Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/core/dom/Document.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 419 matching lines @@
     return m_documentClasses & MediaDocumentClass;
   }
 
   bool hasSVGRootNode() const;
 
   bool isFrameSet() const;
 
   bool isSrcdocDocument() const { return m_isSrcdocDocument; }
   bool isMobileDocument() const { return m_isMobileDocument; }
 
+  // True if this document is an IFrame srcdoc document, and the frame in which
+  // it lives was created by a fragment parser (e.g. 'innerHTML').
+  bool isFragmentParserCreatedSrcdoc() const {
+    return m_isFragmentParserCreatedSrcdoc;
+  }
+
   StyleResolver* styleResolver() const;
   StyleResolver& ensureStyleResolver() const;
 
   bool isViewSource() const { return m_isViewSource; }
   void setIsViewSource(bool);
 
   bool sawElementsInKnownNamespaces() const {
     return m_sawElementsInKnownNamespaces;
   }
 
@@ skipping 1137 matching lines @@
   // the cache object's references will be traced by a stack walk.
   GC_PLUGIN_IGNORE("461878")
   NthIndexCache* m_nthIndexCache = nullptr;
 
   DocumentClassFlags m_documentClasses;
 
   bool m_isViewSource;
   bool m_sawElementsInKnownNamespaces;
   bool m_isSrcdocDocument;
   bool m_isMobileDocument;
+  bool m_isFragmentParserCreatedSrcdoc;
 
   LayoutView* m_layoutView;
 
   WeakMember<Document> m_contextDocument;
 
   // For early return in Fullscreen::fromIfExists()
   bool m_hasFullscreenSupplement;
 
   HeapVector<Member<Element>> m_topLayerElements;
 
@@ skipping 115 matching lines @@
 DEFINE_TYPE_CASTS(TreeScope, Document, document, true, true);
 
 }  // namespace blink
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 CORE_EXPORT void showLiveDocumentInstances();
 #endif
 
 #endif  // Document_h