Fix layout test to not rely on function ctor from detached frame

third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html

 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }
 
 window.onmessage = function(e) { 
     document.documentElement.appendChild(document.createTextNode(e.data));
     if (window.testRunner)
         testRunner.notifyDone();
 }
 
 var i = document.documentElement.appendChild(document.createElement('iframe'));
-var f = frames[0].Function;
+var f = frames[0].Function("location.replace('javascript:window.top.postMessage(\\'FAIL\\', \\'*\\')')");
 i.onload = function() {
-  f("location.replace('javascript:window.top.postMessage(\\'FAIL\\', \\'*\\')')")();
+  f();
   setTimeout(function() {
     window.postMessage("PASS", "*");
   }, 0);
 }
 i.src = 'https://localhost:8443/security/resources/innocent-victim.html';
 </script>