Fix layout test to not rely on function ctor from detached frame

third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html

Index: third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html b/third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
index f96831021a5b0ada4a2ff459f5e6232ef1a0df7c..1359a3e591950f7ef8f1ef0687679fb557cd6ef4 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
+++ b/third_party/WebKit/LayoutTests/http/tests/security/location-change-from-detached-DOMWindow.html
@@ -11,9 +11,9 @@ window.onmessage = function(e) {
 }
 
 var i = document.documentElement.appendChild(document.createElement('iframe'));
-var f = frames[0].Function;
+var f = frames[0].Function("location.replace('javascript:window.top.postMessage(\\'FAIL\\', \\'*\\')')");
 i.onload = function() {
-  f("location.replace('javascript:window.top.postMessage(\\'FAIL\\', \\'*\\')')")();
+  f();
   setTimeout(function() {
     window.postMessage("PASS", "*");
   }, 0);