Throw 'SecurityError' upon cross-origin Location access.

LayoutTests/http/tests/security/contentSecurityPolicy/resources/reflected-xss-and-xss-protection.js

 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.setXSSAuditorEnabled(true);
     testRunner.waitUntilDone();
 }
 
 function testMixedHeader(csp, xssProtection) {
     var params = [
         'q=<script>alert(String.fromCharCode(0x58,0x53,0x53))<' + '/script>'
     ];
@@ skipping 12 matching lines @@
     var url = '/security/xssAuditor/resources/echo-intertag.pl?';
     url += params.join('&amp;');
 
     document.write('<p>Testing behavior when "reflected-xss" is set to ' + csp + ', and "X-XSS-Protection" is set to ' + xssProtection + '.');
     document.write('<iframe src="' + url + '"></iframe>');
 }
 
 function frameLoaded() {
     var frame = document.querySelector('iframe');
     try {
-      alert('Loaded ' + frame.contentWindow.location + ' into the IFrame.');
+      alert('Loaded ' + frame.contentWindow.location.href + ' into the IFrame.');
     } catch (e) {
       alert('Loaded cross-origin frame.');
     }
     testRunner.notifyDone();
 }
 
 window.onload = frameLoaded;