http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html

<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<meta http-equiv="X-WebKit-CSP" content="sandbox">
This test passes if it doesn't alert fail.
<iframe src="data:text/html,<script>alert('FAIL');</script>"></iframe>