CSP 'self' is not interpreted correctly for iframes,

Source/core/frame/csp/ContentSecurityPolicy.cpp

Index: Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/Source/core/frame/csp/ContentSecurityPolicy.cpp b/Source/core/frame/csp/ContentSecurityPolicy.cpp
index ba5235d9515eaadf96442b21c6efc137753c865a..74ae698abfccc7a1de0bd3d555e82aa0ec4c2872 100644
--- a/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -155,9 +155,18 @@ void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionCo
 void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext()
 {
     ASSERT(m_executionContext);
-    // Ensure that 'self' processes correctly.
-    m_selfProtocol = securityOrigin()->protocol();
-    m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin()->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource::NoWildcard));
+    // Ensure that 'self' processes correctly. Note that this uses the URL of
+    // the context, not the security origin. That's because in the sandbox
+    // case, the origin is 'unique' (which, in practice, gives an empty scheme,
+    // host, and port). However, regarding matching the 'self' source, the CSP
+    // spec
+    // (https://w3c.github.io/webappsec/specs/content-security-policy/#match-source-expression)
+    // reads: "Return does match if the URL has the same scheme, host, and port
+    // as the protected resource’s URL". Thus, if Chrome were to store the
+    // 'unqiue' origin in m_selfSource, it would match nothing, even though it
+    // should match resources that are loaded at the same URL it loaded from.
+    m_selfProtocol = m_executionContext->url().protocol();
+    m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, m_executionContext->url().host(), m_executionContext->url().port(), String(), CSPSource::NoWildcard, CSPSource::NoWildcard));
 
     // If we're in a Document, set the referrer policy, mixed content checking, and sandbox
     // flags, then dump all the parsing error messages, then poke at histograms.