- Revision
- 139278
- Author
- rn...@webkit.org
- Date
- 2013-01-09 19:55:33 -0800 (Wed, 09 Jan 2013)
Log Message
[JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
https://bugs.webkit.org/show_bug.cgi?id=105775
Reviewed by Sam Weinig.
Source/WebCore:
Fixed the bug by respecting properties on ancestor classes.
Test: fast/dom/collection-length-should-not-be-overridden.html
* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching): Added.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
hierarchy.
LayoutTests:
Added a regression tests for all known HTMLCollection sublcasses except HTMLNameCollection,
which is used only to implement named getters on window and document objects and HTMLPropertiesCollection
since it's not enabled on all ports yet.
* fast/dom/collection-length-should-not-be-overridden-expected.txt: Added.
* fast/dom/collection-length-should-not-be-overridden.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (139277 => 139278)
--- trunk/LayoutTests/ChangeLog 2013-01-10 03:44:28 UTC (rev 139277)
+++ trunk/LayoutTests/ChangeLog 2013-01-10 03:55:33 UTC (rev 139278)
@@ -1,3 +1,17 @@
+2013-01-09 Ryosuke Niwa <rn...@webkit.org>
+
+ [JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
+ https://bugs.webkit.org/show_bug.cgi?id=105775
+
+ Reviewed by Sam Weinig.
+
+ Added a regression tests for all known HTMLCollection sublcasses except HTMLNameCollection,
+ which is used only to implement named getters on window and document objects and HTMLPropertiesCollection
+ since it's not enabled on all ports yet.
+
+ * fast/dom/collection-length-should-not-be-overridden-expected.txt: Added.
+ * fast/dom/collection-length-should-not-be-overridden.html: Added.
+
2013-01-09 Shinya Kawanaka <shin...@chromium.org>
Assert triggered in SelectorChecker::checkOneSelector when scrollbar (e.g. :horizontal) selector is specified.
Added: trunk/LayoutTests/fast/dom/collection-length-should-not-be-overridden-expected.txt (0 => 139278)
--- trunk/LayoutTests/fast/dom/collection-length-should-not-be-overridden-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/collection-length-should-not-be-overridden-expected.txt 2013-01-10 03:55:33 UTC (rev 139278)
@@ -0,0 +1,22 @@
+This test ensures the builtin length property of HTMLCollection's subclasses is not overridden by a named getter of the same name.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS documentAllLength is 18
+PASS documentAll5 is documentAllSome
+PASS documentAll6.name is 'length'
+PASS form.length is form.elements[1]
+PASS form.elements.length is 2
+PASS form.elements[0] is form.elements['some']
+PASS form.elements[1].name is 'length'
+PASS select.options.length is 2
+PASS select.options[0].getAttribute('name') is 'length'
+PASS select.options[1] is select.options['some']
+PASS table.rows.length is 2
+PASS table.rows[0] is table.rows['another']
+PASS table.rows[1].id is 'length'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/dom/collection-length-should-not-be-overridden.html (0 => 139278)
--- trunk/LayoutTests/fast/dom/collection-length-should-not-be-overridden.html (rev 0)
+++ trunk/LayoutTests/fast/dom/collection-length-should-not-be-overridden.html 2013-01-10 03:55:33 UTC (rev 139278)
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div id="testElements">
+<form>
+<input type="text" name="some">
+<input type="text" name="length">
+</form>
+<form>
+<select>
+<option name="length">
+<option name="some">
+</select>
+</form>
+<table>
+<tbody>
+<tr id="another"><td></td></tr>
+<tr id="length"><td></td></tr>
+</tbody>
+</table>
+</div>
+<script>
+
+// We need to pre-fetch these values since including the script element inserts new elements.
+documentAllLength = document.all.length;
+documentAllSome = document.all['some'];
+documentAll5 = document.all[5];
+documentAll6 = document.all[6];
+
+</script>
+<script src=""
+<script>
+
+description("This test ensures the builtin length property of HTMLCollection's subclasses is not overridden by a named getter of the same name.");
+
+var form = document.forms[0];
+var select = document.querySelector('select');
+var table = document.querySelector('table');
+shouldBe("documentAllLength", "18");
+shouldBe("documentAll5", "documentAllSome");
+shouldBe("documentAll6.name", "'length'");
+
+shouldBe("form.length", "form.elements[1]");
+shouldBe("form.elements.length", "2");
+shouldBe("form.elements[0]", "form.elements['some']");
+shouldBe("form.elements[1].name", "'length'");
+
+shouldBe("select.options.length", "2");
+shouldBe("select.options[0].getAttribute('name')", "'length'");
+shouldBe("select.options[1]", "select.options['some']");
+
+shouldBe("table.rows.length", "2");
+shouldBe("table.rows[0]", "table.rows['another']");
+shouldBe("table.rows[1].id", "'length'");
+
+document.getElementById('testElements').style.display = 'none';
+
+var successfullyParsed = true;
+
+</script>
+<script src=""
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (139277 => 139278)
--- trunk/Source/WebCore/ChangeLog 2013-01-10 03:44:28 UTC (rev 139277)
+++ trunk/Source/WebCore/ChangeLog 2013-01-10 03:55:33 UTC (rev 139278)
@@ -1,3 +1,20 @@
+2013-01-09 Ryosuke Niwa <rn...@webkit.org>
+
+ [JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
+ https://bugs.webkit.org/show_bug.cgi?id=105775
+
+ Reviewed by Sam Weinig.
+
+ Fixed the bug by respecting properties on ancestor classes.
+
+ Test: fast/dom/collection-length-should-not-be-overridden.html
+
+ * bindings/js/JSDOMBinding.h:
+ (WebCore::getStaticValueSlotEntryWithoutCaching): Added.
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
+ hierarchy.
+
2013-01-09 Kondapally Kalyan <kalyan.kondapa...@intel.com>
[EFL] [WebGL] Remove GLX dependencies from X11WindowResources..
Modified: trunk/Source/WebCore/bindings/js/JSDOMBinding.h (139277 => 139278)
--- trunk/Source/WebCore/bindings/js/JSDOMBinding.h 2013-01-10 03:44:28 UTC (rev 139277)
+++ trunk/Source/WebCore/bindings/js/JSDOMBinding.h 2013-01-10 03:55:33 UTC (rev 139278)
@@ -47,6 +47,12 @@
#include <wtf/Noncopyable.h>
#include <wtf/Vector.h>
+namespace JSC {
+
+class HashEntry;
+
+}
+
namespace WebCore {
class DOMStringList;
@@ -512,6 +518,21 @@
return AtomicString(propertyName.publicName());
}
+ template <class ThisImp>
+ inline const JSC::HashEntry* getStaticValueSlotEntryWithoutCaching(JSC::ExecState* exec, JSC::PropertyName propertyName)
+ {
+ const JSC::HashEntry* entry = ThisImp::s_info.propHashTable(exec)->entry(exec, propertyName);
+ if (!entry) // not found, forward to parent
+ return getStaticValueSlotEntryWithoutCaching<typename ThisImp::Base>(exec, propertyName);
+ return entry;
+ }
+
+ template <>
+ inline const JSC::HashEntry* getStaticValueSlotEntryWithoutCaching<JSDOMWrapper>(JSC::ExecState*, JSC::PropertyName)
+ {
+ return 0;
+ }
+
} // namespace WebCore
#endif // JSDOMBinding_h
Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (139277 => 139278)
--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2013-01-10 03:44:28 UTC (rev 139277)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2013-01-10 03:55:33 UTC (rev 139278)
@@ -402,7 +402,7 @@
my $manualLookupGetterGeneration = sub {
my $requiresManualLookup = $interface->extendedAttributes->{"IndexedGetter"} || $interface->extendedAttributes->{"NamedGetter"};
if ($requiresManualLookup) {
- push(@getOwnPropertySlotImpl, " const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+ push(@getOwnPropertySlotImpl, " const ${namespaceMaybe}HashEntry* entry = getStaticValueSlotEntryWithoutCaching<$className>(exec, propertyName);\n");
push(@getOwnPropertySlotImpl, " if (entry) {\n");
push(@getOwnPropertySlotImpl, " slot.setCustom(thisObject, entry->propertyGetter());\n");
push(@getOwnPropertySlotImpl, " return true;\n");
