http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<meta http-equiv="X-WebKit-CSP" content="sandbox allow-scripts">
This test passes if it does alert pass.
<iframe src="data:text/html,<script>alert('PASS');</script>"></iframe>