PlzNavigate: Enforce 'frame-src' CSP on the browser.

chrome/test/data/extensions/api_test/sandboxed_pages_csp/sandboxed.html

 This page should be sandboxed.
 
 <script>
 // We're not served with the extension default CSP, we can use inline script.
 
+var sendResponse = function(msg) {
+  var mainWindow = window.opener || window.top;
+  mainWindow.postMessage(msg, '*');
+};
+
+var remote_frame_loaded = false;
+window.addEventListener('securitypolicyviolation', function(e) {
+  if (remote_frame_loaded)
+    sendResponse('succeeded');
+  else
+    sendResponse('failed');
+});
+
 var loadFrameExpectResponse = function(iframe, url) {
   var identifier = performance.now();
   return new Promise(function(resolve, reject) {
     window.addEventListener('message', function(e) {
       var data = JSON.parse(e.data);
       if (data[0] == 'local frame msg' && data[1] == identifier) {
         resolve();
       } else {
         reject();
       }
     });
     iframe.onerror = reject;
     iframe.onload = function() {
       iframe.contentWindow.postMessage(
           JSON.stringify(['sandboxed frame msg', identifier]), '*');
     };
     iframe.src = url;
   });
 };
 
 var runTestAndRespond = function(localUrl, remoteUrl) {
   var iframe = document.createElement('iframe');
-  var sendResponse = function(msg) {
-    var mainWindow = window.opener || window.top;
-    mainWindow.postMessage(msg, '*');
-  };
 
   // First load local resource in |iframe|, expect the local frame to respond.
   loadFrameExpectResponse(iframe, localUrl).then(function() {
     // Then try to load remote resource on the same iframe element. The remote
     // resource will fail to load but we'd get an iframe.onload event and the
     // local frame will still be there. Therefore, expect the local frame to
     // respond again.
+    // PlzNavigate: The first local frame has been replaced by an error page.

[alexmos, 2017/02/24 06:40:27]

nit: s/has been/will be/

Alternatively, we could just remove "the local frame will still be there. 
Therefore, expect the local frame to respond again." and this sentence.  Since
the eventual goal is to always go to the error page in both modes, and we will
probably forget to go back and update this comment once we do that.  Just saying
that we rely on the SecurityPolicyViolationEvent to detect that the frame has
been blocked might be good enough.

[arthursonzogni, 2017/02/24 16:13:29]

Done.

+    // Instead, rely on the SecurityPolicyViolationEvent to detect that the
+    // frame has been blocked.
+    remote_frame_loaded = true;
     return loadFrameExpectResponse(iframe, remoteUrl);
   }).then(function() {
     sendResponse('succeeded');
   }).catch(function(err) {
     sendResponse('failed');
   });
   document.body.appendChild(iframe);
 };
 
 onmessage = function(e) {
   var command = JSON.parse(e.data);
   if (command[0] == 'load') {
     var localUrl = command[1];
     var remoteUrl = command[2];
     runTestAndRespond(localUrl, remoteUrl);
   }
 };
 
 </script>