<!DOCTYPE html>
<html>
<head>
<!-- FIXME: Change 'self' to 'blob:' once we fix <https://bugs.webkit.org/show_bug.cgi?id=153158>. -->
<meta http-equiv="Content-Security-Policy" content="script-src 'self' http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.php 'unsafe-inline'">
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
</script>
</head>
<body>
<p>This tests that in an isolated world the Content Security Policy of the parent origin (this page) is bypassed and a Web Worker is allowed to import a script from a different origin, not listed in script-src, through a redirect.</p>
<pre id="result"></pre>
<script>
window.onmessage = function (event)
{
    document.getElementById("result").textContent = event.data;
    if (window.testRunner)
        testRunner.notifyDone();
}

function runTest()
{
    var script = [
        'self.result = false;',
        'var exception;',
        'try {',
        '    importScripts("http://127.0.0.1:8000/security/contentSecurityPolicy/resources/redir.php?url=http://localhost:8000/security/contentSecurityPolicy/resources/script-set-value.js");',
        '} catch (e) {',
        '    exception = e;',
        '}',
        'if (exception)',
        '    self.postMessage("FAIL should not have thrown an exception. Threw exception " + exception + ".");',
        'else {',
        '    if (self.result)',
        '        self.postMessage("PASS did import script from different origin.");',
        '    else',
        '        self.postMessage("FAIL did not import script from different origin.");',
        '}',
    ].join("\n");

    var worker;
    try {
        worker = new Worker(window.URL.createObjectURL(new Blob([script])));
        worker.onmessage = function (event) { window.postMessage(event.data, "*"); }
    } catch (exception) {
        window.postMessage("FAIL should not have thrown an exception when creating worker. Threw exception " + exception + ".", "*");
    }
}

if (window.testRunner)
    testRunner.evaluateScriptInIsolatedWorld(0, runTest.toString() + ";runTest();");
</script>
</body>
</html>