<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[160879] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/160879">160879</a></dd>
<dt>Author</dt> <dd>oliver@apple.com</dd>
<dt>Date</dt> <dd>2013-12-19 16:52:06 -0800 (Thu, 19 Dec 2013)</dd>
</dl>

<h3>Log Message</h3>
<pre>DOM bindings should use thisValue for attributes
https://bugs.webkit.org/show_bug.cgi?id=126011

Reviewed by Antti Koivisto.

Source/WebCore:

Make all standard DOM attributes use the thisValue instead
of the slot object.  This requires using a dynamic cast in
the attribute getters. Happily for normal uses this a single
indirect load and pointer compare, and we were already doing
it for many attributes.

Alas it's too expensive to do this on the window object still
due to the proxy indirection that intercepts global variable
access.  I'll correct this in a follow on patch (bug 126013).

A number of custom getters have also been updated to use the
thisValue and full type checks.

This patch still leaves the index and generic named getters
on the slot based model as fixing these cases requires more
complicated changes.

* bindings/js/JSCSSStyleDeclarationCustom.cpp:
(WebCore::cssPropertyGetterPixelOrPosPrefixCallback):
(WebCore::cssPropertyGetterCallback):
* bindings/js/JSPluginElementFunctions.cpp:
(WebCore::pluginElementPropertyGetter):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::jsTestActiveDOMObjectExcitingAttr):
(WebCore::jsTestActiveDOMObjectConstructor):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::jsTestCustomNamedGetterConstructor):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::jsTestEventConstructorAttr1):
(WebCore::jsTestEventConstructorAttr2):
(WebCore::jsTestEventConstructorConstructor):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::jsTestEventTargetConstructor):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::jsTestExceptionName):
(WebCore::jsTestExceptionConstructor):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::jsTestGenerateIsReachableConstructor):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
(WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
(WebCore::jsTestInterfaceImplementsStr1):
(WebCore::jsTestInterfaceImplementsStr2):
(WebCore::jsTestInterfaceImplementsStr3):
(WebCore::jsTestInterfaceImplementsNode):
(WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
(WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
(WebCore::jsTestInterfaceSupplementalStr1):
(WebCore::jsTestInterfaceSupplementalStr2):
(WebCore::jsTestInterfaceSupplementalStr3):
(WebCore::jsTestInterfaceSupplementalNode):
(WebCore::jsTestInterfaceConstructor):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::jsTestMediaQueryListListenerConstructor):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::jsTestNamedConstructorConstructor):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::jsTestNodeConstructor):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjReadOnlyLongAttr):
(WebCore::jsTestObjReadOnlyStringAttr):
(WebCore::jsTestObjReadOnlyTestObjAttr):
(WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
(WebCore::jsTestObjConstructorStaticStringAttr):
(WebCore::jsTestObjConstructorTestSubObj):
(WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::jsTestObjEnumAttr):
(WebCore::jsTestObjByteAttr):
(WebCore::jsTestObjOctetAttr):
(WebCore::jsTestObjShortAttr):
(WebCore::jsTestObjUnsignedShortAttr):
(WebCore::jsTestObjLongAttr):
(WebCore::jsTestObjLongLongAttr):
(WebCore::jsTestObjUnsignedLongLongAttr):
(WebCore::jsTestObjStringAttr):
(WebCore::jsTestObjTestObjAttr):
(WebCore::jsTestObjXMLObjAttr):
(WebCore::jsTestObjCreate):
(WebCore::jsTestObjReflectedStringAttr):
(WebCore::jsTestObjReflectedIntegralAttr):
(WebCore::jsTestObjReflectedUnsignedIntegralAttr):
(WebCore::jsTestObjReflectedBooleanAttr):
(WebCore::jsTestObjReflectedURLAttr):
(WebCore::jsTestObjReflectedCustomIntegralAttr):
(WebCore::jsTestObjReflectedCustomBooleanAttr):
(WebCore::jsTestObjReflectedCustomURLAttr):
(WebCore::jsTestObjTypedArrayAttr):
(WebCore::jsTestObjAttrWithGetterException):
(WebCore::jsTestObjAttrWithSetterException):
(WebCore::jsTestObjStringAttrWithGetterException):
(WebCore::jsTestObjStringAttrWithSetterException):
(WebCore::jsTestObjCustomAttr):
(WebCore::jsTestObjWithScriptStateAttribute):
(WebCore::jsTestObjWithScriptExecutionContextAttribute):
(WebCore::jsTestObjWithScriptStateAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
(WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
(WebCore::jsTestObjConditionalAttr1):
(WebCore::jsTestObjConditionalAttr2):
(WebCore::jsTestObjConditionalAttr3):
(WebCore::jsTestObjConditionalAttr4Constructor):
(WebCore::jsTestObjConditionalAttr5Constructor):
(WebCore::jsTestObjConditionalAttr6Constructor):
(WebCore::jsTestObjCachedAttribute1):
(WebCore::jsTestObjCachedAttribute2):
(WebCore::jsTestObjAnyAttribute):
(WebCore::jsTestObjContentDocument):
(WebCore::jsTestObjMutablePoint):
(WebCore::jsTestObjImmutablePoint):
(WebCore::jsTestObjStrawberry):
(WebCore::jsTestObjStrictFloat):
(WebCore::jsTestObjDescription):
(WebCore::jsTestObjId):
(WebCore::jsTestObjHash):
(WebCore::jsTestObjReplaceableAttribute):
(WebCore::jsTestObjNullableDoubleAttribute):
(WebCore::jsTestObjNullableLongAttribute):
(WebCore::jsTestObjNullableBooleanAttribute):
(WebCore::jsTestObjNullableStringAttribute):
(WebCore::jsTestObjNullableLongSettableAttribute):
(WebCore::jsTestObjNullableStringValue):
(WebCore::jsTestObjAttribute):
(WebCore::jsTestObjAttributeWithReservedEnumType):
(WebCore::jsTestObjConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::jsTestOverloadedConstructorsConstructor):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::jsTestSerializedScriptValueInterfaceValue):
(WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
(WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
(WebCore::jsTestSerializedScriptValueInterfacePorts):
(WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
(WebCore::jsTestSerializedScriptValueInterfaceConstructor):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::jsTestTypedefsUnsignedLongLongAttr):
(WebCore::jsTestTypedefsImmutableSerializedScriptValue):
(WebCore::jsTestTypedefsConstructorTestSubObj):
(WebCore::jsTestTypedefsAttrWithGetterException):
(WebCore::jsTestTypedefsAttrWithSetterException):
(WebCore::jsTestTypedefsStringAttrWithGetterException):
(WebCore::jsTestTypedefsStringAttrWithSetterException):
(WebCore::jsTestTypedefsConstructor):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::jsattributeReadonly):
(WebCore::jsattributeConstructor):
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::jsreadonlyConstructor):
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::lengthGetter):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::lengthGetter):

LayoutTests:

* js/dom/dom-attributes-on-mismatch-type.html: Added.
* js/dom/dom-attributes-on-mismatch-type-expected.txt: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSCSSStyleDeclarationCustomcpp">trunk/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSPluginElementFunctionscpp">trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSattributecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSreadonlycpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp</a></li>
<li><a href="#trunkSourceWebCorebridgeruntime_arraycpp">trunk/Source/WebCore/bridge/runtime_array.cpp</a></li>
<li><a href="#trunkSourceWebCorebridgeruntime_methodcpp">trunk/Source/WebCore/bridge/runtime_method.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsdomdomattributesonmismatchtypeexpectedtxt">trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdomattributesonmismatchtypehtml">trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/LayoutTests/ChangeLog        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2013-12-19  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        DOM bindings should use thisValue for attributes
+        https://bugs.webkit.org/show_bug.cgi?id=126011
+
+        Reviewed by Antti Koivisto.
+
+        * js/dom/dom-attributes-on-mismatch-type.html: Added.
+        * js/dom/dom-attributes-on-mismatch-type-expected.txt: Added.
+
</ins><span class="cx"> 2013-12-19  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Implement ArrayBuffer.isView
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomdomattributesonmismatchtypeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type-expected.txt (0 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type-expected.txt        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -0,0 +1,15 @@
</span><ins>+Make sure DOM attributes handle different types of |this| properly
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS objectWithDocumentAsPrototype.all threw exception TypeError: Type error.
+See what happens if we put the anchor prototype on a div
+PASS testDiv instanceof HTMLAnchorElement is true
+PASS testDiv.href is undefined.
+PASS testDiv instanceof HTMLAnchorElement is true
+PASS testDiv.href threw exception TypeError: Type error.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdomattributesonmismatchtypehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type.html (0 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type.html                                (rev 0)
+++ trunk/LayoutTests/js/dom/dom-attributes-on-mismatch-type.html        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -0,0 +1,27 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;title&gt;Test&lt;/title&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    &lt;div id=&quot;testDiv&quot;&gt;&lt;/div&gt;
+    &lt;a id=&quot;testAnchor&quot;&gt;&lt;/a&gt;
+    &lt;script&gt;
+        description(&quot;Make sure DOM attributes handle different types of |this| properly&quot;);
+        var testDiv = document.getElementById(&quot;testDiv&quot;);
+        var testAnchor = document.getElementById(&quot;testAnchor&quot;);
+        var objectWithDocumentAsPrototype = { __proto__: document };
+        shouldThrow(&quot;objectWithDocumentAsPrototype.all&quot;);
+        debug(&quot;See what happens if we put the anchor prototype on a div&quot;);
+        testDiv.__proto__ = testAnchor.__proto__;
+        shouldBeTrue(&quot;testDiv instanceof HTMLAnchorElement&quot;)
+        /* This will change to an exception once attributes are on the prototype chain */
+        shouldBeUndefined(&quot;testDiv.href&quot;)
+        testDiv.__proto__ = testAnchor;
+        shouldBeTrue(&quot;testDiv instanceof HTMLAnchorElement&quot;)
+        shouldThrow(&quot;testDiv.href&quot;)
+    &lt;/script&gt;
+    &lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/ChangeLog        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -1,3 +1,167 @@
</span><ins>+2013-12-19  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        DOM bindings should use thisValue for attributes
+        https://bugs.webkit.org/show_bug.cgi?id=126011
+
+        Reviewed by Antti Koivisto.
+
+        Make all standard DOM attributes use the thisValue instead
+        of the slot object.  This requires using a dynamic cast in
+        the attribute getters. Happily for normal uses this a single
+        indirect load and pointer compare, and we were already doing
+        it for many attributes.
+
+        Alas it's too expensive to do this on the window object still
+        due to the proxy indirection that intercepts global variable
+        access.  I'll correct this in a follow on patch (bug 126013).
+
+        A number of custom getters have also been updated to use the
+        thisValue and full type checks.
+
+        This patch still leaves the index and generic named getters
+        on the slot based model as fixing these cases requires more
+        complicated changes.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyGetterPixelOrPosPrefixCallback):
+        (WebCore::cssPropertyGetterCallback):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginElementPropertyGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::jsTestActiveDOMObjectExcitingAttr):
+        (WebCore::jsTestActiveDOMObjectConstructor):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::jsTestCustomNamedGetterConstructor):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::jsTestEventConstructorAttr1):
+        (WebCore::jsTestEventConstructorAttr2):
+        (WebCore::jsTestEventConstructorConstructor):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::jsTestEventTargetConstructor):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::jsTestExceptionName):
+        (WebCore::jsTestExceptionConstructor):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::jsTestGenerateIsReachableConstructor):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
+        (WebCore::jsTestInterfaceImplementsStr1):
+        (WebCore::jsTestInterfaceImplementsStr2):
+        (WebCore::jsTestInterfaceImplementsStr3):
+        (WebCore::jsTestInterfaceImplementsNode):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::jsTestInterfaceSupplementalStr1):
+        (WebCore::jsTestInterfaceSupplementalStr2):
+        (WebCore::jsTestInterfaceSupplementalStr3):
+        (WebCore::jsTestInterfaceSupplementalNode):
+        (WebCore::jsTestInterfaceConstructor):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::jsTestMediaQueryListListenerConstructor):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::jsTestNamedConstructorConstructor):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::jsTestNodeConstructor):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjReadOnlyLongAttr):
+        (WebCore::jsTestObjReadOnlyStringAttr):
+        (WebCore::jsTestObjReadOnlyTestObjAttr):
+        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
+        (WebCore::jsTestObjConstructorStaticStringAttr):
+        (WebCore::jsTestObjConstructorTestSubObj):
+        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
+        (WebCore::jsTestObjEnumAttr):
+        (WebCore::jsTestObjByteAttr):
+        (WebCore::jsTestObjOctetAttr):
+        (WebCore::jsTestObjShortAttr):
+        (WebCore::jsTestObjUnsignedShortAttr):
+        (WebCore::jsTestObjLongAttr):
+        (WebCore::jsTestObjLongLongAttr):
+        (WebCore::jsTestObjUnsignedLongLongAttr):
+        (WebCore::jsTestObjStringAttr):
+        (WebCore::jsTestObjTestObjAttr):
+        (WebCore::jsTestObjXMLObjAttr):
+        (WebCore::jsTestObjCreate):
+        (WebCore::jsTestObjReflectedStringAttr):
+        (WebCore::jsTestObjReflectedIntegralAttr):
+        (WebCore::jsTestObjReflectedUnsignedIntegralAttr):
+        (WebCore::jsTestObjReflectedBooleanAttr):
+        (WebCore::jsTestObjReflectedURLAttr):
+        (WebCore::jsTestObjReflectedCustomIntegralAttr):
+        (WebCore::jsTestObjReflectedCustomBooleanAttr):
+        (WebCore::jsTestObjReflectedCustomURLAttr):
+        (WebCore::jsTestObjTypedArrayAttr):
+        (WebCore::jsTestObjAttrWithGetterException):
+        (WebCore::jsTestObjAttrWithSetterException):
+        (WebCore::jsTestObjStringAttrWithGetterException):
+        (WebCore::jsTestObjStringAttrWithSetterException):
+        (WebCore::jsTestObjCustomAttr):
+        (WebCore::jsTestObjWithScriptStateAttribute):
+        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
+        (WebCore::jsTestObjWithScriptStateAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::jsTestObjConditionalAttr1):
+        (WebCore::jsTestObjConditionalAttr2):
+        (WebCore::jsTestObjConditionalAttr3):
+        (WebCore::jsTestObjConditionalAttr4Constructor):
+        (WebCore::jsTestObjConditionalAttr5Constructor):
+        (WebCore::jsTestObjConditionalAttr6Constructor):
+        (WebCore::jsTestObjCachedAttribute1):
+        (WebCore::jsTestObjCachedAttribute2):
+        (WebCore::jsTestObjAnyAttribute):
+        (WebCore::jsTestObjContentDocument):
+        (WebCore::jsTestObjMutablePoint):
+        (WebCore::jsTestObjImmutablePoint):
+        (WebCore::jsTestObjStrawberry):
+        (WebCore::jsTestObjStrictFloat):
+        (WebCore::jsTestObjDescription):
+        (WebCore::jsTestObjId):
+        (WebCore::jsTestObjHash):
+        (WebCore::jsTestObjReplaceableAttribute):
+        (WebCore::jsTestObjNullableDoubleAttribute):
+        (WebCore::jsTestObjNullableLongAttribute):
+        (WebCore::jsTestObjNullableBooleanAttribute):
+        (WebCore::jsTestObjNullableStringAttribute):
+        (WebCore::jsTestObjNullableLongSettableAttribute):
+        (WebCore::jsTestObjNullableStringValue):
+        (WebCore::jsTestObjAttribute):
+        (WebCore::jsTestObjAttributeWithReservedEnumType):
+        (WebCore::jsTestObjConstructor):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::jsTestOverloadedConstructorsConstructor):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::jsTestSerializedScriptValueInterfaceValue):
+        (WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
+        (WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
+        (WebCore::jsTestSerializedScriptValueInterfacePorts):
+        (WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
+        (WebCore::jsTestSerializedScriptValueInterfaceConstructor):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::jsTestTypedefsUnsignedLongLongAttr):
+        (WebCore::jsTestTypedefsImmutableSerializedScriptValue):
+        (WebCore::jsTestTypedefsConstructorTestSubObj):
+        (WebCore::jsTestTypedefsAttrWithGetterException):
+        (WebCore::jsTestTypedefsAttrWithSetterException):
+        (WebCore::jsTestTypedefsStringAttrWithGetterException):
+        (WebCore::jsTestTypedefsStringAttrWithSetterException):
+        (WebCore::jsTestTypedefsConstructor):
+        * bindings/scripts/test/JS/JSattribute.cpp:
+        (WebCore::jsattributeReadonly):
+        (WebCore::jsattributeConstructor):
+        * bindings/scripts/test/JS/JSreadonly.cpp:
+        (WebCore::jsreadonlyConstructor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+
</ins><span class="cx"> 2013-12-19  Andy Estes  &lt;aestes@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Remove WebFilterEvaluator wrappers from WebKitSystemInterface
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSCSSStyleDeclarationCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -303,9 +303,12 @@
</span><span class="cx">     return getPropertyValueFallback(exec, thisObj, propertyID);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static EncodedJSValue cssPropertyGetterPixelOrPosPrefixCallback(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, unsigned propertyID)
</del><ins>+static EncodedJSValue cssPropertyGetterPixelOrPosPrefixCallback(ExecState* exec, EncodedJSValue, EncodedJSValue thisValue, unsigned propertyID)
</ins><span class="cx"> {
</span><del>-    return JSValue::encode(cssPropertyGetterPixelOrPosPrefix(exec, jsCast&lt;JSCSSStyleDeclaration*&gt;(JSValue::decode(slotBase)), propertyID));
</del><ins>+    JSCSSStyleDeclaration* thisObject = jsDynamicCast&lt;JSCSSStyleDeclaration*&gt;(JSValue::decode(thisValue));
+    if (!thisObject)
+        return throwVMTypeError(exec);
+    return JSValue::encode(cssPropertyGetterPixelOrPosPrefix(exec, thisObject, propertyID));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static inline JSValue cssPropertyGetter(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned propertyID)
</span><span class="lines">@@ -317,9 +320,12 @@
</span><span class="cx">     return getPropertyValueFallback(exec, thisObj, propertyID);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static EncodedJSValue cssPropertyGetterCallback(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, unsigned propertyID)
</del><ins>+static EncodedJSValue cssPropertyGetterCallback(ExecState* exec, EncodedJSValue, EncodedJSValue thisValue, unsigned propertyID)
</ins><span class="cx"> {
</span><del>-    return JSValue::encode(cssPropertyGetter(exec, jsCast&lt;JSCSSStyleDeclaration*&gt;(JSValue::decode(slotBase)), propertyID));
</del><ins>+    JSCSSStyleDeclaration* thisObject = jsDynamicCast&lt;JSCSSStyleDeclaration*&gt;(JSValue::decode(thisValue));
+    if (!thisObject)
+        return throwVMTypeError(exec);
+    return JSValue::encode(cssPropertyGetter(exec, thisObject, propertyID));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSCSSStyleDeclaration::getOwnPropertySlotDelegate(ExecState*, PropertyName propertyIdentifier, PropertySlot&amp; slot)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSPluginElementFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -100,10 +100,13 @@
</span><span class="cx">     return instance-&gt;createRuntimeObject(exec);
</span><span class="cx"> }
</span><span class="cx">     
</span><del>-EncodedJSValue pluginElementPropertyGetter(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName propertyName)
</del><ins>+EncodedJSValue pluginElementPropertyGetter(ExecState* exec, EncodedJSValue, EncodedJSValue thisValue, PropertyName propertyName)
</ins><span class="cx"> {
</span><del>-    JSHTMLElement* element = jsCast&lt;JSHTMLElement*&gt;(JSValue::decode(slotBase));
-    JSObject* scriptObject = pluginScriptObject(exec, element);
</del><ins>+
+    JSHTMLElement* thisObject = jsDynamicCast&lt;JSHTMLElement*&gt;(JSValue::decode(thisValue));
+    if (!thisObject)
+        return throwVMTypeError(exec);
+    JSObject* scriptObject = pluginScriptObject(exec, thisObject);
</ins><span class="cx">     if (!scriptObject)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -1887,12 +1887,21 @@
</span><span class="cx">             my $attributeConditionalString = $codeGenerator-&gt;GenerateConditionalString($attribute-&gt;signature);
</span><span class="cx">             push(@implContent, &quot;#if ${attributeConditionalString}\n&quot;) if $attributeConditionalString;
</span><span class="cx"> 
</span><del>-            push(@implContent, &quot;EncodedJSValue ${getFunctionName}(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)\n&quot;);
</del><ins>+            push(@implContent, &quot;EncodedJSValue ${getFunctionName}(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)\n&quot;);
</ins><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><span class="cx"> 
</span><span class="cx">             if (!$attribute-&gt;isStatic || $attribute-&gt;signature-&gt;type =~ /Constructor$/) {
</span><del>-                push(@implContent, &quot;    ${className}* castedThis = jsDynamicCast&lt;$className*&gt;(JSValue::decode(slotBase));\n&quot;);
</del><ins>+                if ($interfaceName eq &quot;DOMWindow&quot;) {
+                    push(@implContent, &quot;    ${className}* castedThis = jsCast&lt;$className*&gt;(JSValue::decode(slotBase));\n&quot;);
+                    push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;);
+                } else {
+                    push(@implContent, &quot;    ${className}* castedThis = jsDynamicCast&lt;$className*&gt;(JSValue::decode(thisValue));\n&quot;);
+                    push(@implContent, &quot;    UNUSED_PARAM(slotBase);\n&quot;);
+                    push(@implContent, &quot;    if (!castedThis)\n&quot;);
+                    push(@implContent, &quot;        return throwVMTypeError(exec);\n&quot;);
+                }
</ins><span class="cx">             } else {
</span><ins>+                push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;);
</ins><span class="cx">                 push(@implContent, &quot;    UNUSED_PARAM(slotBase);\n&quot;);
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="lines">@@ -2058,6 +2067,8 @@
</span><span class="cx">             push(@implContent, &quot;EncodedJSValue ${constructorFunctionName}(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)\n&quot;);
</span><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    ${className}* domObject = jsDynamicCast&lt;$className*&gt;(JSValue::decode(slotBase));\n&quot;);
</span><ins>+            push(@implContent, &quot;    if (!domObject)\n&quot;);
+            push(@implContent, &quot;        return throwVMTypeError(exec);\n&quot;);
</ins><span class="cx"> 
</span><span class="cx">             if ($interface-&gt;extendedAttributes-&gt;{&quot;CheckSecurity&quot;}) {
</span><span class="cx">                 push(@implContent, &quot;    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, domObject-&gt;impl()))\n&quot;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -130,9 +130,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSTestActiveDOMObject, Base&gt;(exec, JSTestActiveDOMObjectTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestActiveDOMObjectExcitingAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestActiveDOMObjectExcitingAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestActiveDOMObject* castedThis = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestActiveDOMObject* castedThis = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, castedThis-&gt;impl()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="lines">@@ -145,6 +148,8 @@
</span><span class="cx"> EncodedJSValue jsTestActiveDOMObjectConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestActiveDOMObject* domObject = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, domObject-&gt;impl()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     return JSValue::encode(JSTestActiveDOMObject::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -147,6 +147,8 @@
</span><span class="cx"> EncodedJSValue jsTestCustomNamedGetterConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestCustomNamedGetter* domObject = jsDynamicCast&lt;JSTestCustomNamedGetter*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestCustomNamedGetter::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -167,9 +167,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSTestEventConstructor, Base&gt;(exec, JSTestEventConstructorTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestEventConstructorAttr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestEventConstructorAttr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestEventConstructor* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestEventConstructor* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestEventConstructor&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.attr1());
</span><span class="lines">@@ -177,9 +180,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestEventConstructorAttr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestEventConstructorAttr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestEventConstructor* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestEventConstructor* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestEventConstructor&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.attr2());
</span><span class="lines">@@ -190,6 +196,8 @@
</span><span class="cx"> EncodedJSValue jsTestEventConstructorConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestEventConstructor* domObject = jsDynamicCast&lt;JSTestEventConstructor*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestEventConstructor::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -172,6 +172,8 @@
</span><span class="cx"> EncodedJSValue jsTestEventTargetConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestEventTarget* domObject = jsDynamicCast&lt;JSTestEventTarget*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestEventTarget::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -120,9 +120,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSTestException, Base&gt;(exec, JSTestExceptionTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestExceptionName(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestExceptionName(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestException* castedThis = jsDynamicCast&lt;JSTestException*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestException* castedThis = jsDynamicCast&lt;JSTestException*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestException&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.name());
</span><span class="lines">@@ -133,6 +136,8 @@
</span><span class="cx"> EncodedJSValue jsTestExceptionConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestException* domObject = jsDynamicCast&lt;JSTestException*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestException::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -120,6 +120,8 @@
</span><span class="cx"> EncodedJSValue jsTestGenerateIsReachableConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestGenerateIsReachable* domObject = jsDynamicCast&lt;JSTestGenerateIsReachable*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestGenerateIsReachable::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -272,8 +272,9 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><del>-EncodedJSValue jsTestInterfaceConstructorImplementsStaticReadOnlyAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceConstructorImplementsStaticReadOnlyAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><ins>+    UNUSED_PARAM(thisValue);
</ins><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     JSValue result = jsNumber(TestInterface::implementsStaticReadOnlyAttr());
</span><span class="lines">@@ -283,8 +284,9 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><del>-EncodedJSValue jsTestInterfaceConstructorImplementsStaticAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceConstructorImplementsStaticAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><ins>+    UNUSED_PARAM(thisValue);
</ins><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     JSValue result = jsStringWithCache(exec, TestInterface::implementsStaticAttr());
</span><span class="lines">@@ -294,9 +296,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><del>-EncodedJSValue jsTestInterfaceImplementsStr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceImplementsStr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.implementsStr1());
</span><span class="lines">@@ -306,9 +311,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><del>-EncodedJSValue jsTestInterfaceImplementsStr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceImplementsStr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.implementsStr2());
</span><span class="lines">@@ -318,18 +326,24 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><del>-EncodedJSValue jsTestInterfaceImplementsStr3(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceImplementsStr3(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(castedThis-&gt;implementsStr3(exec));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><del>-EncodedJSValue jsTestInterfaceImplementsNode(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceImplementsNode(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.implementsNode()));
</span><span class="lines">@@ -339,8 +353,9 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><del>-EncodedJSValue jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><ins>+    UNUSED_PARAM(thisValue);
</ins><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     JSValue result = jsNumber(TestSupplemental::supplementalStaticReadOnlyAttr());
</span><span class="lines">@@ -350,8 +365,9 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><del>-EncodedJSValue jsTestInterfaceConstructorSupplementalStaticAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceConstructorSupplementalStaticAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><ins>+    UNUSED_PARAM(thisValue);
</ins><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     JSValue result = jsStringWithCache(exec, TestSupplemental::supplementalStaticAttr());
</span><span class="lines">@@ -361,9 +377,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><del>-EncodedJSValue jsTestInterfaceSupplementalStr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceSupplementalStr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, TestSupplemental::supplementalStr1(&amp;impl));
</span><span class="lines">@@ -373,9 +392,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><del>-EncodedJSValue jsTestInterfaceSupplementalStr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceSupplementalStr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, TestSupplemental::supplementalStr2(&amp;impl));
</span><span class="lines">@@ -385,18 +407,24 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><del>-EncodedJSValue jsTestInterfaceSupplementalStr3(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceSupplementalStr3(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(castedThis-&gt;supplementalStr3(exec));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><del>-EncodedJSValue jsTestInterfaceSupplementalNode(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestInterfaceSupplementalNode(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(TestSupplemental::supplementalNode(&amp;impl)));
</span><span class="lines">@@ -408,6 +436,8 @@
</span><span class="cx"> EncodedJSValue jsTestInterfaceConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestInterface* domObject = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestInterface::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -131,6 +131,8 @@
</span><span class="cx"> EncodedJSValue jsTestMediaQueryListListenerConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestMediaQueryListListener* domObject = jsDynamicCast&lt;JSTestMediaQueryListListener*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestMediaQueryListListener::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -167,6 +167,8 @@
</span><span class="cx"> EncodedJSValue jsTestNamedConstructorConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestNamedConstructor* domObject = jsDynamicCast&lt;JSTestNamedConstructor*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestNamedConstructor::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -124,6 +124,8 @@
</span><span class="cx"> EncodedJSValue jsTestNodeConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestNode* domObject = jsDynamicCast&lt;JSTestNode*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestNode::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -392,9 +392,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSTestObj, Base&gt;(exec, JSTestObjTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReadOnlyLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReadOnlyLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.readOnlyLongAttr());
</span><span class="lines">@@ -402,9 +405,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReadOnlyStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReadOnlyStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.readOnlyStringAttr());
</span><span class="lines">@@ -412,9 +418,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReadOnlyTestObjAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReadOnlyTestObjAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.readOnlyTestObjAttr()));
</span><span class="lines">@@ -422,8 +431,9 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjConstructorStaticReadOnlyLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConstructorStaticReadOnlyLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><ins>+    UNUSED_PARAM(thisValue);
</ins><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     JSValue result = jsNumber(TestObj::staticReadOnlyLongAttr());
</span><span class="lines">@@ -431,8 +441,9 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjConstructorStaticStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConstructorStaticStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><ins>+    UNUSED_PARAM(thisValue);
</ins><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     JSValue result = jsStringWithCache(exec, TestObj::staticStringAttr());
</span><span class="lines">@@ -440,16 +451,22 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjConstructorTestSubObj(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConstructorTestSubObj(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestSubObj::getConstructor(exec-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjTestSubObjEnabledBySettingConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjTestSubObjEnabledBySettingConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     if (!castedThis-&gt;impl().frame())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Settings&amp; settings = castedThis-&gt;impl().frame()-&gt;settings();
</span><span class="lines">@@ -459,9 +476,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjEnumAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjEnumAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.enumAttr());
</span><span class="lines">@@ -469,9 +489,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjByteAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjByteAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.byteAttr());
</span><span class="lines">@@ -479,9 +502,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjOctetAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjOctetAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.octetAttr());
</span><span class="lines">@@ -489,9 +515,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjShortAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjShortAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.shortAttr());
</span><span class="lines">@@ -499,9 +528,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjUnsignedShortAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjUnsignedShortAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.unsignedShortAttr());
</span><span class="lines">@@ -509,9 +541,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.longAttr());
</span><span class="lines">@@ -519,9 +554,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjLongLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjLongLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.longLongAttr());
</span><span class="lines">@@ -529,9 +567,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjUnsignedLongLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjUnsignedLongLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.unsignedLongLongAttr());
</span><span class="lines">@@ -539,9 +580,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.stringAttr());
</span><span class="lines">@@ -549,9 +593,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjTestObjAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjTestObjAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.testObjAttr()));
</span><span class="lines">@@ -559,9 +606,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjXMLObjAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjXMLObjAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.xmlObjAttr()));
</span><span class="lines">@@ -569,9 +619,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjCreate(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjCreate(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsBoolean(impl.isCreate());
</span><span class="lines">@@ -579,9 +632,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.fastGetAttribute(WebCore::HTMLNames::reflectedstringattrAttr));
</span><span class="lines">@@ -589,9 +645,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedIntegralAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedIntegralAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr));
</span><span class="lines">@@ -599,9 +658,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedUnsignedIntegralAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedUnsignedIntegralAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(std::max(0, impl.getIntegralAttribute(WebCore::HTMLNames::reflectedunsignedintegralattrAttr)));
</span><span class="lines">@@ -609,9 +671,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedBooleanAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedBooleanAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsBoolean(impl.fastHasAttribute(WebCore::HTMLNames::reflectedbooleanattrAttr));
</span><span class="lines">@@ -619,9 +684,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedURLAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedURLAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.getURLAttribute(WebCore::HTMLNames::reflectedurlattrAttr));
</span><span class="lines">@@ -629,9 +697,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedStringAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.fastGetAttribute(WebCore::HTMLNames::customContentStringAttrAttr));
</span><span class="lines">@@ -639,9 +710,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedCustomIntegralAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedCustomIntegralAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr));
</span><span class="lines">@@ -649,9 +723,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedCustomBooleanAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedCustomBooleanAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsBoolean(impl.fastHasAttribute(WebCore::HTMLNames::customContentBooleanAttrAttr));
</span><span class="lines">@@ -659,9 +736,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReflectedCustomURLAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReflectedCustomURLAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.getURLAttribute(WebCore::HTMLNames::customContentURLAttrAttr));
</span><span class="lines">@@ -669,9 +749,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjTypedArrayAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjTypedArrayAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.typedArrayAttr()));
</span><span class="lines">@@ -679,9 +762,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSC::JSValue result = jsNumber(impl.attrWithGetterException(ec));
</span><span class="lines">@@ -690,9 +776,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.attrWithSetterException());
</span><span class="lines">@@ -700,9 +789,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjStringAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjStringAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSC::JSValue result = jsStringWithCache(exec, impl.stringAttrWithGetterException(ec));
</span><span class="lines">@@ -711,9 +803,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjStringAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjStringAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.stringAttrWithSetterException());
</span><span class="lines">@@ -721,25 +816,34 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjCustomAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjCustomAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(castedThis-&gt;customAttr(exec));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptStateAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptStateAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.withScriptStateAttribute(exec));
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptExecutionContextAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptExecutionContextAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ScriptExecutionContext* scriptContext = jsCast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!scriptContext)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -749,9 +853,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptStateAttributeRaises(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptStateAttributeRaises(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSC::JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.withScriptStateAttributeRaises(exec, ec)));
</span><span class="lines">@@ -760,9 +867,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     ScriptExecutionContext* scriptContext = jsCast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!scriptContext)
</span><span class="lines">@@ -774,9 +884,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ScriptExecutionContext* scriptContext = jsCast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!scriptContext)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -786,9 +899,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     ScriptExecutionContext* scriptContext = jsCast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!scriptContext)
</span><span class="lines">@@ -800,9 +916,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ScriptExecutionContext* scriptContext = jsCast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!scriptContext)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -812,9 +931,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.withScriptArgumentsAndCallStackAttribute()));
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -822,9 +944,12 @@
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition1)
</span><del>-EncodedJSValue jsTestObjConditionalAttr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConditionalAttr1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.conditionalAttr1());
</span><span class="lines">@@ -834,9 +959,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><del>-EncodedJSValue jsTestObjConditionalAttr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConditionalAttr2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.conditionalAttr2());
</span><span class="lines">@@ -846,9 +974,12 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><del>-EncodedJSValue jsTestObjConditionalAttr3(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConditionalAttr3(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.conditionalAttr3());
</span><span class="lines">@@ -858,35 +989,47 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition1)
</span><del>-EncodedJSValue jsTestObjConditionalAttr4Constructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConditionalAttr4Constructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestObjectA::getConstructor(exec-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><del>-EncodedJSValue jsTestObjConditionalAttr5Constructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConditionalAttr5Constructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestObjectB::getConstructor(exec-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><del>-EncodedJSValue jsTestObjConditionalAttr6Constructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjConditionalAttr6Constructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestObjectC::getConstructor(exec-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjCachedAttribute1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjCachedAttribute1(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedAttribute1.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -897,9 +1040,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjCachedAttribute2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjCachedAttribute2(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedAttribute2.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -910,9 +1056,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjAnyAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjAnyAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = (impl.anyAttribute().hasNoValue() ? jsNull() : impl.anyAttribute().jsValue());
</span><span class="lines">@@ -920,17 +1069,23 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjContentDocument(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjContentDocument(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     return JSValue::encode(shouldAllowAccessToNode(exec, impl.contentDocument()) ? toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.contentDocument())) : jsNull());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjMutablePoint(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjMutablePoint(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(SVGStaticPropertyTearOff&lt;TestObj, SVGPoint&gt;::create(impl, impl.mutablePoint(), &amp;TestObj::updateMutablePoint)));
</span><span class="lines">@@ -938,9 +1093,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjImmutablePoint(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjImmutablePoint(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(SVGPropertyTearOff&lt;SVGPoint&gt;::create(impl.immutablePoint())));
</span><span class="lines">@@ -948,9 +1106,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjStrawberry(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjStrawberry(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.blueberry());
</span><span class="lines">@@ -958,9 +1119,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjStrictFloat(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjStrictFloat(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.strictFloat());
</span><span class="lines">@@ -968,9 +1132,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjDescription(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjDescription(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.description());
</span><span class="lines">@@ -978,9 +1145,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjId(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjId(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.id());
</span><span class="lines">@@ -988,9 +1158,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjHash(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjHash(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.hash());
</span><span class="lines">@@ -998,9 +1171,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjReplaceableAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjReplaceableAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.replaceableAttribute());
</span><span class="lines">@@ -1008,9 +1184,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjNullableDoubleAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjNullableDoubleAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     bool isNull = false;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="lines">@@ -1021,9 +1200,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjNullableLongAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjNullableLongAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     bool isNull = false;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="lines">@@ -1034,9 +1216,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjNullableBooleanAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjNullableBooleanAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     bool isNull = false;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="lines">@@ -1047,9 +1232,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjNullableStringAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjNullableStringAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     bool isNull = false;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="lines">@@ -1060,9 +1248,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjNullableLongSettableAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjNullableLongSettableAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     bool isNull = false;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="lines">@@ -1073,9 +1264,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjNullableStringValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjNullableStringValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     bool isNull = false;
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="lines">@@ -1087,9 +1281,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjAttribute(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.attribute());
</span><span class="lines">@@ -1097,9 +1294,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestObjAttributeWithReservedEnumType(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestObjAttributeWithReservedEnumType(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestObj&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.attributeWithReservedEnumType());
</span><span class="lines">@@ -1110,6 +1310,8 @@
</span><span class="cx"> EncodedJSValue jsTestObjConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestObj* domObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestObj::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -195,6 +195,8 @@
</span><span class="cx"> EncodedJSValue jsTestOverloadedConstructorsConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestOverloadedConstructors* domObject = jsDynamicCast&lt;JSTestOverloadedConstructors*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestOverloadedConstructors::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -129,9 +129,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSTestSerializedScriptValueInterface, Base&gt;(exec, JSTestSerializedScriptValueInterfaceTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestSerializedScriptValueInterfaceValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestSerializedScriptValueInterfaceValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestSerializedScriptValueInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = impl.value() ? impl.value()-&gt;deserialize(exec, castedThis-&gt;globalObject(), 0) : jsNull();
</span><span class="lines">@@ -139,9 +142,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestSerializedScriptValueInterfaceReadonlyValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestSerializedScriptValueInterfaceReadonlyValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestSerializedScriptValueInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = impl.readonlyValue() ? impl.readonlyValue()-&gt;deserialize(exec, castedThis-&gt;globalObject(), 0) : jsNull();
</span><span class="lines">@@ -149,9 +155,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestSerializedScriptValueInterfaceCachedValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestSerializedScriptValueInterfaceCachedValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedValue.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -162,9 +171,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestSerializedScriptValueInterfacePorts(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestSerializedScriptValueInterfacePorts(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestSerializedScriptValueInterface&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsArray(exec, castedThis-&gt;globalObject(), impl.ports());
</span><span class="lines">@@ -172,9 +184,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedReadonlyValue.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -188,6 +203,8 @@
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfaceConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestSerializedScriptValueInterface* domObject = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestSerializedScriptValueInterface::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -176,9 +176,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSTestTypedefs, Base&gt;(exec, JSTestTypedefsTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsUnsignedLongLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsUnsignedLongLongAttr(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestTypedefs&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.unsignedLongLongAttr());
</span><span class="lines">@@ -186,9 +189,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsImmutableSerializedScriptValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsImmutableSerializedScriptValue(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestTypedefs&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = impl.immutableSerializedScriptValue() ? impl.immutableSerializedScriptValue()-&gt;deserialize(exec, castedThis-&gt;globalObject(), 0) : jsNull();
</span><span class="lines">@@ -196,16 +202,22 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsConstructorTestSubObj(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsConstructorTestSubObj(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestSubObj::getConstructor(exec-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     TestTypedefs&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSC::JSValue result = jsNumber(impl.attrWithGetterException(ec));
</span><span class="lines">@@ -214,9 +226,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestTypedefs&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsNumber(impl.attrWithSetterException());
</span><span class="lines">@@ -224,9 +239,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsStringAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsStringAttrWithGetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     TestTypedefs&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSC::JSValue result = jsStringWithCache(exec, impl.stringAttrWithGetterException(ec));
</span><span class="lines">@@ -235,9 +253,12 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-EncodedJSValue jsTestTypedefsStringAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsTestTypedefsStringAttrWithSetterException(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     TestTypedefs&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.stringAttrWithSetterException());
</span><span class="lines">@@ -248,6 +269,8 @@
</span><span class="cx"> EncodedJSValue jsTestTypedefsConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSTestTypedefs* domObject = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSTestTypedefs::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSattributecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -120,9 +120,12 @@
</span><span class="cx">     return getStaticValueSlot&lt;JSattribute, Base&gt;(exec, JSattributeTable, thisObject, propertyName, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue jsattributeReadonly(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue jsattributeReadonly(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    JSattribute* castedThis = jsDynamicCast&lt;JSattribute*&gt;(JSValue::decode(slotBase));
</del><ins>+    JSattribute* castedThis = jsDynamicCast&lt;JSattribute*&gt;(JSValue::decode(thisValue));
+    UNUSED_PARAM(slotBase);
+    if (!castedThis)
+        return throwVMTypeError(exec);
</ins><span class="cx">     UNUSED_PARAM(exec);
</span><span class="cx">     attribute&amp; impl = castedThis-&gt;impl();
</span><span class="cx">     JSValue result = jsStringWithCache(exec, impl.readonly());
</span><span class="lines">@@ -133,6 +136,8 @@
</span><span class="cx"> EncodedJSValue jsattributeConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSattribute* domObject = jsDynamicCast&lt;JSattribute*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSattribute::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSreadonlycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -120,6 +120,8 @@
</span><span class="cx"> EncodedJSValue jsreadonlyConstructor(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</span><span class="cx"> {
</span><span class="cx">     JSreadonly* domObject = jsDynamicCast&lt;JSreadonly*&gt;(JSValue::decode(slotBase));
</span><ins>+    if (!domObject)
+        return throwVMTypeError(exec);
</ins><span class="cx">     return JSValue::encode(JSreadonly::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebridgeruntime_arraycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/runtime_array.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bridge/runtime_array.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bridge/runtime_array.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -60,10 +60,12 @@
</span><span class="cx">     static_cast&lt;RuntimeArray*&gt;(cell)-&gt;RuntimeArray::~RuntimeArray();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue RuntimeArray::lengthGetter(ExecState*, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue RuntimeArray::lengthGetter(ExecState* exec, EncodedJSValue, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    RuntimeArray* thisObj = jsCast&lt;RuntimeArray*&gt;(JSValue::decode(slotBase));
-    return JSValue::encode(jsNumber(thisObj-&gt;getLength()));
</del><ins>+    RuntimeArray* thisObject = jsDynamicCast&lt;RuntimeArray*&gt;(JSValue::decode(thisValue));
+    if (!thisObject)
+        return throwVMTypeError(exec);
+    return JSValue::encode(jsNumber(thisObject-&gt;getLength()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue RuntimeArray::indexGetter(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, unsigned index)
</span></span></pre></div>
<a id="trunkSourceWebCorebridgeruntime_methodcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/runtime_method.cpp (160878 => 160879)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bridge/runtime_method.cpp        2013-12-20 00:49:58 UTC (rev 160878)
+++ trunk/Source/WebCore/bridge/runtime_method.cpp        2013-12-20 00:52:06 UTC (rev 160879)
</span><span class="lines">@@ -54,11 +54,12 @@
</span><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue RuntimeMethod::lengthGetter(ExecState*, EncodedJSValue slotBase, EncodedJSValue, PropertyName)
</del><ins>+EncodedJSValue RuntimeMethod::lengthGetter(ExecState* exec, EncodedJSValue, EncodedJSValue thisValue, PropertyName)
</ins><span class="cx"> {
</span><del>-    RuntimeMethod* thisObj = jsCast&lt;RuntimeMethod*&gt;(JSValue::decode(slotBase));
-
-    return JSValue::encode(jsNumber(thisObj-&gt;m_method-&gt;numParameters()));
</del><ins>+    RuntimeMethod* thisObject = jsDynamicCast&lt;RuntimeMethod*&gt;(JSValue::decode(thisValue));
+    if (!thisObject)
+        return throwVMTypeError(exec);
+    return JSValue::encode(jsNumber(thisObject-&gt;m_method-&gt;numParameters()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool RuntimeMethod::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
</span></span></pre>
</div>
</div>

</body>
</html>