Experiment with blocking script inside fragment-parser-inserted `<iframe srcdoc>`.

third_party/WebKit/Source/core/html/HTMLIFrameElement.h

Index: third_party/WebKit/Source/core/html/HTMLIFrameElement.h
diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElement.h b/third_party/WebKit/Source/core/html/HTMLIFrameElement.h
index 51ae060faa6306b585b3fff35a19ac7bb79f37bc..4ac5c084e15475378c0416bf4431ce835e5a437f 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElement.h
@@ -41,17 +41,19 @@ class CORE_EXPORT HTMLIFrameElement final
   USING_GARBAGE_COLLECTED_MIXIN(HTMLIFrameElement);
 
  public:
-  DECLARE_NODE_FACTORY(HTMLIFrameElement);
   DECLARE_VIRTUAL_TRACE();
+
+  static HTMLIFrameElement* create(Document&, bool createdByFragmentParser);
   ~HTMLIFrameElement() override;
   DOMTokenList* sandbox() const;
   DOMTokenList* permissions() const;
+  bool createdByFragmentParser() const { return m_createdByFragmentParser; }
 
   void sandboxValueWasSet();
   void permissionsValueWasSet();
 
  private:
-  explicit HTMLIFrameElement(Document&);
+  HTMLIFrameElement(Document&, bool createdByFragmentParser);
 
   void parseAttribute(const AttributeModificationParams&) override;
   bool isPresentationAttribute(const QualifiedName&) const override;
@@ -88,6 +90,7 @@ class CORE_EXPORT HTMLIFrameElement final
   bool m_didLoadNonEmptyDocument;
   bool m_allowFullscreen;
   bool m_allowPaymentRequest;
+  const bool m_createdByFragmentParser;
   Member<HTMLIFrameElementSandbox> m_sandbox;
   Member<HTMLIFrameElementPermissions> m_permissions;