<!DOCTYPE html>
<html>
<head>
    <script src="/js-test-resources/testharness.js"></script>
    <script src="/js-test-resources/testharnessreport.js"></script>
</head>
<body>
    <script>
        async_test(function (t) {
            var i = document.createElement('iframe');
            i.src = "../../resources/frame-ancestors-and-x-frame-options.pl?policy='self'&xfo=DENY";
            i.onload = t.step_func_done(function () {
                assert_equals(i.contentWindow.origin, self.origin, "The same-origin page loaded.");
            });
            document.body.appendChild(i);
        }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' header which would block the page.");

        async_test(function (t) {
            var i = document.createElement('iframe');
            i.src = "../../resources/frame-ancestors-and-x-frame-options.pl?policy=other-origin.com&xfo=SAMEORIGIN";
            i.onload = t.step_func_done(function () {
                assert_throws_dom(
                    "SecurityError",
                    function () { i.contentWindow.origin },
                    "The same-origin page was blocked and sandboxed.");
            });
            document.body.appendChild(i);
        }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' header which would allow the page.");
    </script>
</body>
</html>
