Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Ericsson AB. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "core/html/HTMLIFrameElement.h"
 
 #include "core/CSSPropertyNames.h"
 #include "core/HTMLNames.h"
+#include "core/dom/ScriptableDocumentParser.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLDocument.h"
+#include "core/html/parser/HTMLDocumentParser.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/layout/LayoutIFrame.h"
 #include "platform/RuntimeEnabledFeatures.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
-inline HTMLIFrameElement::HTMLIFrameElement(Document& document)
+// static.
+HTMLIFrameElement* HTMLIFrameElement::create(Document& document,
+                                             bool createdByFragmentParser) {
+  return new HTMLIFrameElement(document, createdByFragmentParser);
+}
+
+inline HTMLIFrameElement::HTMLIFrameElement(Document& document,
+                                            bool createdByFragmentParser)
     : HTMLFrameElementBase(iframeTag, document),
       m_didLoadNonEmptyDocument(false),
+      m_createdByFragmentParser(createdByFragmentParser),
       m_sandbox(HTMLIFrameElementSandbox::create(this)),
       m_referrerPolicy(ReferrerPolicyDefault) {}
 
-DEFINE_NODE_FACTORY(HTMLIFrameElement)
-
 DEFINE_TRACE(HTMLIFrameElement) {
   visitor->trace(m_sandbox);
   visitor->trace(m_permissions);
   HTMLFrameElementBase::trace(visitor);
   Supplementable<HTMLIFrameElement>::trace(visitor);
 }
 
 HTMLIFrameElement::~HTMLIFrameElement() {}
 
 DOMTokenList* HTMLIFrameElement::sandbox() const {
@@ skipping 161 matching lines @@
 bool HTMLIFrameElement::initializePermissionsAttribute() {
   if (!RuntimeEnabledFeatures::permissionDelegationEnabled())
     return false;
 
   if (!m_permissions)
     m_permissions = HTMLIFrameElementPermissions::create(this);
   return true;
 }
 
 }  // namespace blink