Bug 271377 – Frame-Ancestors directive not supported in Content-Security-Policy-Report-Only Mode

• Status: NEW
• Component: Frames

Framing a page that sets a `Content-Security-Policy-Report-Only: frame-ancestors 'none'` header results in the following error message: "The Content Security Policy directive 'frame-ancestors' is ignored when delivered in a report-only policy." in Safari only. In Chromium and Firefox, a report is generated.

The following two WPT tests already test for this behavior and it would be great for compatibility if WebKit also would report the violation here.
- https://wpt.fyi/results/content-security-policy/frame-ancestors/report-only-frame.sub.html?label=master&label=experimental&aligned&q=frame-ancestors
- https://wpt.fyi/results/content-security-policy/reporting/report-frame-ancestors-with-x-frame-options.sub.html?label=master&label=experimental&aligned&q=frame-ancestors

[Karl Dubost]

The first test
http://wpt.live/content-security-policy/frame-ancestors/report-only-frame.sub.html
fails with (No asserts ran)
   undefined is not an object (evaluating 'data[0]["body"]')
only in Safari

The second test fails
http://wpt.live/content-security-policy/reporting/report-frame-ancestors-with-x-frame-options.sub.html
fails with (No asserts ran) 
Safari:  undefined is not an object (evaluating 'data[0]["body"]')
Firefox: can't access property "body", data[0] is undefined

[Radar WebKit Bug Importer]

<rdar://problem/125210248>

The second test failing in Firefox is not due to the feature the test wants to test but due to the fact that a download is triggered in Firefox only: https://github.com/web-platform-tests/wpt/issues/45249