<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
<iframe src="about:blank"></iframe>
WebAssembly should be blocked in the iframe, but inline script should be allowed.
<script>
window.onload = function() {
    frames[0].document.write("<script>alert(/PASS/); new WebAssembly.Instance(new WebAssembly.Module(Uint8Array.of(0x0, 0x61, 0x73, 0x6d, 0x1, 0x00, 0x00, 0x00)));<\/script>");
}
</script>