binding: Sets location[Symbol.toPrimitive].

third_party/WebKit/Source/bindings/templates/interface_base.cpp.tmpl

Index: third_party/WebKit/Source/bindings/templates/interface_base.cpp.tmpl
diff --git a/third_party/WebKit/Source/bindings/templates/interface_base.cpp.tmpl b/third_party/WebKit/Source/bindings/templates/interface_base.cpp.tmpl
index 16bb616edd9650a10e3230642c7b258e75331c56..a2532dd525b1b0062355a8964736bca8b488813e 100644
--- a/third_party/WebKit/Source/bindings/templates/interface_base.cpp.tmpl
+++ b/third_party/WebKit/Source/bindings/templates/interface_base.cpp.tmpl
@@ -497,6 +497,17 @@ static void install{{v8_class}}Template(v8::Isolate* isolate, const DOMWrapperWo
   {% endfilter %}
   {% endif %}
 
+  {% if interface_name == 'Location' %}
+  // Symbol.toPrimitive
+  // Prevent author scripts to inject Symbol.toPrimitive property into location
+  // objects, also prevent the look-up of Symbol.toPrimitive through the
+  // prototype chain.
+  instanceTemplate->Set(v8::Symbol::GetToPrimitive(isolate),
+                        v8::Undefined(isolate),
+                        static_cast<v8::PropertyAttribute>(
+                            v8::ReadOnly | v8::DontEnum | v8::DontDelete));
+  {% endif %}
+
   {% if legacy_caller and not is_partial %}
   instanceTemplate->SetCallAsFunctionHandler({{cpp_class_or_partial}}V8Internal::{{legacy_caller.name}}MethodCallback);
   {% elif has_custom_legacy_call_as_function and not is_partial %}