Block renderer-initiated main frame navigations to data URLs

third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-with-own-policy-window-open.html

Index: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-with-own-policy-window-open.html
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-with-own-policy-window-open.html b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-with-own-policy-window-open.html
index ce49fab009ad4435e531fd6f05ce27a25cd5a30b..f77bd32325e07db18a89f4ddd3db4cb2101beaa0 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-with-own-policy-window-open.html
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-with-own-policy-window-open.html
@@ -18,14 +18,16 @@
       t.done();
     }));
 
-    window.open("data:text/html," +
-                "<meta http-equiv='content-security-policy' content='img-src http://127.0.0.1:8000'>" +
-                "<script>" + 
-                "  var i = document.createElement('img');" +
-                "  i.onload = _ => opener.postMessage('loaded', '*');" +
-                "  i.onerror = _ => opener.postMessage('blocked', '*');" +
-                "  i.src = 'http://example.test:8000/resources/square.png?data-frame'" +
-                "</scr" + "ipt>");
+    var win = window.open("about:blank");
+    win.document.write(
+        "<meta http-equiv='content-security-policy'" +
+        "    content='img-src http://127.0.0.1:8000'>" +
+        "<script>" +
+        "  var i = document.createElement('img');" +
+        "  i.onload = _ => opener.postMessage('loaded', '*');" +
+        "  i.onerror = _ => opener.postMessage('blocked', '*');" +
+        "  i.src = 'http://example.test:8000/resources/square.png?data-frame'" +
+        "</scr" + "ipt>");
   }, "Image loaded via data: frame blocked.");
 </script>
 </body>