Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/build/scripts/templates/ElementFactory.cpp.tmpl

 {% from "macros.tmpl" import license %}
 {{ license() }}
 
 #include "{{namespace}}ElementFactory.h"
 
 #include "{{namespace}}Names.h"
 {% for tag in tags|groupby('interface') %}
 #include "core/{{namespace|lower}}/{{tag[0]}}.h"
 {% endfor %}
 {% if fallback_interface %}
@@ skipping 26 matching lines @@
     Document& document,
     CreateElementFlags flags) {
   {% if tag.runtimeEnabled %}
   if (!RuntimeEnabledFeatures::{{tag.runtimeEnabled}}Enabled())
     return {{fallback_interface}}::create({{tag|symbol}}Tag, document);
   {% endif %}
   return {{tag.interface}}::create(
       {%- if tag.multipleTagNames %}{{tag|symbol}}Tag, {% endif -%}
       document
       {%- if tag.constructorNeedsCreatedByParser %}, flags & CreatedByParser{% endif -%}
+      {%- if tag.constructorNeedsCreatedByFragmentParser %}, (flags & CreatedByFragmentParser) == CreatedByFragmentParser{% endif -%}
   );
 }
 {% endfor %}
 
 struct Create{{namespace}}FunctionMapData {
   const QualifiedName& tag;
   ConstructorFunction func;
 };
 
 static void create{{namespace}}FunctionMap() {
@@ skipping 38 matching lines @@
     Element* element = document.registrationContext()->createCustomTagElement(
         document, QualifiedName(nullAtom, localName, {{namespace_prefix}}NamespaceURI));
     SECURITY_DCHECK(element->is{{namespace}}Element());
     return to{{namespace}}Element(element);
   }
 
   return {{fallback_interface}}::create(QualifiedName(nullAtom, localName, {{namespace_prefix}}NamespaceURI), document);
 }
 
 } // namespace blink