Use the current context as the creation context for cross-origin objects.

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

Index: third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp b/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
index 5c9bf858e256ad80027e3043161b29eef31ddfd7..774a91e6f608d2efff4e0b965676289fd4b1455b 100644
--- a/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
@@ -51,6 +51,7 @@
 #include "core/frame/ImageBitmap.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/Location.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
@@ -65,6 +66,58 @@
 
 namespace blink {
 
+void V8Window::locationAttributeGetterCustom(
+    const v8::PropertyCallbackInfo<v8::Value>& info) {
+  v8::Isolate* isolate = info.GetIsolate();
+  v8::Local<v8::Object> holder = info.Holder();
+
+  DOMWindow* window = V8Window::toImpl(holder);
+  Location* location = window->location();
+  DCHECK(location);
+
+  // Keep the wrapper object for the return value alive as long as |this|
+  // object is alive in order to save creation time of the wrapper object.
+  if (DOMDataStore::setReturnValue(info.GetReturnValue(), location))
+    return;
+
+  v8::Local<v8::Value> wrapper;
+
+  // Note that this check is gated on whether or not |window| is remote, not
+  // whether or not |window| is cross-origin. If |window| is local, the
+  // |location| property must always return the same wrapper, even if the
+  // cross-origin status changes by changing properties like |document.domain|.
+  if (window->isRemoteDOMWindow()) {
+    DOMWrapperWorld& world = DOMWrapperWorld::current(isolate);
+    const auto* wrapperTypeInfo = location->wrapperTypeInfo();
+    v8::Local<v8::Object> newWrapper =
+        wrapperTypeInfo->domTemplate(isolate, world)
+            ->NewRemoteInstance()
+            .ToLocalChecked();
+
+    DCHECK(!DOMDataStore::containsWrapper(location, isolate));
+    wrapper = V8DOMWrapper::associateObjectWithWrapper(
+        isolate, location, wrapperTypeInfo, newWrapper);
+  } else {
+    wrapper = ToV8(location, holder, isolate);
+  }
+
+  // Keep the wrapper object for the return value alive as long as |this|
+  // object is alive in order to save creation time of the wrapper object.
+  //
+  // TODO(dcheng): The hidden reference behavior is broken in many ways. We
+  // should be caching for all DOM attributes. Even if it's not critical for
+  // remote Location objects, we should clean this up to improve
+  // maintainability. In the long-term, this will be superseded by wrapper
+  // tracing.
+  const char kKeepAliveKey[] = "KeepAlive#Window#location";
+  V8HiddenValue::setHiddenValue(
+      ScriptState::current(isolate), holder,
+      v8AtomicString(isolate, StringView(kKeepAliveKey, sizeof kKeepAliveKey)),
+      wrapper);
+
+  v8SetReturnValue(info, wrapper);
+}
+
 void V8Window::eventAttributeGetterCustom(
     const v8::FunctionCallbackInfo<v8::Value>& info) {
   LocalDOMWindow* impl = toLocalDOMWindow(V8Window::toImpl(info.Holder()));