Bug 215589

Created attachment 406747 [details]
Example test case

Sandboxed iframes that do not set `allow-scripts` do not seem to fire `DOMContentLoaded`. Here's a quick example

        const iframe = document.createElement('iframe')

        iframe.setAttribute('sandbox', 'allow-same-origin')
        iframe.src = './other'
        document.body.append(iframe)

        iframe.contentWindow.addEventListener('DOMContentLoaded', () => {
            console.log('loaded');
        });


The event is fired if the iframe is not sandboxed or if `allow-scripts` is included in the sandbox. The sandboxed iframe does fire events in Chrome and Firefox. 

This is similar to https://bugs.webkit.org/show_bug.cgi?id=33604 but for sandboxed iframes