cobalt/black_box_tests/testdata/worker_csp_test.js

const xhr = new XMLHttpRequest();
// Script should fail and stop execution at this step due to SecurityViolation.
xhr.open("GET", "http://www.google.com");
xhr.send();

self.postMessage("Should not be reached!");