Use the current context as the creation context for cross-origin objects.

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

Index: third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp b/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
index 2134492acdd163242964c52f0d597abadc66f88b..fa6b92a2dbfd92c62ce4592efb7fae704bd730f1 100644
--- a/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
@@ -50,6 +50,7 @@
 #include "core/frame/ImageBitmap.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/Location.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
@@ -64,6 +65,68 @@
 
 namespace blink {
 
+void V8Window::locationAttributeGetterCustom(
+    const v8::PropertyCallbackInfo<v8::Value>& info) {
+  v8::Isolate* isolate = info.GetIsolate();
+  v8::Local<v8::Object> holder = info.Holder();
+
+  DOMWindow* window = V8Window::toImpl(holder);
+  Location* location = window->location();
+  DCHECK(location);
+
+  // Keep the wrapper object for the return value alive as long as |this|
+  // object is alive in order to save creation time of the wrapper object.
+  if (DOMDataStore::setReturnValue(info.GetReturnValue(), location))
+    return;
+
+  v8::Local<v8::Value> wrapper;
+
+  // Note that this check is gated on whether or not |window| is remote, not
+  // whether or not |window| is cross-origin. If |window| is local, the
+  // |location| property must always return the same wrapper, even if the
+  // cross-origin status changes by changing properties like |document.domain|.
+  if (window->isRemoteDOMWindow()) {
+    DOMWrapperWorld& world = DOMWrapperWorld::current(isolate);
+    const auto* wrapperTypeInfo = location->wrapperTypeInfo();
+    v8::Local<v8::Object> newWrapper =
+        wrapperTypeInfo->domTemplate(isolate, world)
+            ->NewRemoteInstance()
+            .ToLocalChecked();
+
+    DCHECK(!DOMDataStore::containsWrapper(location, isolate));
+    wrapper = V8DOMWrapper::associateObjectWithWrapper(
+        isolate, location, wrapperTypeInfo, newWrapper);
+
+    // Note: normally it is important to keep the Location wrapper alive as long
+    // as the window is alive: this ensures that properties set on the Location
+    // wrapper (e.g. window.location.custom_property = 2) persist even if script
+    // doesn't hold a reference to the wrapper to keep it alive.
+    //
+    // However, a Location object for a RemoteDOMWindow can never have any
+    // custom properties set, so it's safe to not cache the returned wrapper at
+    // all.
+    //
+    // TODO(dcheng): The hidden reference behavior is broken in many ways. We
+    // should be caching for all DOM attributes. Even if it's not critical for
+    // remote Location objects, we should clean this up to improve
+    // maintainability. In the long-term, this will be superseded by wrapper
+    // tracing.
+  } else {
+    wrapper = ToV8(location, holder, isolate);
+
+    // Keep the wrapper object for the return value alive as long as |this|
+    // object is alive in order to save creation time of the wrapper object.
+    const char kKeepAliveKey[] = "KeepAlive#Window#location";
+    V8HiddenValue::setHiddenValue(
+        ScriptState::current(isolate), holder,
+        v8AtomicString(isolate,
+                       StringView(kKeepAliveKey, sizeof kKeepAliveKey)),
+        wrapper);
+  }
+
+  v8SetReturnValue(info, wrapper);
+}
+
 void V8Window::eventAttributeGetterCustom(
     const v8::FunctionCallbackInfo<v8::Value>& info) {
   LocalDOMWindow* impl = toLocalDOMWindow(V8Window::toImpl(info.Holder()));