chromium/third_party/blink/web_tests/fast/dom/wrapper-scope.html

<!DOCTYPE html>
<body>
<script src="../../resources/js-test.js"></script>
<script>

description('Make sure wrappers are setup using the window the property came from, instead of the lexical global object.');

var frame = document.createElement('iframe');
document.body.appendChild(frame);
var inner = frame.contentWindow;

window.Object.prototype.isInner = false;
inner.Object.prototype.isInner = true;

var pathsToTest = [
    'HTMLElement',
    'Window',
    'close',
    'console',
    'document',
    'document.body',
    'document.childNodes',
    'navigator',
    'postMessage',
    'window',
];

function testPath(path) {
    shouldBeTrue('inner.' + path + '.isInner');
    shouldBeTrue('inner.' + path + '.constructor.isInner');
    shouldBeTrue('inner.' + path + '.constructor.prototype.isInner');
    shouldBeTrue('inner.' + path + '.__proto__.isInner');
}

pathsToTest.forEach(testPath);

</script>
</body>