Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
index 12457460b7b20b3f17c50c8fe861b380e63af822..4eba7560097d4813c9a8c6250394a9db3c38c8f7 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
@@ -26,8 +26,10 @@
 
 #include "core/CSSPropertyNames.h"
 #include "core/HTMLNames.h"
+#include "core/dom/ScriptableDocumentParser.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLDocument.h"
+#include "core/html/parser/HTMLDocumentParser.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/layout/LayoutIFrame.h"
 #include "platform/RuntimeEnabledFeatures.h"
@@ -36,14 +38,20 @@ namespace blink {
 
 using namespace HTMLNames;
 
-inline HTMLIFrameElement::HTMLIFrameElement(Document& document)
+// static.
+HTMLIFrameElement* HTMLIFrameElement::create(Document& document,
+                                             bool createdByFragmentParser) {
+  return new HTMLIFrameElement(document, createdByFragmentParser);
+}
+
+inline HTMLIFrameElement::HTMLIFrameElement(Document& document,
+                                            bool createdByFragmentParser)
     : HTMLFrameElementBase(iframeTag, document),
       m_didLoadNonEmptyDocument(false),
+      m_createdByFragmentParser(createdByFragmentParser),
       m_sandbox(HTMLIFrameElementSandbox::create(this)),
       m_referrerPolicy(ReferrerPolicyDefault) {}
 
-DEFINE_NODE_FACTORY(HTMLIFrameElement)
-
 DEFINE_TRACE(HTMLIFrameElement) {
   visitor->trace(m_sandbox);
   visitor->trace(m_permissions);