Merge 95489 - [V8] document.all gets confused about its prototype chain

LayoutTests/http/tests/security/document-all.html

 <script>
 if (window.layoutTestController) {
     layoutTestController.dumpAsText();
     layoutTestController.waitUntilDone();
 }
 
 window.onload = function()
 {
     frame = document.body.appendChild(document.createElement("iframe"));
     frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
     frame.onload = function() {
         frame.onload = null;
 
         frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
 
             setTimeout(function() {
                 if (window.layoutTestController)
                     layoutTestController.notifyDone();
             }, 0);
 
             window.name = "alert";
             obj = document.all;
             obj.__proto__ = parent;
             alert(obj.alert.constructor("return document.body.innerHTML")());
         } + ")()</scr" + "ipt>";
     }
 }
 </script>