<!doctype html>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'; style-src 'self'; img-src 'none'">
<script nonce="abc" src="/resources/testharness.js"></script>
<script nonce="abc" src="/resources/testharnessreport.js"></script>
<body>
<script nonce="abc">
    function waitForViolation(el) {
      return new Promise(resolve => {
        el.addEventListener('securitypolicyviolation', e => resolve(e));
      });
    }

    async_test(t => {
      var s = document.createElement('scr