commit ebdd6c2a1567b09457dd6088d03bbc49d4412e46
author Hiroki Nakagawa <nhiroki@chromium.org> Wed May 08 23:57:21 2019
committer Commit Bot <commit-bot@chromium.org> Wed May 08 23:57:21 2019
tree 04b9cb347c540da7c99d1969411b60e8959b7c75
parent 3eac1795e4c3e46a65bebd8daebeaeb8894ad4d6

Worker: Respect CSP for eval() on workers when off-the-main-thread script fetch is enabled

This CL allows to call WorkerOrWorkletScriptController::DisableEval() after
WorkerOrWorkletScriptController::Initialize() to make it possible to disallow
JS's eval() by CSP headers when off-the-main-thread worker script fetch is
enabled.

=== Details ===

WorkerOrWorkletScriptContoller::DisableEval() just stashes a request to disable
`eval()`, and Initialize() actually disables it. Therefore, DisableEval() must
be called before Initialize().

In the current implementation, Initialize() is called from
WorkerThread::InitializeOnWorkerThread() during worker thread startup. This
works well for on-the-main-thread script fetch because the worker script is
fetched before the worker thread startup, and DisableEval() is called based on
worker script's CSP headers before Initialize().

On the other hand, with off-the-main-thread script fetch, the worker script is
fetched on the worker thread after InitializeOnWorkerThread(), and DisableEval()
is also called after InitializeOnWorkerThread(), so eval() is not affected by
the CSP headers. This CL fixes it.

In addition, this CL fixes failing tests for installed service workers that
behave like off-the-main-thread worker script fetch.

Design doc:
https://docs.google.com/document/d/1JCv8TD2nPLNC2iRCp_D1OM4I3uTS0HoEobuTymaMqgw/edit?usp=sharing

Bug: 940316, 937168, 960770
Change-Id: Iba46ad5b67f4013753c061241bd35aafc68ae680
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1514337
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Commit-Position: refs/heads/master@{#657928}