binding: Supports static operations/attrs returning non-primitive types.

LayoutTests/http/tests/security/cross-frame-access-static-operation-return-wrapper.html

Index: LayoutTests/http/tests/security/cross-frame-access-static-operation-return-wrapper.html
diff --git a/LayoutTests/http/tests/security/cross-frame-access-static-operation-return-wrapper.html b/LayoutTests/http/tests/security/cross-frame-access-static-operation-return-wrapper.html
new file mode 100644
index 0000000000000000000000000000000000000000..3b0782fcccdf365da3072da88cecc39eb1b3127c
--- /dev/null
+++ b/LayoutTests/http/tests/security/cross-frame-access-static-operation-return-wrapper.html
@@ -0,0 +1,19 @@
+<script>
+console.log("Tests that static operations return DOM wrappers which are associated with the caller's context, not associated with |this| which can be faked.");
+// See also http://crbug.com/494640
+
+var iframe = document.documentElement.appendChild(document.createElement('iframe'));
+iframe.src = 'data:text/plain,hello';
+iframe.onload = function() {
+    var uri = IDBKeyRange.only.call(frames[0], 0).constructor.constructor('return location.href')();
+    console.log(uri);
+    if (window.testRunner) {
+        testRunner.notifyDone();
+    }
+}
+
+if (window.testRunner) {
+    testRunner.waitUntilDone();
+    testRunner.dumpAsText();
+}
+</script>