<script>
if (window.testRunner)
    testRunner.dumpAsText();

window[0] = {
    a: "1",
    f: function() {
        console.log("FAIL: Child called parent.f()");
    }
};
</script>
<iframe src="data:text/html,<script>console.log(parent[0].a);</script><script>parent[0].f();</script>"></iframe><br>
This test passes if the access is forbidden.