It's really something like "is dynamic code generation possible via eval or Function", so its name is a misnomer (particularly when it's called in the code to implement the Function constructor!).
Tangentially, but perhaps fixable in this bug, we should get rid of js_CheckContentSecurityPolicy, and we should make all such callers use the GlobalObject::* method instead.
Created attachment 538311 [details] [diff] [review]
cdleary-bot mozilla-central merge info: