<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[46068] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/46068">46068</a></dd>
<dt>Author</dt> <dd>eric@webkit.org</dd>
<dt>Date</dt> <dd>2009-07-17 16:13:04 -0700 (Fri, 17 Jul 2009)</dd>
</dl>

<h3>Log Message</h3>
<pre>2009-07-14  Eric Seidel  &lt;eric@webkit.org&gt;

        Reviewed by Adam Barth.

        Some constructor objects exposed on Window have the wrong prototype chain
        https://bugs.webkit.org/show_bug.cgi?id=27276

        * fast/dom/prototype-inheritance-expected.txt: Added.
        * fast/dom/prototype-inheritance.html: Added.
        * fast/dom/resources/prototype-inheritance.js: Added.

2009-07-14  Eric Seidel  &lt;eric@webkit.org&gt;

        Reviewed by Adam Barth.

        Some constructor objects exposed on Window have the wrong prototype chain
        https://bugs.webkit.org/show_bug.cgi?id=27276

        Several Constructor classes were already being passed a global object
        during construction, but they were ignoring it for prototype lookup.
        I've fixed those to use the passed global object instead.

        Most of these Constructor classes should just be auto-generated, but I
        refrained from changing them over to auto-gen in this patch.

        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
        to match existing behavior.

        Test: fast/dom/prototype-inheritance.html

        * bindings/js/JSAudioConstructor.cpp:
        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
        * bindings/js/JSDOMBinding.h:
        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
        (WebCore::deprecatedGetDOMStructure):
        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::webKitPoint): pass &quot;this&quot; for the global object.
        (WebCore::JSDOMWindow::webKitCSSMatrix): pass &quot;this&quot; for the global object.
        (WebCore::JSDOMWindow::xsltProcessor): pass &quot;this&quot; for the global object.
        (WebCore::JSDOMWindow::worker): pass &quot;this&quot; for the global object.
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
        * bindings/js/JSMessageChannelConstructor.cpp:
        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
        * bindings/js/JSOptionConstructor.cpp:
        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
        * bindings/js/JSWebKitCSSMatrixConstructor.h:
        * bindings/js/JSWebKitPointConstructor.cpp:
        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
        * bindings/js/JSWebKitPointConstructor.h:
        * bindings/js/JSWorkerConstructor.cpp:
        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
        * bindings/js/JSWorkerConstructor.h:
        * bindings/js/JSXMLHttpRequestConstructor.cpp:
        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
         -- XMLHttpRequest constructor was also missing a length.  Added one.
        * bindings/js/JSXSLTProcessorConstructor.cpp:
        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
        * bindings/js/JSXSLTProcessorConstructor.h:
        * bindings/scripts/CodeGeneratorJS.pm:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkWebCoreChangeLog">trunk/WebCore/ChangeLog</a></li>
<li><a href="#trunkWebCorebindingsjsJSAudioConstructorcpp">trunk/WebCore/bindings/js/JSAudioConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSDOMBindingh">trunk/WebCore/bindings/js/JSDOMBinding.h</a></li>
<li><a href="#trunkWebCorebindingsjsJSDOMGlobalObjecth">trunk/WebCore/bindings/js/JSDOMGlobalObject.h</a></li>
<li><a href="#trunkWebCorebindingsjsJSDOMWindowCustomcpp">trunk/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSImageConstructorcpp">trunk/WebCore/bindings/js/JSImageConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSMessageChannelConstructorcpp">trunk/WebCore/bindings/js/JSMessageChannelConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSOptionConstructorcpp">trunk/WebCore/bindings/js/JSOptionConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSWebKitCSSMatrixConstructorcpp">trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSWebKitCSSMatrixConstructorh">trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h</a></li>
<li><a href="#trunkWebCorebindingsjsJSWebKitPointConstructorcpp">trunk/WebCore/bindings/js/JSWebKitPointConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSWebKitPointConstructorh">trunk/WebCore/bindings/js/JSWebKitPointConstructor.h</a></li>
<li><a href="#trunkWebCorebindingsjsJSWorkerConstructorcpp">trunk/WebCore/bindings/js/JSWorkerConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSWorkerConstructorh">trunk/WebCore/bindings/js/JSWorkerConstructor.h</a></li>
<li><a href="#trunkWebCorebindingsjsJSXMLHttpRequestConstructorcpp">trunk/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSXSLTProcessorConstructorcpp">trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp</a></li>
<li><a href="#trunkWebCorebindingsjsJSXSLTProcessorConstructorh">trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.h</a></li>
<li><a href="#trunkWebCorebindingsscriptsCodeGeneratorJSpm">trunk/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastdomprototypeinheritanceexpectedtxt">trunk/LayoutTests/fast/dom/prototype-inheritance-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomprototypeinheritancehtml">trunk/LayoutTests/fast/dom/prototype-inheritance.html</a></li>
<li><a href="#trunkLayoutTestsfastdomresourcesprototypeinheritancejs">trunk/LayoutTests/fast/dom/resources/prototype-inheritance.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/LayoutTests/ChangeLog        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2009-07-14  Eric Seidel  &lt;eric@webkit.org&gt;
+
+        Reviewed by Adam Barth.
+
+        Some constructor objects exposed on Window have the wrong prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=27276
+
+        * fast/dom/prototype-inheritance-expected.txt: Added.
+        * fast/dom/prototype-inheritance.html: Added.
+        * fast/dom/resources/prototype-inheritance.js: Added.
+
</ins><span class="cx"> 2009-07-17  Michelangelo De Simone  &lt;micdesim@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Reviewed by Darin Adler.
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomprototypeinheritanceexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/prototype-inheritance-expected.txt (0 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/prototype-inheritance-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/dom/prototype-inheritance-expected.txt        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -0,0 +1,249 @@
</span><ins>+Make sure prototypes are set up using the window a property came from, instead of the lexical global object.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS inner.Attr.isInner is true
+PASS inner.Audio.isInner is true
+PASS inner.CDATASection.isInner is true
+PASS inner.CSSCharsetRule.isInner is true
+PASS inner.CSSFontFaceRule.isInner is true
+PASS inner.CSSImportRule.isInner is true
+PASS inner.CSSMediaRule.isInner is true
+PASS inner.CSSPageRule.isInner is true
+PASS inner.CSSPrimitiveValue.isInner is true
+PASS inner.CSSRule.isInner is true
+PASS inner.CSSRuleList.isInner is true
+PASS inner.CSSStyleDeclaration.isInner is true
+PASS inner.CSSStyleRule.isInner is true
+PASS inner.CSSStyleSheet.isInner is true
+PASS inner.CSSValue.isInner is true
+PASS inner.CSSValueList.isInner is true
+PASS inner.CSSVariablesDeclaration.isInner is true
+PASS inner.CSSVariablesRule.isInner is true
+PASS inner.CanvasRenderingContext2D.isInner is true
+PASS inner.CharacterData.isInner is true
+PASS inner.ClientRect.isInner is true
+PASS inner.ClientRectList.isInner is true
+PASS inner.Clipboard.isInner is true
+PASS inner.Comment.isInner is true
+PASS inner.Counter.isInner is true
+PASS inner.DOMException.isInner is true
+PASS inner.DOMImplementation.isInner is true
+PASS inner.DOMParser.isInner is true
+PASS inner.Document.isInner is true
+PASS inner.DocumentFragment.isInner is true
+PASS inner.DocumentType.isInner is true
+PASS inner.Element.isInner is true
+PASS inner.Entity.isInner is true
+PASS inner.EntityReference.isInner is true
+PASS inner.EvalError.isInner is true
+PASS inner.Event.isInner is true
+PASS inner.EventException.isInner is true
+PASS inner.File.isInner is true
+PASS inner.FileList.isInner is true
+PASS inner.HTMLAnchorElement.isInner is true
+PASS inner.HTMLAppletElement.isInner is true
+PASS inner.HTMLAreaElement.isInner is true
+PASS inner.HTMLAudioElement.isInner is true
+PASS inner.HTMLBRElement.isInner is true
+PASS inner.HTMLBaseElement.isInner is true
+PASS inner.HTMLBaseFontElement.isInner is true
+PASS inner.HTMLBlockquoteElement.isInner is true
+PASS inner.HTMLBodyElement.isInner is true
+PASS inner.HTMLButtonElement.isInner is true
+PASS inner.HTMLCanvasElement.isInner is true
+PASS inner.HTMLCollection.isInner is true
+PASS inner.HTMLDListElement.isInner is true
+PASS inner.HTMLDataGridCellElement.isInner is true
+PASS inner.HTMLDataGridColElement.isInner is true
+PASS inner.HTMLDataGridElement.isInner is true
+PASS inner.HTMLDirectoryElement.isInner is true
+PASS inner.HTMLDivElement.isInner is true
+PASS inner.HTMLDocument.isInner is true
+PASS inner.HTMLElement.isInner is true
+PASS inner.HTMLEmbedElement.isInner is true
+PASS inner.HTMLFieldSetElement.isInner is true
+PASS inner.HTMLFontElement.isInner is true
+PASS inner.HTMLFormElement.isInner is true
+PASS inner.HTMLFrameElement.isInner is true
+PASS inner.HTMLFrameSetElement.isInner is true
+PASS inner.HTMLHRElement.isInner is true
+PASS inner.HTMLHeadElement.isInner is true
+PASS inner.HTMLHeadingElement.isInner is true
+PASS inner.HTMLHtmlElement.isInner is true
+PASS inner.HTMLIFrameElement.isInner is true
+PASS inner.HTMLImageElement.isInner is true
+PASS inner.HTMLInputElement.isInner is true
+PASS inner.HTMLIsIndexElement.isInner is true
+PASS inner.HTMLLIElement.isInner is true
+PASS inner.HTMLLabelElement.isInner is true
+PASS inner.HTMLLegendElement.isInner is true
+PASS inner.HTMLLinkElement.isInner is true
+PASS inner.HTMLMapElement.isInner is true
+PASS inner.HTMLMarqueeElement.isInner is true
+PASS inner.HTMLMediaElement.isInner is true
+PASS inner.HTMLMenuElement.isInner is true
+PASS inner.HTMLMetaElement.isInner is true
+PASS inner.HTMLModElement.isInner is true
+PASS inner.HTMLOListElement.isInner is true
+PASS inner.HTMLObjectElement.isInner is true
+PASS inner.HTMLOptGroupElement.isInner is true
+PASS inner.HTMLOptionElement.isInner is true
+PASS inner.HTMLParagraphElement.isInner is true
+PASS inner.HTMLParamElement.isInner is true
+PASS inner.HTMLPreElement.isInner is true
+PASS inner.HTMLQuoteElement.isInner is true
+PASS inner.HTMLScriptElement.isInner is true
+PASS inner.HTMLSelectElement.isInner is true
+PASS inner.HTMLStyleElement.isInner is true
+PASS inner.HTMLTableCaptionElement.isInner is true
+PASS inner.HTMLTableCellElement.isInner is true
+PASS inner.HTMLTableColElement.isInner is true
+PASS inner.HTMLTableElement.isInner is true
+PASS inner.HTMLTableRowElement.isInner is true
+PASS inner.HTMLTableSectionElement.isInner is true
+PASS inner.HTMLTextAreaElement.isInner is true
+PASS inner.HTMLTitleElement.isInner is true
+PASS inner.HTMLUListElement.isInner is true
+PASS inner.HTMLVideoElement.isInner is true
+PASS inner.Image.isInner is true
+PASS inner.KeyboardEvent.isInner is true
+PASS inner.MediaError.isInner is true
+PASS inner.MediaList.isInner is true
+PASS inner.MessageChannel.isInner is true
+PASS inner.MessageEvent.isInner is true
+PASS inner.MessagePort.isInner is true
+PASS inner.MimeType.isInner is true
+PASS inner.MimeTypeArray.isInner is true
+PASS inner.MouseEvent.isInner is true
+PASS inner.MutationEvent.isInner is true
+PASS inner.NamedNodeMap.isInner is true
+PASS inner.Node.isInner is true
+PASS inner.NodeFilter.isInner is true
+PASS inner.NodeList.isInner is true
+PASS inner.Notation.isInner is true
+PASS inner.Option.isInner is true
+PASS inner.OverflowEvent.isInner is true
+PASS inner.Plugin.isInner is true
+PASS inner.PluginArray.isInner is true
+PASS inner.ProcessingInstruction.isInner is true
+PASS inner.ProgressEvent.isInner is true
+PASS inner.Range.isInner is true
+PASS inner.RangeError.isInner is true
+PASS inner.RangeException.isInner is true
+PASS inner.Rect.isInner is true
+PASS inner.ReferenceError.isInner is true
+PASS inner.SVGAngle.isInner is true
+PASS inner.SVGColor.isInner is true
+PASS inner.SVGException.isInner is true
+PASS inner.SVGGradientElement.isInner is true
+PASS inner.SVGLength.isInner is true
+PASS inner.SVGMarkerElement.isInner is true
+PASS inner.SVGPaint.isInner is true
+PASS inner.SVGPathSeg.isInner is true
+PASS inner.SVGPreserveAspectRatio.isInner is true
+PASS inner.SVGRenderingIntent.isInner is true
+PASS inner.SVGTextContentElement.isInner is true
+PASS inner.SVGTextPathElement.isInner is true
+PASS inner.SVGTransform.isInner is true
+PASS inner.SVGUnitTypes.isInner is true
+PASS inner.Storage.isInner is true
+PASS inner.StorageEvent.isInner is true
+PASS inner.StyleSheet.isInner is true
+PASS inner.StyleSheetList.isInner is true
+PASS inner.SyntaxError.isInner is true
+PASS inner.Text.isInner is true
+PASS inner.TextEvent.isInner is true
+PASS inner.TextMetrics.isInner is true
+PASS inner.TypeError.isInner is true
+PASS inner.UIEvent.isInner is true
+PASS inner.URIError.isInner is true
+PASS inner.WebKitAnimationEvent.isInner is true
+PASS inner.WebKitCSSKeyframeRule.isInner is true
+PASS inner.WebKitCSSKeyframesRule.isInner is true
+PASS inner.WebKitCSSMatrix.isInner is true
+PASS inner.WebKitCSSTransformValue.isInner is true
+PASS inner.WebKitPoint.isInner is true
+PASS inner.WebKitTransitionEvent.isInner is true
+PASS inner.WheelEvent.isInner is true
+PASS inner.Worker.isInner is true
+PASS inner.XMLDocument.isInner is true
+PASS inner.XMLHttpRequest.isInner is true
+PASS inner.XMLHttpRequestException.isInner is true
+PASS inner.XMLHttpRequestUpload.isInner is true
+PASS inner.XMLSerializer.isInner is true
+PASS inner.XPathEvaluator.isInner is true
+PASS inner.XPathException.isInner is true
+PASS inner.XPathResult.isInner is true
+PASS inner.XSLTProcessor.isInner is true
+PASS inner.accessibilityController.isInner is true
+FAIL inner.addEventListener.isInner should be true. Was false.
+FAIL inner.alert.isInner should be true. Was false.
+PASS inner.appleScriptController.isInner is true
+FAIL inner.applicationCache.isInner should be true. Was false.
+FAIL inner.atob.isInner should be true. Was false.
+FAIL inner.blur.isInner should be true. Was false.
+FAIL inner.btoa.isInner should be true. Was false.
+FAIL inner.captureEvents.isInner should be true. Was false.
+FAIL inner.clearInterval.isInner should be true. Was false.
+FAIL inner.clearTimeout.isInner should be true. Was false.
+FAIL inner.clientInformation.isInner should be true. Was false.
+FAIL inner.close.isInner should be true. Was false.
+FAIL inner.confirm.isInner should be true. Was false.
+FAIL inner.console.isInner should be true. Was false.
+FAIL inner.devicePixelRatio.isInner should be true. Was false.
+FAIL inner.dispatchEvent.isInner should be true. Was false.
+PASS inner.document.isInner is true
+FAIL inner.find.isInner should be true. Was false.
+FAIL inner.focus.isInner should be true. Was false.
+FAIL inner.frameElement.isInner should be true. Was false.
+PASS inner.frames.isInner is true
+FAIL inner.getComputedStyle.isInner should be true. Was false.
+FAIL inner.getMatchedCSSRules.isInner should be true. Was false.
+FAIL inner.getSelection.isInner should be true. Was false.
+PASS inner.history.isInner is true
+FAIL inner.isInner.isInner should be true. Was false.
+FAIL inner.localStorage.isInner should be true. Was false.
+PASS inner.location.isInner is true
+FAIL inner.locationbar.isInner should be true. Was false.
+FAIL inner.menubar.isInner should be true. Was false.
+FAIL inner.moveBy.isInner should be true. Was false.
+FAIL inner.moveTo.isInner should be true. Was false.
+FAIL inner.name.isInner should be true. Was false.
+FAIL inner.navigator.isInner should be true. Was false.
+FAIL inner.offscreenBuffering.isInner should be true. Was false.
+FAIL inner.open.isInner should be true. Was false.
+FAIL inner.openDatabase.isInner should be true. Was false.
+FAIL inner.outerHeight.isInner should be true. Was false.
+FAIL inner.outerWidth.isInner should be true. Was false.
+FAIL inner.personalbar.isInner should be true. Was false.
+PASS inner.plainText.isInner is true
+FAIL inner.postMessage.isInner should be true. Was false.
+FAIL inner.print.isInner should be true. Was false.
+FAIL inner.prompt.isInner should be true. Was false.
+FAIL inner.releaseEvents.isInner should be true. Was false.
+FAIL inner.removeEventListener.isInner should be true. Was false.
+FAIL inner.resizeBy.isInner should be true. Was false.
+FAIL inner.resizeTo.isInner should be true. Was false.
+FAIL inner.screen.isInner should be true. Was false.
+FAIL inner.screenTop.isInner should be true. Was false.
+FAIL inner.screenY.isInner should be true. Was false.
+FAIL inner.scroll.isInner should be true. Was false.
+FAIL inner.scrollBy.isInner should be true. Was false.
+FAIL inner.scrollTo.isInner should be true. Was false.
+FAIL inner.scrollbars.isInner should be true. Was false.
+PASS inner.self.isInner is true
+FAIL inner.sessionStorage.isInner should be true. Was false.
+FAIL inner.setInterval.isInner should be true. Was false.
+FAIL inner.setTimeout.isInner should be true. Was false.
+FAIL inner.statusbar.isInner should be true. Was false.
+FAIL inner.stop.isInner should be true. Was false.
+FAIL inner.toolbar.isInner should be true. Was false.
+FAIL inner.webkitConvertPointFromNodeToPage.isInner should be true. Was false.
+FAIL inner.webkitConvertPointFromPageToNode.isInner should be true. Was false.
+PASS inner.window.isInner is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdomprototypeinheritancehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/prototype-inheritance.html (0 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/prototype-inheritance.html                                (rev 0)
+++ trunk/LayoutTests/fast/dom/prototype-inheritance.html        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;link rel=&quot;stylesheet&quot; href=&quot;../js/resources/js-test-style.css&quot;&gt;
+&lt;script src=&quot;../js/resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;p id=&quot;description&quot;&gt;&lt;/p&gt;
+&lt;div id=&quot;console&quot;&gt;&lt;/div&gt;
+&lt;script src=&quot;resources/prototype-inheritance.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../js/resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdomresourcesprototypeinheritancejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/resources/prototype-inheritance.js (0 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/resources/prototype-inheritance.js                                (rev 0)
+++ trunk/LayoutTests/fast/dom/resources/prototype-inheritance.js        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -0,0 +1,45 @@
</span><ins>+description(&quot;Make sure prototypes are set up using the window a property came from, instead of the lexical global object.&quot;)
+
+var subframe = document.createElement(&quot;iframe&quot;);
+document.body.appendChild(subframe);
+var inner = subframe.contentWindow; // Call it &quot;inner&quot; to make shouldBe output shorter
+
+var skippedProperties = [
+    // These reach outside the frame:
+    &quot;parent&quot;, &quot;top&quot;, &quot;opener&quot;,
+    // These are defined by DumpRenderTree
+    &quot;GCController&quot;, &quot;layoutTestController&quot;,
+    &quot;objCController&quot;, &quot;textInputController&quot;, &quot;navigationController&quot;,
+    &quot;eventSender&quot;, &quot;objCPlugin&quot;, &quot;objCPluginFunction&quot;,
+];
+
+var skippedPropertiesSet = {};
+for (var i = 0; i &lt; skippedProperties.length; i++)
+  skippedPropertiesSet[skippedProperties[i]] = true;
+
+// Stash a property on the prototypes.
+window.Object.prototype.isInner = false;
+inner.Object.prototype.isInner = true;
+
+var windowProperites = [];
+for (property in window) {
+    windowProperites.push(property);
+}
+windowProperties = windowProperites.sort();
+
+for (var x = 0; x &lt; windowProperites.length; x++) {
+    var property = windowProperites[x];
+    if (skippedPropertiesSet[property])
+        continue;
+
+    // Skip null properties (like on* listeners)
+    var value = inner[property];
+    if (!value)
+        continue;
+
+    shouldBeTrue(&quot;inner.&quot; + property + &quot;.isInner&quot;)
+}
+
+document.body.removeChild(subframe);
+
+var successfullyParsed = true;
</ins></span></pre></div>
<a id="trunkWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/ChangeLog (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/ChangeLog        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/ChangeLog        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -1,3 +1,57 @@
</span><ins>+2009-07-14  Eric Seidel  &lt;eric@webkit.org&gt;
+
+        Reviewed by Adam Barth.
+
+        Some constructor objects exposed on Window have the wrong prototype chain
+        https://bugs.webkit.org/show_bug.cgi?id=27276
+
+        Several Constructor classes were already being passed a global object
+        during construction, but they were ignoring it for prototype lookup.
+        I've fixed those to use the passed global object instead.
+
+        Most of these Constructor classes should just be auto-generated, but I
+        refrained from changing them over to auto-gen in this patch.
+
+        Fixed CodeGeneratorJS to pass a global object to getDOMConstructor when
+        available, otherwise default to deprecatedGlobalObjectForPrototype(exec)
+        to match existing behavior.
+
+        Test: fast/dom/prototype-inheritance.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::deprecatedGlobalObjectForPrototype): Make it easy to detect where the wrong global object is being used.
+        (WebCore::deprecatedGetDOMStructure):
+        * bindings/js/JSDOMGlobalObject.h: remove error-prone getDOMConstructor, require passing JSDOMGlobalObject*
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webKitPoint): pass &quot;this&quot; for the global object.
+        (WebCore::JSDOMWindow::webKitCSSMatrix): pass &quot;this&quot; for the global object.
+        (WebCore::JSDOMWindow::xsltProcessor): pass &quot;this&quot; for the global object.
+        (WebCore::JSDOMWindow::worker): pass &quot;this&quot; for the global object.
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor): use the existing globalObject pointer for prototype lookup
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWebKitPointConstructor.h:
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor): add new globalObject parameter and use it
+        * bindings/js/JSWorkerConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): use the existing globalObject pointer for prototype lookup
+         -- XMLHttpRequest constructor was also missing a length.  Added one.
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
</ins><span class="cx"> 2009-07-17  Dan Bernstein  &lt;mitz@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Build fix
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSAudioConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSAudioConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSAudioConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSAudioConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -42,13 +42,13 @@
</span><span class="cx"> const ClassInfo JSAudioConstructor::s_info = { &quot;AudioConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><span class="cx"> JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
</span><del>-    : DOMConstructorObject(JSAudioConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+    : DOMConstructorObject(JSAudioConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx">     , m_globalObject(globalObject)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(globalObject-&gt;scriptExecutionContext());
</span><span class="cx">     ASSERT(globalObject-&gt;scriptExecutionContext()-&gt;isDocument());
</span><span class="cx"> 
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
</ins><span class="cx">     putDirect(exec-&gt;propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSDOMBindingh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSDOMBinding.h (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSDOMBinding.h        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSDOMBinding.h        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -95,6 +95,14 @@
</span><span class="cx">     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
</span><span class="cx">     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
</span><span class="cx"> 
</span><ins>+    inline JSDOMGlobalObject* deprecatedGlobalObjectForPrototype(JSC::ExecState* exec)
+    {
+        // FIXME: Callers to this function should be using the global object
+        // from which the object is being created, instead of assuming the lexical one.
+        // e.g. subframe.document.body should use the subframe's global object, not the lexical one.
+        return static_cast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject());
+    }
+
</ins><span class="cx">     template&lt;class WrapperClass&gt; inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
</span><span class="cx">     {
</span><span class="cx">         if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &amp;WrapperClass::s_info))
</span><span class="lines">@@ -104,7 +112,7 @@
</span><span class="cx">     template&lt;class WrapperClass&gt; inline JSC::Structure* deprecatedGetDOMStructure(JSC::ExecState* exec)
</span><span class="cx">     {
</span><span class="cx">         // FIXME: This function is wrong.  It uses the wrong global object for creating the prototype structure.
</span><del>-        return getDOMStructure&lt;WrapperClass&gt;(exec, static_cast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject()));
</del><ins>+        return getDOMStructure&lt;WrapperClass&gt;(exec, deprecatedGlobalObjectForPrototype(exec));
</ins><span class="cx">     }
</span><span class="cx">     template&lt;class WrapperClass&gt; inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSDOMGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSDOMGlobalObject.h (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSDOMGlobalObject.h        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSDOMGlobalObject.h        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -89,16 +89,6 @@
</span><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     template&lt;class ConstructorClass&gt;
</span><del>-    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec)
-    {
-        if (JSC::JSObject* constructor = getCachedDOMConstructor(exec, &amp;ConstructorClass::s_info))
-            return constructor;
-        JSC::JSObject* constructor = new (exec) ConstructorClass(exec);
-        cacheDOMConstructor(exec, &amp;ConstructorClass::s_info, constructor);
-        return constructor;
-    }
-
-    template&lt;class ConstructorClass&gt;
</del><span class="cx">     inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
</span><span class="cx">     {
</span><span class="cx">         if (JSC::JSObject* constructor = globalObject-&gt;constructors().get(&amp;ConstructorClass::s_info))
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSDOMWindowCustom.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSDOMWindowCustom.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSDOMWindowCustom.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -443,12 +443,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSDOMWindow::webKitPoint(ExecState* exec) const
</span><span class="cx"> {
</span><del>-    return getDOMConstructor&lt;JSWebKitPointConstructor&gt;(exec);
</del><ins>+    return getDOMConstructor&lt;JSWebKitPointConstructor&gt;(exec, this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
</span><span class="cx"> {
</span><del>-    return getDOMConstructor&lt;JSWebKitCSSMatrixConstructor&gt;(exec);
</del><ins>+    return getDOMConstructor&lt;JSWebKitCSSMatrixConstructor&gt;(exec, this);
</ins><span class="cx"> }
</span><span class="cx">  
</span><span class="cx"> JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
</span><span class="lines">@@ -459,7 +459,7 @@
</span><span class="cx"> #if ENABLE(XSLT)
</span><span class="cx"> JSValue JSDOMWindow::xsltProcessor(ExecState* exec) const
</span><span class="cx"> {
</span><del>-    return getDOMConstructor&lt;JSXSLTProcessorConstructor&gt;(exec);
</del><ins>+    return getDOMConstructor&lt;JSXSLTProcessorConstructor&gt;(exec, this);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -473,7 +473,7 @@
</span><span class="cx"> #if ENABLE(WORKERS)
</span><span class="cx"> JSValue JSDOMWindow::worker(ExecState* exec) const
</span><span class="cx"> {
</span><del>-    return getDOMConstructor&lt;JSWorkerConstructor&gt;(exec);
</del><ins>+    return getDOMConstructor&lt;JSWorkerConstructor&gt;(exec, this);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSImageConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSImageConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSImageConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSImageConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -35,13 +35,13 @@
</span><span class="cx"> const ClassInfo JSImageConstructor::s_info = { &quot;ImageConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><span class="cx"> JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
</span><del>-    : DOMConstructorObject(JSImageConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+    : DOMConstructorObject(JSImageConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx">     , m_globalObject(globalObject)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(globalObject-&gt;scriptExecutionContext());
</span><span class="cx">     ASSERT(globalObject-&gt;scriptExecutionContext()-&gt;isDocument());
</span><span class="cx"> 
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, globalObject), None);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Document* JSImageConstructor::document() const
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSMessageChannelConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSMessageChannelConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSMessageChannelConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSMessageChannelConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -38,10 +38,10 @@
</span><span class="cx"> const ClassInfo JSMessageChannelConstructor::s_info = { &quot;MessageChannelConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><span class="cx"> JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
</span><del>-    : DOMConstructorObject(JSMessageChannelConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+    : DOMConstructorObject(JSMessageChannelConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx">     , m_globalObject(globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSMessageChannelPrototype::self(exec, globalObject), None);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSMessageChannelConstructor::~JSMessageChannelConstructor()
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSOptionConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSOptionConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSOptionConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSOptionConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -35,13 +35,13 @@
</span><span class="cx"> const ClassInfo JSOptionConstructor::s_info = { &quot;OptionConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><span class="cx"> JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
</span><del>-    : DOMConstructorObject(JSOptionConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+    : DOMConstructorObject(JSOptionConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx">     , m_globalObject(globalObject)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(globalObject-&gt;scriptExecutionContext());
</span><span class="cx">     ASSERT(globalObject-&gt;scriptExecutionContext()-&gt;isDocument());
</span><span class="cx"> 
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, globalObject), None);
</ins><span class="cx">     putDirect(exec-&gt;propertyNames().length, jsNumber(exec, 4), ReadOnly|DontDelete|DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSWebKitCSSMatrixConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -35,10 +35,10 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSWebKitCSSMatrixConstructor::s_info = { &quot;WebKitCSSMatrixConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><del>-JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor(ExecState* exec)
-    : DOMConstructorObject(JSWebKitCSSMatrixConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebKitCSSMatrixConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx"> {
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec, globalObject), None);
</ins><span class="cx">     putDirect(exec-&gt;propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSWebKitCSSMatrixConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> 
</span><span class="cx"> class JSWebKitCSSMatrixConstructor : public DOMConstructorObject {
</span><span class="cx"> public:
</span><del>-    JSWebKitCSSMatrixConstructor(JSC::ExecState*);
</del><ins>+    JSWebKitCSSMatrixConstructor(JSC::ExecState*, JSDOMGlobalObject*);
</ins><span class="cx">     static const JSC::ClassInfo s_info;
</span><span class="cx"> 
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSWebKitPointConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSWebKitPointConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSWebKitPointConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSWebKitPointConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -36,10 +36,10 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSWebKitPointConstructor::s_info = { &quot;WebKitPointConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><del>-JSWebKitPointConstructor::JSWebKitPointConstructor(ExecState* exec)
-    : DOMConstructorObject(JSWebKitPointConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+JSWebKitPointConstructor::JSWebKitPointConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWebKitPointConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx"> {
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSWebKitPointPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSWebKitPointPrototype::self(exec, globalObject), None);
</ins><span class="cx">     putDirect(exec-&gt;propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSWebKitPointConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSWebKitPointConstructor.h (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSWebKitPointConstructor.h        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSWebKitPointConstructor.h        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> 
</span><span class="cx"> class JSWebKitPointConstructor : public DOMConstructorObject {
</span><span class="cx"> public:
</span><del>-    JSWebKitPointConstructor(JSC::ExecState*);
</del><ins>+    JSWebKitPointConstructor(JSC::ExecState*, JSDOMGlobalObject*);
</ins><span class="cx">     static const JSC::ClassInfo s_info;
</span><span class="cx"> 
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSWorkerConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSWorkerConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSWorkerConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSWorkerConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -41,10 +41,10 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSWorkerConstructor::s_info = { &quot;WorkerConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><del>-JSWorkerConstructor::JSWorkerConstructor(ExecState* exec)
-    : DOMConstructorObject(JSWorkerConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+JSWorkerConstructor::JSWorkerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSWorkerConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx"> {
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSWorkerPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSWorkerPrototype::self(exec, globalObject), None);
</ins><span class="cx">     putDirect(exec-&gt;propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSWorkerConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSWorkerConstructor.h (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSWorkerConstructor.h        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSWorkerConstructor.h        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> 
</span><span class="cx">     class JSWorkerConstructor : public DOMConstructorObject {
</span><span class="cx">     public:
</span><del>-        JSWorkerConstructor(JSC::ExecState*);
</del><ins>+        JSWorkerConstructor(JSC::ExecState*, JSDOMGlobalObject*);
</ins><span class="cx"> 
</span><span class="cx">         static const JSC::ClassInfo s_info;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSXMLHttpRequestConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -33,10 +33,10 @@
</span><span class="cx"> const ClassInfo JSXMLHttpRequestConstructor::s_info = { &quot;XMLHttpRequestConstructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><span class="cx"> JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
</span><del>-    : DOMConstructorObject(JSXMLHttpRequestConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+    : DOMConstructorObject(JSXMLHttpRequestConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx">     , m_globalObject(globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, globalObject), None);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ScriptExecutionContext* JSXMLHttpRequestConstructor::scriptExecutionContext() const
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSXSLTProcessorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -41,10 +41,10 @@
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSXSLTProcessorConstructor::s_info = { &quot;XSLTProcessorConsructor&quot;, 0, 0, 0 };
</span><span class="cx"> 
</span><del>-JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
-    : DOMConstructorObject(JSXSLTProcessorConstructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSXSLTProcessorConstructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx"> {
</span><del>-    putDirect(exec-&gt;propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+    putDirect(exec-&gt;propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, globalObject), None);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList&amp;)
</span></span></pre></div>
<a id="trunkWebCorebindingsjsJSXSLTProcessorConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.h (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.h        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/js/JSXSLTProcessorConstructor.h        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> 
</span><span class="cx">     class JSXSLTProcessorConstructor : public DOMConstructorObject {
</span><span class="cx">     public:
</span><del>-        JSXSLTProcessorConstructor(JSC::ExecState*);
</del><ins>+        JSXSLTProcessorConstructor(JSC::ExecState*, JSDOMGlobalObject*);
</ins><span class="cx">         static const JSC::ClassInfo s_info;
</span><span class="cx"> 
</span><span class="cx">     private:
</span></span></pre></div>
<a id="trunkWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/WebCore/bindings/scripts/CodeGeneratorJS.pm (46067 => 46068)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/WebCore/bindings/scripts/CodeGeneratorJS.pm        2009-07-17 23:11:45 UTC (rev 46067)
+++ trunk/WebCore/bindings/scripts/CodeGeneratorJS.pm        2009-07-17 23:13:04 UTC (rev 46068)
</span><span class="lines">@@ -520,7 +520,7 @@
</span><span class="cx">     push(@headerContent, &quot;    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier&amp; propertyName);\n&quot;) if $dataNode-&gt;extendedAttributes-&gt;{&quot;CustomLookupSetter&quot;};
</span><span class="cx"> 
</span><span class="cx">     # Constructor object getter
</span><del>-    push(@headerContent, &quot;    static JSC::JSValue getConstructor(JSC::ExecState*);\n&quot;) if $dataNode-&gt;extendedAttributes-&gt;{&quot;GenerateConstructor&quot;};
</del><ins>+    push(@headerContent, &quot;    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n&quot;) if $dataNode-&gt;extendedAttributes-&gt;{&quot;GenerateConstructor&quot;};
</ins><span class="cx"> 
</span><span class="cx">     my $numCustomFunctions = 0;
</span><span class="cx">     my $numCustomAttributes = 0;
</span><span class="lines">@@ -1132,8 +1132,10 @@
</span><span class="cx">                 } elsif ($attribute-&gt;signature-&gt;type =~ /Constructor$/) {
</span><span class="cx">                     my $constructorType = $codeGenerator-&gt;StripModule($attribute-&gt;signature-&gt;type);
</span><span class="cx">                     $constructorType =~ s/Constructor$//;
</span><del>-                    push(@implContent, &quot;    UNUSED_PARAM(slot);\n&quot;);
-                    push(@implContent, &quot;    return JS&quot; . $constructorType . &quot;::getConstructor(exec);\n&quot;);
</del><ins>+                    push(@implContent, &quot;    ${className}* castedThis = static_cast&lt;$className*&gt;(asObject(slot.slotBase()));\n&quot;);
+                    # Constructor attribute is only used by DOMWindow.idl, so it's correct to pass castedThis as the global object
+                    # Once DOMObjects have a back-pointer to the globalObject we can pass castedThis-&gt;globalObject()
+                    push(@implContent, &quot;    return JS&quot; . $constructorType . &quot;::getConstructor(exec, castedThis);\n&quot;);
</ins><span class="cx">                 } elsif (!@{$attribute-&gt;getterExceptions}) {
</span><span class="cx">                     push(@implContent, &quot;    UNUSED_PARAM(exec);\n&quot;);
</span><span class="cx">                     if ($podType) {
</span><span class="lines">@@ -1191,9 +1193,9 @@
</span><span class="cx">             if ($dataNode-&gt;extendedAttributes-&gt;{&quot;GenerateConstructor&quot;}) {
</span><span class="cx">                 my $constructorFunctionName = &quot;js&quot; . $interfaceName . &quot;Constructor&quot;;
</span><span class="cx"> 
</span><del>-                push(@implContent, &quot;JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&amp;, const PropertySlot&amp; slot)\n&quot;);
</del><ins>+                push(@implContent, &quot;JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&amp;, const PropertySlot&amp;)\n&quot;);
</ins><span class="cx">                 push(@implContent, &quot;{\n&quot;);
</span><del>-                push(@implContent, &quot;    return static_cast&lt;$className*&gt;(asObject(slot.slotBase()))-&gt;getConstructor(exec);\n&quot;);
</del><ins>+                push(@implContent, &quot;    return ${className}::getConstructor(exec, deprecatedGlobalObjectForPrototype(exec));\n&quot;);
</ins><span class="cx">                 push(@implContent, &quot;}\n&quot;);
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -1338,8 +1340,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if ($dataNode-&gt;extendedAttributes-&gt;{&quot;GenerateConstructor&quot;}) {
</span><del>-        push(@implContent, &quot;JSValue ${className}::getConstructor(ExecState* exec)\n{\n&quot;);
-        push(@implContent, &quot;    return getDOMConstructor&lt;${className}Constructor&gt;(exec);\n&quot;);
</del><ins>+        push(@implContent, &quot;JSValue ${className}::getConstructor(ExecState* exec, JSGlobalObject* globalObject)\n{\n&quot;);
+        push(@implContent, &quot;    return getDOMConstructor&lt;${className}Constructor&gt;(exec, static_cast&lt;JSDOMGlobalObject*&gt;(globalObject));\n&quot;);
</ins><span class="cx">         push(@implContent, &quot;}\n\n&quot;);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -2027,10 +2029,10 @@
</span><span class="cx"> my $implContent = &lt;&lt; &quot;EOF&quot;;
</span><span class="cx"> class ${className}Constructor : public DOMObject {
</span><span class="cx"> public:
</span><del>-    ${className}Constructor(ExecState* exec)
-        : DOMObject(${className}Constructor::createStructure(exec-&gt;lexicalGlobalObject()-&gt;objectPrototype()))
</del><ins>+    ${className}Constructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+        : DOMObject(${className}Constructor::createStructure(globalObject-&gt;objectPrototype()))
</ins><span class="cx">     {
</span><del>-        putDirect(exec-&gt;propertyNames().prototype, ${protoClassName}::self(exec, exec-&gt;lexicalGlobalObject()), None);
</del><ins>+        putDirect(exec-&gt;propertyNames().prototype, ${protoClassName}::self(exec, globalObject), None);
</ins><span class="cx">     }
</span><span class="cx">     virtual bool getOwnPropertySlot(ExecState*, const Identifier&amp;, PropertySlot&amp;);
</span><span class="cx">     virtual const ClassInfo* classInfo() const { return &amp;s_info; }
</span></span></pre>
</div>
</div>

</body>
</html>