Merge 95488 - Named property confusion with __proto__

LayoutTests/http/tests/security/window-named-proto.html

 <script>
 if (window.layoutTestController) {
     layoutTestController.dumpAsText();
     layoutTestController.waitUntilDone();
 }
 
 window.onload = function()
 {
     frame = document.body.appendChild(document.createElement("iframe"));
     frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
     frame.onload = function() {
         frame.onload = null;
 
         frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
 
             setTimeout(function() {
                 if (window.layoutTestController)
                     layoutTestController.notifyDone();
             }, 0);
 
             window.name = "__proto__";
             parent.__proto__.alert.constructor("alert(document.body.innerHTML)")();
         } + ")()</scr" + "ipt>";
     }
 }
 </script>