CSP: Move policy parsing out of Document.

Source/core/workers/WorkerGlobalScope.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 85 matching lines @@
     m_workerClients->reattachThread();
     m_thread->setWorkerInspectorController(m_workerInspectorController.get());
 }
 
 WorkerGlobalScope::~WorkerGlobalScope()
 {
 }
 
 void WorkerGlobalScope::applyContentSecurityPolicyFromString(const String& policy, ContentSecurityPolicyHeaderType contentSecurityPolicyType)
 {
-    setContentSecurityPolicy(ContentSecurityPolicy::create(this));
-    contentSecurityPolicy()->didReceiveHeader(policy, contentSecurityPolicyType, ContentSecurityPolicyHeaderSourceHTTP);
+    // FIXME: This doesn't match the CSP2 spec's Worker behavior (see https://w3c.github.io/webappsec/specs/content-security-policy/#processing-model-workers)
+    RefPtr<ContentSecurityPolicy> csp = ContentSecurityPolicy::create();
+    csp->didReceiveHeader(policy, contentSecurityPolicyType, ContentSecurityPolicyHeaderSourceHTTP);
+    csp->bindToExecutionContext(executionContext());
+    setContentSecurityPolicy(csp);
 }
 
 ExecutionContext* WorkerGlobalScope::executionContext() const
 {
     return const_cast<WorkerGlobalScope*>(this);
 }
 
 const KURL& WorkerGlobalScope::virtualURL() const
 {
     return m_url;
@@ skipping 214 matching lines @@
     visitor->trace(m_workerInspectorController);
     visitor->trace(m_eventQueue);
     visitor->trace(m_workerClients);
     visitor->trace(m_messageStorage);
     WillBeHeapSupplementable<WorkerGlobalScope>::trace(visitor);
     ExecutionContext::trace(visitor);
     EventTargetWithInlineData::trace(visitor);
 }
 
 } // namespace blink