I can't replicate this easily, but it happens sometimes when we embed an YouTube iframe. However, I believe I understand why it happens: we try to retrieve the descriptor for the href setter from a Location, calling internal_get_own_property (OrdinaryGetOwnProperty in the specification) from cross_origin_get_own_property_helper. However, the said setter (and its descriptor) only exists in LocationPrototype, which isn't used by OrdinaryGetOwnProperty (it only looks up object's own, as opposed to prototype, properties).

I don't fully understand how we generate the bindings, but we might need to do something similar to Window, which inherits from a WindowGlobalMixin, which contains the properties as opposed to having them in a prototype.