Add tests for srcdoc documents
diff --git a/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing-2.html b/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing-2.html
new file mode 100644
index 0000000..2e19dd1
--- /dev/null
+++ b/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing-2.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Sandbox Navigation Timing</title>
+    <script src=/resources/testharness.js></script>
+    <script src=/resources/testharnessreport.js></script>
+  </head>
+  <body>
+    <script>
+    async_test(t => {
+      const iframe = document.createElement('iframe');
+      document.body.appendChild(iframe);
+
+      // Construction of the srcdoc document should be initiated here. The value
+      // of the sandbox attribute should be snapshotted.
+      iframe.srcdoc = "<scr" + "ipt>try{parent.document.body;" +
+        "parent.postMessage(\"Not sandboxed\",\"*\")}catch(e){" +
+        "parent.postMessage(\"Sandboxed\",\"*\")}</scr" + "ipt>";
+
+      // Manipulating the sandbox attribute at this point should not affect the
+      // sandbox flags used for the document in the iframe.
+      iframe.sandbox = 'allow-scripts';
+
+      // After navigation, child frame should not be sandboxed.
+      window.onmessage = t.step_func_done(e => {
+        assert_equals(e.data, 'Not sandboxed');
+      });
+    }, "Setting sandbox attribute after srcdoc attribute is set should not" +
+       " affect document in srcdoc iframe.");
+    </script>
+  </body>
+</html>
diff --git a/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing-3.html b/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing-3.html
new file mode 100644
index 0000000..10b2eca
--- /dev/null
+++ b/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing-3.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Sandbox Navigation Timing</title>
+    <script src=/resources/testharness.js></script>
+    <script src=/resources/testharnessreport.js></script>
+  </head>
+  <body>
+    <script>
+    async_test(t => {
+      const iframe = document.createElement('iframe');
+
+      iframe.srcdoc = "<scr" + "ipt>try{parent.document.body;" +
+        "parent.postMessage(\"Not sandboxed\",\"*\")}catch(e){" +
+        "parent.postMessage(\"Sandboxed\",\"*\")}</scr" + "ipt>";
+      iframe.sandbox = 'allow-scripts';
+
+      // Construction of the srcdoc document should be initiated here. The value
+      // of the sandbox attribute should be snapshotted.
+      document.body.appendChild(iframe);
+
+      // Manipulating the sandbox attribute at this point should not affect the
+      // sandbox flags used for the document in the iframe.
+      iframe.removeAttribute('sandbox');
+
+      // After navigation, child frame should still be sandboxed.
+      window.onmessage = t.step_func_done(e => {
+        assert_equals(e.data, 'Sandboxed');
+      });
+    }, "Removing sandbox attribute after iframe is attached to document" +
+       " should not affect document in srcdoc iframe.");
+    </script>
+  </body>
+</html>
diff --git a/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing.html b/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing.html
new file mode 100644
index 0000000..7135efa
--- /dev/null
+++ b/html/browsers/sandboxing/sandbox-srcdoc-navigation-timing.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Sandbox Navigation Timing</title>
+    <script src=/resources/testharness.js></script>
+    <script src=/resources/testharnessreport.js></script>
+  </head>
+  <body>
+    <script>
+    async_test(t => {
+      const iframe = document.createElement('iframe');
+
+      iframe.srcdoc = "<scr" + "ipt>try{parent.document.body;" +
+        "parent.postMessage(\"Not sandboxed\",\"*\")}catch(e){" +
+        "parent.postMessage(\"Sandboxed\",\"*\")}</scr" + "ipt>";
+
+      // Construction of the srcdoc document should be initiated here. The value
+      // of the sandbox attribute should be snapshotted.
+      document.body.appendChild(iframe);
+
+      // Manipulating the sandbox attribute at this point should not affect the
+      // sandbox flags used for the document in the iframe.
+      iframe.sandbox = 'allow-scripts';
+
+      // After navigation, child frame should not be sandboxed.
+      window.onmessage = t.step_func_done(e => {
+        assert_equals(e.data, 'Not sandboxed');
+      });
+    }, "setting sandbox attribute after iframe is attached to document should" +
+       " not affect document in srcdoc iframe.");
+    </script>
+  </body>
+</html>