Use the current context as the creation context for cross-origin objects.

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

Index: third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp b/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
index 2134492acdd163242964c52f0d597abadc66f88b..8bfda702a235a678c7c7582997c5a1a4a5dc68e4 100644
--- a/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp
@@ -50,6 +50,7 @@
 #include "core/frame/ImageBitmap.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
+#include "core/frame/Location.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
@@ -64,6 +65,38 @@
 
 namespace blink {
 
+void V8Window::locationAttributeGetterCustom(
+    const v8::PropertyCallbackInfo<v8::Value>& info) {
+  v8::Isolate* isolate = info.GetIsolate();
+  v8::Local<v8::Object> holder = info.Holder();
+
+  DOMWindow* window = V8Window::toImpl(holder);
+  Location* location = window->location();
+  DCHECK(location);
+
+  // Note that this check is gated on whether or not |window| is remote, not
+  // whether or not |window| is cross-origin. If |window| is local, the
+  // |location| property must always return the same wrapper, even if the
+  // cross-origin status changes by changing properties like |document.domain|.
+  if (window->isRemoteDOMWindow()) {

[dcheng, 2017/01/24 09:40:47]

Actually, I think with this small update, this will actually work fine. It's OK
for window.location != window.location if window is navigated, so this ensures
the wrapper is always consistent within the lifetime of the window itself (not
the window proxy).

+    v8SetReturnValue(info, location->crossOriginWrapper(isolate));
+    return;
+  }
+
+  // Keep the wrapper object for the return value alive as long as |this|
+  // object is alive in order to save creation time of the wrapper object.
+  if (DOMDataStore::setReturnValue(info.GetReturnValue(), location))
+    return;
+  v8::Local<v8::Value> wrapper = ToV8(location, holder, isolate);
+  const char kKeepAliveKey[] = "KeepAlive#Window#location";
+  V8HiddenValue::setHiddenValue(
+      ScriptState::current(isolate), holder,
+      v8AtomicString(isolate, StringView(kKeepAliveKey, sizeof kKeepAliveKey)),
+      wrapper);
+
+  v8SetReturnValue(info, wrapper);
+}
+
 void V8Window::eventAttributeGetterCustom(
     const v8::FunctionCallbackInfo<v8::Value>& info) {
   LocalDOMWindow* impl = toLocalDOMWindow(V8Window::toImpl(info.Holder()));