Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 440 matching lines @@
       m_hasXMLDeclaration(0),
       m_designMode(false),
       m_isRunningExecCommand(false),
       m_hasAnnotatedRegions(false),
       m_annotatedRegionsDirty(false),
       m_documentClasses(documentClasses),
       m_isViewSource(false),
       m_sawElementsInKnownNamespaces(false),
       m_isSrcdocDocument(false),
       m_isMobileDocument(false),
+      m_isFragmentParserCreatedSrcdoc(false),
       m_layoutView(0),
       m_contextDocument(initializer.contextDocument()),
       m_hasFullscreenSupplement(false),
       m_loadEventDelayCount(0),
       m_loadEventDelayTimer(TaskRunnerHelper::get(TaskType::Networking, this),
                             this,
                             &Document::loadEventDelayTimerFired),
       m_pluginLoadingTimer(
           TaskRunnerHelper::get(TaskType::UnspecedLoading, this),
           this,
@@ skipping 5004 matching lines @@
         // Some clients do not want local URLs to have access to other local
         // URLs.
         getSecurityOrigin()->blockLocalAccessFromLocalOrigin();
       }
     }
   }
 
   if (initializer.shouldTreatURLAsSrcdocDocument()) {
     m_isSrcdocDocument = true;
     setBaseURLOverride(initializer.parentBaseURL());
+
+    if (Element* owner = domWindow()->frameElement()) {
+      HTMLIFrameElement* iframe = toHTMLIFrameElement(owner);
+      m_isFragmentParserCreatedSrcdoc =
+          iframe->createdByFragmentParser() ||
+          iframe->document().isFragmentParserCreatedSrcdoc();
+    }
   }
 
   if (getSecurityOrigin()->isUnique() &&
       SecurityOrigin::create(m_url)->isPotentiallyTrustworthy())
     getSecurityOrigin()->setUniqueOriginIsPotentiallyTrustworthy(true);
 
   if (getSecurityOrigin()->hasSuborigin())
     enforceSuborigin(*getSecurityOrigin()->suborigin());
 }
 
@@ skipping 1040 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif