A bug of bindings/core/v8/custom/V8DocumentCustom.cpp.

I shall try to check this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/61e63cfb2c69c140c27806b9472c6b68fb2e5cd0

commit 61e63cfb2c69c140c27806b9472c6b68fb2e5cd0
Author: Bhagirathi Satpathy <bhagirathi.s@samsung.com>
Date: Sat Nov 04 08:02:22 2017

document.open() should not invoke public window.open()

document.open should throw INVALID ACCESS ERROR when it has no window
and is called with three arguments

Bug:  722737 
Change-Id: Ia9fbad66843c1d8d1c334ee5c38d2cc2947fe258
Reviewed-on: https://chromium-review.googlesource.com/750748
Commit-Queue: srirama chandra sekhar <srirama.m@samsung.com>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Rick Byers <rbyers@chromium.org>
Cr-Commit-Position: refs/heads/master@{#514038}
[modify] https://crrev.com/61e63cfb2c69c140c27806b9472c6b68fb2e5cd0/third_party/WebKit/LayoutTests/external/wpt/html/dom/dynamic-markup-insertion/opening-the-input-stream/document.open-02-expected.txt
[modify] https://crrev.com/61e63cfb2c69c140c27806b9472c6b68fb2e5cd0/third_party/WebKit/Source/bindings/core/v8/custom/V8DocumentCustom.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a99b56283511d4ac46782fe24d1a9a2c8735f092

commit a99b56283511d4ac46782fe24d1a9a2c8735f092
Author: Bhagirathi Satpathy <bhagirathi.s@samsung.com>
Date: Wed Nov 15 08:46:39 2017

document.open() should not invoke public window.open()

window = document.open(url, name, features) should open new window
with these three argements instead of calling overwrite open function.

Spec : https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#opening-the-input-stream

Bug:  722737 
Change-Id: I466b3f586966498f6685aa18daef5f558caee6de
Reviewed-on: https://chromium-review.googlesource.com/758698
Commit-Queue: srirama chandra sekhar <srirama.m@samsung.com>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#516641}
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/external/wpt/html/dom/dynamic-markup-insertion/opening-the-input-stream/document.open-02-expected.txt
[add] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/LayoutTests/fast/dom/Document/document-open-01.html
[add] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/LayoutTests/fast/dom/Document/document-open-02.html
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/fast/dom/frame-deleted-in-document-open-expected.txt
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/fast/dom/frame-deleted-in-document-open.html
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/fast/js/document-open-getter-throw-no-crash-expected.txt
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/fast/js/document-open-getter-throw-no-crash.html
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/fast/js/script-tests/document-open-getter-throw-no-crash.js
[rename] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/LayoutTests/http/tests/security/isolatedWorld/document-open-01-expected.txt
[add] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/LayoutTests/http/tests/security/isolatedWorld/document-open-01.html
[copy] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/LayoutTests/http/tests/security/isolatedWorld/document-open-02-expected.txt
[add] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/LayoutTests/http/tests/security/isolatedWorld/document-open-02.html
[delete] https://crrev.com/213ca3788ad79bab9e0894ff4f159cd7a4ac8909/third_party/WebKit/LayoutTests/http/tests/security/isolatedWorld/document-open.html
[modify] https://crrev.com/a99b56283511d4ac46782fe24d1a9a2c8735f092/third_party/WebKit/Source/bindings/core/v8/custom/V8DocumentCustom.cpp

This was fixed in a99b56283511d4ac46782fe24d1a9a2c8735f092 (M64), as mentioned above.