Use Document of callingWindow for access check in isInsecureScriptAccess()

LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html

Index: LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
diff --git a/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html b/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
new file mode 100644
index 0000000000000000000000000000000000000000..f96831021a5b0ada4a2ff459f5e6232ef1a0df7c
--- /dev/null
+++ b/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
@@ -0,0 +1,22 @@
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+window.onmessage = function(e) { 
+    document.documentElement.appendChild(document.createTextNode(e.data));
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+var i = document.documentElement.appendChild(document.createElement('iframe'));
+var f = frames[0].Function;
+i.onload = function() {
+  f("location.replace('javascript:window.top.postMessage(\\'FAIL\\', \\'*\\')')")();
+  setTimeout(function() {
+    window.postMessage("PASS", "*");
+  }, 0);
+}
+i.src = 'https://localhost:8443/security/resources/innocent-victim.html';
+</script>