } else {
     SVGElement::parseAttribute(params);
   }