Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/core/dom/Document.h

Index: third_party/WebKit/Source/core/dom/Document.h
diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index a46b828b0d4250ef3dbc38e41f2e50ca8da52f57..f4b3d4b85eaa081b97540e286c804ac805782bd5 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h
@@ -437,6 +437,12 @@ class CORE_EXPORT Document : public ContainerNode,
   bool isSrcdocDocument() const { return m_isSrcdocDocument; }
   bool isMobileDocument() const { return m_isMobileDocument; }
 
+  // True if this document is an IFrame srcdoc document, and the frame in which
+  // it lives was created by a fragment parser (e.g. 'innerHTML').
+  bool isFragmentParserCreatedSrcdoc() const {
+    return m_isFragmentParserCreatedSrcdoc;
+  }
+
   StyleResolver* styleResolver() const;
   StyleResolver& ensureStyleResolver() const;
 
@@ -1594,6 +1600,7 @@ class CORE_EXPORT Document : public ContainerNode,
   bool m_sawElementsInKnownNamespaces;
   bool m_isSrcdocDocument;
   bool m_isMobileDocument;
+  bool m_isFragmentParserCreatedSrcdoc;
 
   LayoutView* m_layoutView;