<!DOCTYPE html>
<html>
<head>
<script src="../../resources/js-test-pre.js"></script>
</head>
<body onload="runTest()">
<iframe src="http://localhost:8000/security/resources/blank.html"></iframe>
<script>
description("Tests that using another window's property getter does not bypass cross-origin checks.");
jsTestIsAsync = true;

function shouldThrowOrReturnUndefined(expression)
{
    try {
        result = eval(expression);
    } catch (e) {
        testPassed(expression + " threw exception " + e + ".");
        return;
    }
    if (result === undefined)
        testPassed(expression + " returned undefined.");
    else
        testFailed(expression + " returned " + result);
}

function runTest()
{
    crossOriginWindow = frames[0];
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window, "document").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window, "name").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window, "menubar").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window, "scrollbars").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window, "navigator").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window, "screenX").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window.__proto__, "constructor").get.call(crossOriginWindow)');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(window.__proto__, "constructor").get.call(crossOriginWindow.__proto__)');
    shouldThrowOrReturnUndefined('crossOriginWindow.constructor');
    shouldThrowOrReturnUndefined('Object.getOwnPropertyDescriptor(crossOriginWindow.__proto__, "constructor").value');
    shouldBeTrue('Object.getOwnPropertyDescriptor(window, "location").get.call(crossOriginWindow) === crossOriginWindow.location');
    finishJSTest();
}
</script>
</body>
<script src="../../resources/js-test-post.js"></script>
</html>