ync test => {
  const iframe = document.createElement("iframe");
  iframe.csp = sandbox_policy;
  iframe.src = cross_origin + check_sandbox_url + allow_csp_from_star;

  const iframe_reply = future(window, "message", iframe);
  document.body.appendChild(iframe);
  const result = await iframe_reply;

  assert_equals(result.data, "document-domain-is-disallowed");
}, "cross-origin");

</script>
