<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[161220] trunk/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/161220">161220</a></dd>
<dt>Author</dt> <dd>oliver@apple.com</dd>
<dt>Date</dt> <dd>2014-01-02 12:56:20 -0800 (Thu, 02 Jan 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Refactor PutPropertySlot to be aware of custom properties
https://bugs.webkit.org/show_bug.cgi?id=126187

Reviewed by Antti Koivisto.

Source/JavaScriptCore:

Refactor PutPropertySlot, making the constructor take the thisValue
used as a target.  This results in a wide range of boilerplate changes
to pass the new parameter.

* API/JSObjectRef.cpp:
(JSObjectSetProperty):
* dfg/DFGOperations.cpp:
(JSC::DFG::operationPutByValInternal):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
* jit/JITOperations.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/Arguments.cpp:
(JSC::Arguments::putByIndex):
* runtime/ArrayPrototype.cpp:
(JSC::putProperty):
(JSC::arrayProtoFuncPush):
* runtime/JSCJSValue.cpp:
(JSC::JSValue::putToPrimitiveByIndex):
* runtime/JSCell.cpp:
(JSC::JSCell::putByIndex):
* runtime/JSFunction.cpp:
(JSC::JSFunction::put):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::putByIndex):
* runtime/JSONObject.cpp:
(JSC::Walker::walk):
* runtime/JSObject.cpp:
(JSC::JSObject::putByIndex):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::deleteProperty):
* runtime/JSObject.h:
(JSC::JSObject::putDirect):
* runtime/Lookup.h:
(JSC::putEntry):
(JSC::lookupPut):
* runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::PutPropertySlot):
(JSC::PutPropertySlot::setCustomProperty):
(JSC::PutPropertySlot::thisValue):
(JSC::PutPropertySlot::isCacheable):

Source/WebCore:

Update the bindings code generation and custom objects
to the new function signatures

* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::put):
* bindings/objc/WebScriptObject.mm:
(-[WebScriptObject setValue:forKey:]):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterface::putByIndex):
* bridge/NP_jsobject.cpp:
(_NPN_SetProperty):

Source/WebKit/mac:

Update for new method signatures.

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::setProperty):

Source/WebKit2:

Update for new method signatures.

* WebProcess/Plugins/Netscape/NPJSObject.cpp:
(WebKit::NPJSObject::setProperty):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreAPIJSObjectRefcpp">trunk/Source/JavaScriptCore/API/JSObjectRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpretercpp">trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArgumentscpp">trunk/Source/JavaScriptCore/runtime/Arguments.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValuecpp">trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSONObjectcpp">trunk/Source/JavaScriptCore/runtime/JSONObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeLookuph">trunk/Source/JavaScriptCore/runtime/Lookup.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePutPropertySloth">trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsobjcWebScriptObjectmm">trunk/Source/WebCore/bindings/objc/WebScriptObject.mm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebridgeNP_jsobjectcpp">trunk/Source/WebCore/bridge/NP_jsobject.cpp</a></li>
<li><a href="#trunkSourceWebKitmacChangeLog">trunk/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacPluginsHostedNetscapePluginInstanceProxymm">trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm</a></li>
<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>
<li><a href="#trunkSourceWebKit2WebProcessPluginsNetscapeNPJSObjectcpp">trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreAPIJSObjectRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -331,7 +331,7 @@
</span><span class="cx">         PropertyDescriptor desc(jsValue, attributes);
</span><span class="cx">         jsObject-&gt;methodTable()-&gt;defineOwnProperty(jsObject, exec, name, desc, false);
</span><span class="cx">     } else {
</span><del>-        PutPropertySlot slot;
</del><ins>+        PutPropertySlot slot(jsObject);
</ins><span class="cx">         jsObject-&gt;methodTable()-&gt;put(jsObject, exec, name, jsValue, slot);
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1,3 +1,53 @@
</span><ins>+2013-12-23  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Refactor PutPropertySlot to be aware of custom properties
+        https://bugs.webkit.org/show_bug.cgi?id=126187
+
+        Reviewed by Antti Koivisto.
+
+        Refactor PutPropertySlot, making the constructor take the thisValue
+        used as a target.  This results in a wide range of boilerplate changes
+        to pass the new parameter.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetProperty):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::operationPutByValInternal):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::putByIndex):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncPush):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitiveByIndex):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::putByIndex):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::putByIndex):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::deleteProperty):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        * runtime/Lookup.h:
+        (JSC::putEntry):
+        (JSC::lookupPut):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setCustomProperty):
+        (JSC::PutPropertySlot::thisValue):
+        (JSC::PutPropertySlot::isCacheable):
+
</ins><span class="cx"> 2014-01-01  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Rationalize DFG DCE
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -110,7 +110,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (isName(property)) {
</span><del>-        PutPropertySlot slot(strict);
</del><ins>+        PutPropertySlot slot(baseValue, strict);
</ins><span class="cx">         if (direct) {
</span><span class="cx">             RELEASE_ASSERT(baseValue.isObject());
</span><span class="cx">             asObject(baseValue)-&gt;putDirect(*vm, jsCast&lt;NameInstance*&gt;(property.asCell())-&gt;privateName(), value, slot);
</span><span class="lines">@@ -122,7 +122,7 @@
</span><span class="cx">     // Don't put to an object if toString throws an exception.
</span><span class="cx">     Identifier ident(exec, property.toString(exec)-&gt;value(exec));
</span><span class="cx">     if (!vm-&gt;exception()) {
</span><del>-        PutPropertySlot slot(strict);
</del><ins>+        PutPropertySlot slot(baseValue, strict);
</ins><span class="cx">         if (direct) {
</span><span class="cx">             RELEASE_ASSERT(baseValue.isObject());
</span><span class="cx">             asObject(baseValue)-&gt;putDirect(*vm, jsCast&lt;NameInstance*&gt;(property.asCell())-&gt;privateName(), value, slot);
</span><span class="lines">@@ -399,7 +399,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PutPropertySlot slot(true);
</del><ins>+    PutPropertySlot slot(array, true);
</ins><span class="cx">     array-&gt;methodTable()-&gt;put(
</span><span class="cx">         array, exec, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="lines">@@ -414,7 +414,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PutPropertySlot slot(false);
</del><ins>+    PutPropertySlot slot(array, false);
</ins><span class="cx">     array-&gt;methodTable()-&gt;put(
</span><span class="cx">         array, exec, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="lines">@@ -431,7 +431,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PutPropertySlot slot(true);
</del><ins>+    PutPropertySlot slot(array, true);
</ins><span class="cx">     array-&gt;methodTable()-&gt;put(
</span><span class="cx">         array, exec, Identifier::from(exec, index), jsValue, slot);
</span><span class="cx"> }
</span><span class="lines">@@ -448,7 +448,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PutPropertySlot slot(false);
</del><ins>+    PutPropertySlot slot(array, false);
</ins><span class="cx">     array-&gt;methodTable()-&gt;put(
</span><span class="cx">         array, exec, Identifier::from(exec, index), jsValue, slot);
</span><span class="cx"> }
</span><span class="lines">@@ -494,7 +494,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PutPropertySlot slot(true);
</del><ins>+    PutPropertySlot slot(array, true);
</ins><span class="cx">     array-&gt;putDirect(exec-&gt;vm(), Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -508,7 +508,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    PutPropertySlot slot(false);
</del><ins>+    PutPropertySlot slot(array, false);
</ins><span class="cx">     array-&gt;putDirect(exec-&gt;vm(), Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -798,7 +798,7 @@
</span><span class="cx">             JSValue JSONPValue = JSONPData[entry].m_value.get();
</span><span class="cx">             if (JSONPPath.size() == 1 &amp;&amp; JSONPPath[0].m_type == JSONPPathEntryTypeDeclare) {
</span><span class="cx">                 globalObject-&gt;addVar(callFrame, JSONPPath[0].m_pathEntryName);
</span><del>-                PutPropertySlot slot;
</del><ins>+                PutPropertySlot slot(globalObject);
</ins><span class="cx">                 globalObject-&gt;methodTable()-&gt;put(globalObject, callFrame, JSONPPath[0].m_pathEntryName, JSONPValue, slot);
</span><span class="cx">                 result = jsUndefined();
</span><span class="cx">                 continue;
</span><span class="lines">@@ -833,7 +833,7 @@
</span><span class="cx">                     return jsUndefined();
</span><span class="cx">                 }
</span><span class="cx">             }
</span><del>-            PutPropertySlot slot;
</del><ins>+            PutPropertySlot slot(baseObject);
</ins><span class="cx">             switch (JSONPPath.last().m_type) {
</span><span class="cx">             case JSONPPathEntryTypeCall: {
</span><span class="cx">                 JSValue function = baseObject.get(callFrame, JSONPPath.last().m_pathEntryName);
</span><span class="lines">@@ -1162,14 +1162,14 @@
</span><span class="cx">         for (unsigned i = 0; i &lt; numVariables; ++i) {
</span><span class="cx">             const Identifier&amp; ident = codeBlock-&gt;variable(i);
</span><span class="cx">             if (!variableObject-&gt;hasProperty(callFrame, ident)) {
</span><del>-                PutPropertySlot slot;
</del><ins>+                PutPropertySlot slot(variableObject);
</ins><span class="cx">                 variableObject-&gt;methodTable()-&gt;put(variableObject, callFrame, ident, jsUndefined(), slot);
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         for (int i = 0; i &lt; numFunctions; ++i) {
</span><span class="cx">             FunctionExecutable* function = codeBlock-&gt;functionDecl(i);
</span><del>-            PutPropertySlot slot;
</del><ins>+            PutPropertySlot slot(variableObject);
</ins><span class="cx">             variableObject-&gt;methodTable()-&gt;put(variableObject, callFrame, function-&gt;name(), JSFunction::create(vm, function, scope), slot);
</span><span class="cx">         }
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -239,7 +239,7 @@
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><span class="cx">     
</span><span class="cx">     Identifier ident(vm, uid);
</span><del>-    PutPropertySlot slot(true, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(JSValue::decode(encodedBase), true, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     JSValue::decode(encodedBase).put(exec, ident, JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -249,7 +249,7 @@
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><span class="cx">     
</span><span class="cx">     Identifier ident(vm, uid);
</span><del>-    PutPropertySlot slot(false, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(JSValue::decode(encodedBase), false, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     JSValue::decode(encodedBase).put(exec, ident, JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -259,7 +259,7 @@
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><span class="cx">     
</span><span class="cx">     Identifier ident(vm, uid);
</span><del>-    PutPropertySlot slot(true, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(JSValue::decode(encodedBase), true, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     asObject(JSValue::decode(encodedBase))-&gt;putDirect(exec-&gt;vm(), ident, JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -269,7 +269,7 @@
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><span class="cx">     
</span><span class="cx">     Identifier ident(vm, uid);
</span><del>-    PutPropertySlot slot(false, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(JSValue::decode(encodedBase), false, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     asObject(JSValue::decode(encodedBase))-&gt;putDirect(exec-&gt;vm(), ident, JSValue::decode(encodedValue), slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -283,7 +283,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);
</span><del>-    PutPropertySlot slot(true, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseValue, true, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseValue.put(exec, ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -306,7 +306,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);
</span><del>-    PutPropertySlot slot(false, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseValue, false, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseValue.put(exec, ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -329,7 +329,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSObject* baseObject = asObject(JSValue::decode(encodedBase));
</span><del>-    PutPropertySlot slot(true, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseObject, true, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseObject-&gt;putDirect(exec-&gt;vm(), ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -352,7 +352,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSObject* baseObject = asObject(JSValue::decode(encodedBase));
</span><del>-    PutPropertySlot slot(false, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseObject, false, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseObject-&gt;putDirect(exec-&gt;vm(), ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -375,7 +375,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);
</span><del>-    PutPropertySlot slot(true, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseValue, true, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseValue.put(exec, ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -395,7 +395,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);
</span><del>-    PutPropertySlot slot(false, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseValue, false, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseValue.put(exec, ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -415,7 +415,7 @@
</span><span class="cx">     
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSObject* baseObject = asObject(JSValue::decode(encodedBase));
</span><del>-    PutPropertySlot slot(true, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseObject, true, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseObject-&gt;putDirect(exec-&gt;vm(), ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -435,7 +435,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSObject* baseObject = asObject(JSValue::decode(encodedBase));
</span><del>-    PutPropertySlot slot(false, exec-&gt;codeBlock()-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseObject, false, exec-&gt;codeBlock()-&gt;putByIdContext());
</ins><span class="cx">     
</span><span class="cx">     baseObject -&gt;putDirect(exec-&gt;vm(), ident, value, slot);
</span><span class="cx">     
</span><span class="lines">@@ -469,12 +469,12 @@
</span><span class="cx">         } else
</span><span class="cx">             baseValue.putByIndex(callFrame, i, value, callFrame-&gt;codeBlock()-&gt;isStrictMode());
</span><span class="cx">     } else if (isName(subscript)) {
</span><del>-        PutPropertySlot slot(callFrame-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+        PutPropertySlot slot(baseValue, callFrame-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">         baseValue.put(callFrame, jsCast&lt;NameInstance*&gt;(subscript.asCell())-&gt;privateName(), value, slot);
</span><span class="cx">     } else {
</span><span class="cx">         Identifier property(callFrame, subscript.toString(callFrame)-&gt;value(callFrame));
</span><span class="cx">         if (!callFrame-&gt;vm().exception()) { // Don't put to an object if toString threw an exception.
</span><del>-            PutPropertySlot slot(callFrame-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+            PutPropertySlot slot(baseValue, callFrame-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">             baseValue.put(callFrame, property, value, slot);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -486,12 +486,12 @@
</span><span class="cx">         uint32_t i = subscript.asUInt32();
</span><span class="cx">         baseObject-&gt;putDirectIndex(callFrame, i, value);
</span><span class="cx">     } else if (isName(subscript)) {
</span><del>-        PutPropertySlot slot(callFrame-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+        PutPropertySlot slot(baseObject, callFrame-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">         baseObject-&gt;putDirect(callFrame-&gt;vm(), jsCast&lt;NameInstance*&gt;(subscript.asCell())-&gt;privateName(), value, slot);
</span><span class="cx">     } else {
</span><span class="cx">         Identifier property(callFrame, subscript.toString(callFrame)-&gt;value(callFrame));
</span><span class="cx">         if (!callFrame-&gt;vm().exception()) { // Don't put to an object if toString threw an exception.
</span><del>-            PutPropertySlot slot(callFrame-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+            PutPropertySlot slot(baseObject, callFrame-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">             baseObject-&gt;putDirect(callFrame-&gt;vm(), property, value, slot);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -1668,7 +1668,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    PutPropertySlot slot(codeBlock-&gt;isStrictMode());
</del><ins>+    PutPropertySlot slot(scope, codeBlock-&gt;isStrictMode());
</ins><span class="cx">     scope-&gt;methodTable()-&gt;put(scope, exec, ident, value, slot);
</span><span class="cx">     
</span><span class="cx">     if (exec-&gt;vm().exception())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -578,7 +578,7 @@
</span><span class="cx">     const Identifier&amp; ident = codeBlock-&gt;identifier(pc[2].u.operand);
</span><span class="cx">     
</span><span class="cx">     JSValue baseValue = LLINT_OP_C(1).jsValue();
</span><del>-    PutPropertySlot slot(codeBlock-&gt;isStrictMode(), codeBlock-&gt;putByIdContext());
</del><ins>+    PutPropertySlot slot(baseValue, codeBlock-&gt;isStrictMode(), codeBlock-&gt;putByIdContext());
</ins><span class="cx">     if (pc[8].u.operand)
</span><span class="cx">         asObject(baseValue)-&gt;putDirect(vm, ident, LLINT_OP_C(3).jsValue(), slot);
</span><span class="cx">     else
</span><span class="lines">@@ -734,14 +734,14 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (isName(subscript)) {
</span><del>-        PutPropertySlot slot(exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+        PutPropertySlot slot(baseValue, exec-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">         baseValue.put(exec, jsCast&lt;NameInstance*&gt;(subscript.asCell())-&gt;privateName(), value, slot);
</span><span class="cx">         LLINT_END();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Identifier property(exec, subscript.toString(exec)-&gt;value(exec));
</span><span class="cx">     LLINT_CHECK_EXCEPTION();
</span><del>-    PutPropertySlot slot(exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+    PutPropertySlot slot(baseValue, exec-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">     baseValue.put(exec, property, value, slot);
</span><span class="cx">     LLINT_END();
</span><span class="cx"> }
</span><span class="lines">@@ -759,12 +759,12 @@
</span><span class="cx">         uint32_t i = subscript.asUInt32();
</span><span class="cx">         baseObject-&gt;putDirectIndex(exec, i, value);
</span><span class="cx">     } else if (isName(subscript)) {
</span><del>-        PutPropertySlot slot(exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+        PutPropertySlot slot(baseObject, exec-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">         baseObject-&gt;putDirect(exec-&gt;vm(), jsCast&lt;NameInstance*&gt;(subscript.asCell())-&gt;privateName(), value, slot);
</span><span class="cx">     } else {
</span><span class="cx">         Identifier property(exec, subscript.toString(exec)-&gt;value(exec));
</span><span class="cx">         if (!exec-&gt;vm().exception()) { // Don't put to an object if toString threw an exception.
</span><del>-            PutPropertySlot slot(exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+            PutPropertySlot slot(baseObject, exec-&gt;codeBlock()-&gt;isStrictMode());
</ins><span class="cx">             baseObject-&gt;putDirect(exec-&gt;vm(), property, value, slot);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -1368,7 +1368,7 @@
</span><span class="cx">     if (modeAndType.mode() == ThrowIfNotFound &amp;&amp; !scope-&gt;hasProperty(exec, ident))
</span><span class="cx">         LLINT_THROW(createUndefinedVariableError(exec, ident));
</span><span class="cx"> 
</span><del>-    PutPropertySlot slot(codeBlock-&gt;isStrictMode());
</del><ins>+    PutPropertySlot slot(scope, codeBlock-&gt;isStrictMode());
</ins><span class="cx">     scope-&gt;methodTable()-&gt;put(scope, exec, ident, value, slot);
</span><span class="cx"> 
</span><span class="cx">     // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArgumentscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Arguments.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Arguments.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/Arguments.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -187,7 +187,7 @@
</span><span class="cx">     if (thisObject-&gt;trySetArgument(exec-&gt;vm(), i, value))
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    PutPropertySlot slot(shouldThrow);
</del><ins>+    PutPropertySlot slot(thisObject, shouldThrow);
</ins><span class="cx">     JSObject::put(thisObject, exec, Identifier::from(exec, i), value, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -160,7 +160,7 @@
</span><span class="cx"> 
</span><span class="cx"> static void putProperty(ExecState* exec, JSObject* obj, PropertyName propertyName, JSValue value)
</span><span class="cx"> {
</span><del>-    PutPropertySlot slot;
</del><ins>+    PutPropertySlot slot(obj);
</ins><span class="cx">     obj-&gt;methodTable()-&gt;put(obj, exec, propertyName, value, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -501,7 +501,7 @@
</span><span class="cx">         if (length + n &gt;= length)
</span><span class="cx">             thisObj-&gt;methodTable()-&gt;putByIndex(thisObj, exec, length + n, exec-&gt;uncheckedArgument(n), true);
</span><span class="cx">         else {
</span><del>-            PutPropertySlot slot;
</del><ins>+            PutPropertySlot slot(thisObj);
</ins><span class="cx">             Identifier propertyName(exec, JSValue(static_cast&lt;int64_t&gt;(length) + static_cast&lt;int64_t&gt;(n)).toWTFString(exec));
</span><span class="cx">             thisObj-&gt;methodTable()-&gt;put(thisObj, exec, propertyName, exec-&gt;uncheckedArgument(n), slot);
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCJSValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -172,7 +172,7 @@
</span><span class="cx"> void JSValue::putToPrimitiveByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><span class="cx">     if (propertyName &gt; MAX_ARRAY_INDEX) {
</span><del>-        PutPropertySlot slot(shouldThrow);
</del><ins>+        PutPropertySlot slot(*this, shouldThrow);
</ins><span class="cx">         putToPrimitive(exec, Identifier::from(exec, propertyName), value, slot);
</span><span class="cx">         return;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -96,7 +96,7 @@
</span><span class="cx"> void JSCell::putByIndex(JSCell* cell, ExecState* exec, unsigned identifier, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><span class="cx">     if (cell-&gt;isString()) {
</span><del>-        PutPropertySlot slot(shouldThrow);
</del><ins>+        PutPropertySlot slot(cell, shouldThrow);
</ins><span class="cx">         JSValue(cell).putToPrimitive(exec, Identifier::from(exec, identifier), value, slot);
</span><span class="cx">         return;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSFunction.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSFunction.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSFunction.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -389,7 +389,7 @@
</span><span class="cx">         thisObject-&gt;m_allocationProfile.clear();
</span><span class="cx">         thisObject-&gt;m_allocationProfileWatchpoint.fireAll();
</span><span class="cx">         // Don't allow this to be cached, since a [[Put]] must clear m_allocationProfile.
</span><del>-        PutPropertySlot dontCache;
</del><ins>+        PutPropertySlot dontCache(thisObject);
</ins><span class="cx">         Base::put(thisObject, exec, propertyName, value, dontCache);
</span><span class="cx">         return;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -383,7 +383,7 @@
</span><span class="cx">     JSGenericTypedArrayView* thisObject = jsCast&lt;JSGenericTypedArrayView*&gt;(cell);
</span><span class="cx">     
</span><span class="cx">     if (propertyName &gt; MAX_ARRAY_INDEX) {
</span><del>-        PutPropertySlot slot(shouldThrow);
</del><ins>+        PutPropertySlot slot(JSValue(thisObject), shouldThrow);
</ins><span class="cx">         thisObject-&gt;methodTable()-&gt;put(
</span><span class="cx">             thisObject, exec, Identifier::from(exec, propertyName), value, slot);
</span><span class="cx">         return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSONObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSONObject.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSONObject.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSONObject.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -746,7 +746,7 @@
</span><span class="cx">             case ObjectEndVisitMember: {
</span><span class="cx">                 JSObject* object = objectStack.peek();
</span><span class="cx">                 Identifier prop = propertyStack.last()[indexStack.last()];
</span><del>-                PutPropertySlot slot;
</del><ins>+                PutPropertySlot slot(object);
</ins><span class="cx">                 JSValue filteredValue = callReviver(object, jsString(m_exec, prop.string()), outValue);
</span><span class="cx">                 if (filteredValue.isUndefined())
</span><span class="cx">                     object-&gt;methodTable()-&gt;deleteProperty(object, m_exec, prop);
</span><span class="lines">@@ -775,7 +775,7 @@
</span><span class="cx">         stateStack.removeLast();
</span><span class="cx">     }
</span><span class="cx">     JSObject* finalHolder = constructEmptyObject(m_exec);
</span><del>-    PutPropertySlot slot;
</del><ins>+    PutPropertySlot slot(finalHolder);
</ins><span class="cx">     finalHolder-&gt;methodTable()-&gt;put(finalHolder, m_exec, m_exec-&gt;vm().propertyNames-&gt;emptyIdentifier, outValue, slot);
</span><span class="cx">     return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -411,7 +411,7 @@
</span><span class="cx">     JSObject* thisObject = jsCast&lt;JSObject*&gt;(cell);
</span><span class="cx">     
</span><span class="cx">     if (propertyName &gt; MAX_ARRAY_INDEX) {
</span><del>-        PutPropertySlot slot(shouldThrow);
</del><ins>+        PutPropertySlot slot(cell, shouldThrow);
</ins><span class="cx">         thisObject-&gt;methodTable()-&gt;put(thisObject, exec, Identifier::from(exec, propertyName), value, slot);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -1215,7 +1215,7 @@
</span><span class="cx"> 
</span><span class="cx"> void JSObject::putDirectNonIndexAccessor(VM&amp; vm, PropertyName propertyName, JSValue value, unsigned attributes)
</span><span class="cx"> {
</span><del>-    PutPropertySlot slot;
</del><ins>+    PutPropertySlot slot(this);
</ins><span class="cx">     putDirectInternal&lt;PutModeDefineOwnProperty&gt;(vm, propertyName, value, attributes, slot, getCallableObject(value));
</span><span class="cx"> 
</span><span class="cx">     // putDirect will change our Structure if we add a new property. For
</span><span class="lines">@@ -1269,7 +1269,8 @@
</span><span class="cx">         if (entry-&gt;attributes() &amp; DontDelete &amp;&amp; !exec-&gt;vm().isInDefineOwnProperty())
</span><span class="cx">             return false; // this builtin property can't be deleted
</span><span class="cx"> 
</span><del>-        putEntry(exec, entry, propertyName, jsUndefined(), thisObject);
</del><ins>+        PutPropertySlot slot(thisObject);
+        putEntry(exec, entry, propertyName, jsUndefined(), slot);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1422,7 +1422,7 @@
</span><span class="cx"> inline void JSObject::putDirect(VM&amp; vm, PropertyName propertyName, JSValue value, unsigned attributes)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!value.isGetterSetter() &amp;&amp; !(attributes &amp; Accessor));
</span><del>-    PutPropertySlot slot;
</del><ins>+    PutPropertySlot slot(this);
</ins><span class="cx">     putDirectInternal&lt;PutModeDefineOwnProperty&gt;(vm, propertyName, value, attributes, slot, getCallableObject(value));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeLookuph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.h (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.h        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/Lookup.h        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #include &quot;Identifier.h&quot;
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="cx"> #include &quot;PropertySlot.h&quot;
</span><ins>+#include &quot;PutPropertySlot.h&quot;
</ins><span class="cx"> #include &lt;wtf/Assertions.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -41,7 +42,7 @@
</span><span class="cx">     // FIXME: There is no reason this get function can't be simpler.
</span><span class="cx">     // ie. typedef JSValue (*GetFunction)(ExecState*, JSObject* baseObject)
</span><span class="cx">     typedef PropertySlot::GetValueFunc GetFunction;
</span><del>-    typedef void (*PutFunction)(ExecState*, EncodedJSValue base, EncodedJSValue value);
</del><ins>+    typedef PutPropertySlot::PutValueFunc PutFunction;
</ins><span class="cx"> 
</span><span class="cx">     class HashEntry {
</span><span class="cx">         WTF_MAKE_FAST_ALLOCATED;
</span><span class="lines">@@ -290,15 +291,15 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    template &lt;class ThisImp&gt;
-    inline void putEntry(ExecState* exec, const HashEntry* entry, PropertyName propertyName, JSValue value, ThisImp* thisObj, bool shouldThrow = false)
</del><ins>+    inline void putEntry(ExecState* exec, const HashEntry* entry, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</ins><span class="cx">     {
</span><span class="cx">         // If this is a function put it as an override property.
</span><span class="cx">         if (entry-&gt;attributes() &amp; Function)
</span><del>-            thisObj-&gt;putDirect(exec-&gt;vm(), propertyName, value);
-        else if (!(entry-&gt;attributes() &amp; ReadOnly))
-            entry-&gt;propertyPutter()(exec, JSValue::encode(thisObj), JSValue::encode(value));
-        else if (shouldThrow)
</del><ins>+            slot.base()-&gt;putDirect(exec-&gt;vm(), propertyName, value);
+        else if (!(entry-&gt;attributes() &amp; ReadOnly)) {
+            entry-&gt;propertyPutter()(exec, JSValue::encode(slot.thisValue()), JSValue::encode(value));
+            slot.setCustomProperty(slot.base(), entry-&gt;propertyPutter());
+        } else if (slot.isStrictMode())
</ins><span class="cx">             throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -307,15 +308,14 @@
</span><span class="cx">      * It looks up a hash entry for the property to be set.  If an entry
</span><span class="cx">      * is found it sets the value and returns true, else it returns false.
</span><span class="cx">      */
</span><del>-    template &lt;class ThisImp&gt;
-    inline bool lookupPut(ExecState* exec, PropertyName propertyName, JSValue value, const HashTable&amp; table, ThisImp* thisObj, bool shouldThrow = false)
</del><ins>+    inline bool lookupPut(ExecState* exec, PropertyName propertyName, JSValue value, const HashTable&amp; table, PutPropertySlot&amp; slot)
</ins><span class="cx">     {
</span><span class="cx">         const HashEntry* entry = table.entry(exec, propertyName);
</span><span class="cx">         
</span><span class="cx">         if (!entry)
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        putEntry&lt;ThisImp&gt;(exec, entry, propertyName, value, thisObj, shouldThrow);
</del><ins>+        putEntry(exec, entry, propertyName, value, slot);
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -328,7 +328,7 @@
</span><span class="cx">     template &lt;class ThisImp, class ParentImp&gt;
</span><span class="cx">     inline void lookupPut(ExecState* exec, PropertyName propertyName, JSValue value, const HashTable&amp; table, ThisImp* thisObj, PutPropertySlot&amp; slot)
</span><span class="cx">     {
</span><del>-        if (!lookupPut&lt;ThisImp&gt;(exec, propertyName, value, table, thisObj, slot.isStrictMode()))
</del><ins>+        if (!lookupPut(exec, propertyName, value, table, slot))
</ins><span class="cx">             ParentImp::put(thisObj, exec, propertyName, value, slot); // not found: forward to parent
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePutPropertySloth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/JavaScriptCore/runtime/PutPropertySlot.h        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -27,6 +27,8 @@
</span><span class="cx"> #ifndef PutPropertySlot_h
</span><span class="cx"> #define PutPropertySlot_h
</span><span class="cx"> 
</span><ins>+#include &quot;JSCJSValue.h&quot;
+
</ins><span class="cx"> #include &lt;wtf/Assertions.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -36,14 +38,17 @@
</span><span class="cx">     
</span><span class="cx">     class PutPropertySlot {
</span><span class="cx">     public:
</span><del>-        enum Type { Uncachable, ExistingProperty, NewProperty };
</del><ins>+        enum Type { Uncachable, ExistingProperty, NewProperty, CustomProperty };
</ins><span class="cx">         enum Context { UnknownContext, PutById, PutByIdEval };
</span><ins>+        typedef void (*PutValueFunc)(ExecState*, EncodedJSValue base, EncodedJSValue value);
</ins><span class="cx"> 
</span><del>-        PutPropertySlot(bool isStrictMode = false, Context context = UnknownContext)
</del><ins>+        PutPropertySlot(JSValue thisValue, bool isStrictMode = false, Context context = UnknownContext)
</ins><span class="cx">             : m_type(Uncachable)
</span><span class="cx">             , m_base(0)
</span><ins>+            , m_thisValue(thisValue)
</ins><span class="cx">             , m_isStrictMode(isStrictMode)
</span><span class="cx">             , m_context(context)
</span><ins>+            , m_putFunction(nullptr)
</ins><span class="cx">         {
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -60,14 +65,22 @@
</span><span class="cx">             m_base = base;
</span><span class="cx">             m_offset = offset;
</span><span class="cx">         }
</span><ins>+
+        void setCustomProperty(JSObject* base, PutValueFunc function)
+        {
+            m_type = CustomProperty;
+            m_base = base;
+            m_putFunction = function;
+        }
</ins><span class="cx">         
</span><span class="cx">         Context context() const { return static_cast&lt;Context&gt;(m_context); }
</span><span class="cx"> 
</span><span class="cx">         Type type() const { return m_type; }
</span><span class="cx">         JSObject* base() const { return m_base; }
</span><ins>+        JSValue thisValue() const { return m_thisValue; }
</ins><span class="cx"> 
</span><span class="cx">         bool isStrictMode() const { return m_isStrictMode; }
</span><del>-        bool isCacheable() const { return m_type != Uncachable; }
</del><ins>+        bool isCacheable() const { return m_type != Uncachable &amp;&amp; m_type != CustomProperty; }
</ins><span class="cx">         PropertyOffset cachedOffset() const
</span><span class="cx">         {
</span><span class="cx">             ASSERT(isCacheable());
</span><span class="lines">@@ -77,9 +90,12 @@
</span><span class="cx">     private:
</span><span class="cx">         Type m_type;
</span><span class="cx">         JSObject* m_base;
</span><ins>+        JSValue m_thisValue;
</ins><span class="cx">         PropertyOffset m_offset;
</span><span class="cx">         bool m_isStrictMode;
</span><span class="cx">         uint8_t m_context;
</span><ins>+        PutValueFunc m_putFunction;
+
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebCore/ChangeLog        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2013-12-23  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Refactor PutPropertySlot to be aware of custom properties
+        https://bugs.webkit.org/show_bug.cgi?id=126187
+
+        Reviewed by Antti Koivisto.
+
+        Update the bindings code generation and custom objects
+        to the new function signatures
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::put):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject setValue:forKey:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterface::putByIndex):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetProperty):
+
</ins><span class="cx"> 2014-01-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Add AsyncScrollingCoordinator, which is a base class for threaded and future remote ScrollingCoordinators
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -339,7 +339,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (lookupPut&lt;JSDOMWindow&gt;(exec, propertyName, value, *s_info.propHashTable(exec), thisObject))
</del><ins>+    if (lookupPut(exec, propertyName, value, *s_info.propHashTable(exec), slot))
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject-&gt;impl()))
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsobjcWebScriptObjectmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/objc/WebScriptObject.mm (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/objc/WebScriptObject.mm        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebCore/bindings/objc/WebScriptObject.mm        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -376,10 +376,10 @@
</span><span class="cx">     ASSERT(!exec-&gt;hadException());
</span><span class="cx"> 
</span><span class="cx">     JSLockHolder lock(exec);
</span><ins>+    JSObject* object = JSC::jsDynamicCast&lt;JSObject*&gt;([self _imp]);
+    PutPropertySlot slot(object);
+    object-&gt;methodTable()-&gt;put(object, exec, Identifier(exec, String(key)), convertObjcValueToValue(exec, &amp;value, ObjcObjectType, [self _rootObject]), slot);
</ins><span class="cx"> 
</span><del>-    PutPropertySlot slot;
-    [self _imp]-&gt;methodTable()-&gt;put([self _imp], exec, Identifier(exec, String(key)), convertObjcValueToValue(exec, &amp;value, ObjcObjectType, [self _rootObject]), slot);
-
</del><span class="cx">     if (exec-&gt;hadException()) {
</span><span class="cx">         addExceptionToConsole(exec);
</span><span class="cx">         exec-&gt;clearException();
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1929,8 +1929,8 @@
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             if ($interface-&gt;extendedAttributes-&gt;{&quot;CheckSecurity&quot;} &amp;&amp;
</span><del>-            !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;DoNotCheckSecurity&quot;} &amp;&amp;
-            !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;DoNotCheckSecurityOnGetter&quot;}) {
</del><ins>+                !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;DoNotCheckSecurity&quot;} &amp;&amp;
+                !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;DoNotCheckSecurityOnGetter&quot;}) {
</ins><span class="cx">                 push(@implContent, &quot;    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, castedThis-&gt;impl()))\n&quot;);
</span><span class="cx">                 push(@implContent, &quot;        return JSValue::encode(jsUndefined());\n&quot;);
</span><span class="cx">             }
</span><span class="lines">@@ -2064,9 +2064,19 @@
</span><span class="cx">         if (!$interface-&gt;extendedAttributes-&gt;{&quot;NoInterfaceObject&quot;}) {
</span><span class="cx">             my $constructorFunctionName = &quot;js&quot; . $interfaceName . &quot;Constructor&quot;;
</span><span class="cx"> 
</span><del>-            push(@implContent, &quot;EncodedJSValue ${constructorFunctionName}(ExecState* exec, EncodedJSValue slotBase, EncodedJSValue, PropertyName)\n&quot;);
</del><ins>+            push(@implContent, &quot;EncodedJSValue ${constructorFunctionName}(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue, PropertyName)\n&quot;);
</ins><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><del>-            push(@implContent, &quot;    ${className}* domObject = jsDynamicCast&lt;$className*&gt;(JSValue::decode(slotBase));\n&quot;);
</del><ins>+            if ($interfaceName eq &quot;DOMWindow&quot;) {
+                push(@implContent, &quot;    ${className}* domObject = jsCast&lt;$className*&gt;(JSValue::decode(thisValue));\n&quot;);
+                push(@implContent, &quot;    if (!domObject) {\n&quot;);
+                push(@implContent, &quot;        if (JSDOMWindowShell* shell = jsDynamicCast&lt;JSDOMWindowShell*&gt;(JSValue::decode(thisValue)))\n&quot;);
+                push(@implContent, &quot;            domObject = shell-&gt;window();\n&quot;);
+                push(@implContent, &quot;    }\n&quot;);
+            } else {
+                push(@implContent, &quot;    ${className}* domObject = jsDynamicCast&lt;$className*&gt;(JSValue::decode(thisValue));\n&quot;);
+                push(@implContent, &quot;    if (!domObject)\n&quot;);
+                push(@implContent, &quot;        return throwVMTypeError(exec);\n&quot;);
+            }
</ins><span class="cx">             push(@implContent, &quot;    if (!domObject)\n&quot;);
</span><span class="cx">             push(@implContent, &quot;        return throwVMTypeError(exec);\n&quot;);
</span><span class="cx"> 
</span><span class="lines">@@ -2130,7 +2140,7 @@
</span><span class="cx"> 
</span><span class="cx">                     if ($interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedSetter&quot;}) {
</span><span class="cx">                         push(@implContent, &quot;    PropertyName propertyName = Identifier::from(exec, index);\n&quot;);
</span><del>-                        push(@implContent, &quot;    PutPropertySlot slot(shouldThrow);\n&quot;);
</del><ins>+                        push(@implContent, &quot;    PutPropertySlot slot(thisObject, shouldThrow);\n&quot;);
</ins><span class="cx">                         push(@implContent, &quot;    if (thisObject-&gt;putDelegate(exec, propertyName, value, slot))\n&quot;);
</span><span class="cx">                         push(@implContent, &quot;        return;\n&quot;);
</span><span class="cx">                     }
</span><span class="lines">@@ -2160,6 +2170,12 @@
</span><span class="cx">                         push(@implContent, &quot;    UNUSED_PARAM(exec);\n&quot;);
</span><span class="cx">                         if (!$attribute-&gt;isStatic) {
</span><span class="cx">                             push(@implContent, &quot;    ${className}* castedThis = jsDynamicCast&lt;${className}*&gt;(JSValue::decode(thisValue));\n&quot;);
</span><ins>+                            if ($interfaceName eq &quot;DOMWindow&quot;) {
+                                push(@implContent, &quot;    if (!castedThis) {\n&quot;);
+                                push(@implContent, &quot;        if (JSDOMWindowShell* shell = jsDynamicCast&lt;JSDOMWindowShell*&gt;(JSValue::decode(thisValue)))\n&quot;);
+                                push(@implContent, &quot;            castedThis = shell-&gt;window();\n&quot;);
+                                push(@implContent, &quot;    }\n&quot;);
+                            }
</ins><span class="cx">                             push(@implContent, &quot;    if (!castedThis) {\n&quot;);
</span><span class="cx">                             push(@implContent, &quot;        throwVMTypeError(exec);\n&quot;);
</span><span class="cx">                             push(@implContent, &quot;        return;\n&quot;);
</span><span class="lines">@@ -2167,9 +2183,9 @@
</span><span class="cx">                         }
</span><span class="cx">                         if ($interface-&gt;extendedAttributes-&gt;{&quot;CheckSecurity&quot;} &amp;&amp; !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;DoNotCheckSecurity&quot;}) {
</span><span class="cx">                             if ($interfaceName eq &quot;DOMWindow&quot;) {
</span><del>-                                push(@implContent, &quot;    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, jsCast&lt;$className*&gt;(castedThis)-&gt;impl()))\n&quot;);
</del><ins>+                                push(@implContent, &quot;    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, castedThis-&gt;impl()))\n&quot;);
</ins><span class="cx">                             } else {
</span><del>-                                push(@implContent, &quot;    if (!shouldAllowAccessToFrame(exec, jsCast&lt;$className*&gt;(castedThis)-&gt;impl().frame()))\n&quot;);
</del><ins>+                                push(@implContent, &quot;    if (!shouldAllowAccessToFrame(exec, castedThis-&gt;impl().frame()))\n&quot;);
</ins><span class="cx">                             }
</span><span class="cx">                             push(@implContent, &quot;        return;\n&quot;);
</span><span class="cx">                         }
</span><span class="lines">@@ -2312,6 +2328,12 @@
</span><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    JSValue value = JSValue::decode(encodedValue);&quot;);
</span><span class="cx">             push(@implContent, &quot;    ${className}* castedThis = jsDynamicCast&lt;${className}*&gt;(JSValue::decode(thisValue));\n&quot;);
</span><ins>+            if ($interfaceName eq &quot;DOMWindow&quot;) {
+                push(@implContent, &quot;    if (!castedThis) {\n&quot;);
+                push(@implContent, &quot;        if (JSDOMWindowShell* shell = jsDynamicCast&lt;JSDOMWindowShell*&gt;(JSValue::decode(thisValue)))\n&quot;);
+                push(@implContent, &quot;            castedThis = shell-&gt;window();\n&quot;);
+                push(@implContent, &quot;    }\n&quot;);
+            }
</ins><span class="cx">             push(@implContent, &quot;    if (!castedThis) {\n&quot;);
</span><span class="cx">             push(@implContent, &quot;        throwVMTypeError(exec);\n&quot;);
</span><span class="cx">             push(@implContent, &quot;        return;\n&quot;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -455,7 +455,7 @@
</span><span class="cx">     JSTestInterface* thisObject = jsCast&lt;JSTestInterface*&gt;(cell);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     PropertyName propertyName = Identifier::from(exec, index);
</span><del>-    PutPropertySlot slot(shouldThrow);
</del><ins>+    PutPropertySlot slot(thisObject, shouldThrow);
</ins><span class="cx">     if (thisObject-&gt;putDelegate(exec, propertyName, value, slot))
</span><span class="cx">         return;
</span><span class="cx">     Base::putByIndex(cell, exec, index, value, shouldThrow);
</span></span></pre></div>
<a id="trunkSourceWebCorebridgeNP_jsobjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/NP_jsobject.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bridge/NP_jsobject.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebCore/bridge/NP_jsobject.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -324,7 +324,7 @@
</span><span class="cx">         IdentifierRep* i = static_cast&lt;IdentifierRep*&gt;(propertyName);
</span><span class="cx"> 
</span><span class="cx">         if (i-&gt;isString()) {
</span><del>-            PutPropertySlot slot;
</del><ins>+            PutPropertySlot slot(obj-&gt;imp);
</ins><span class="cx">             obj-&gt;imp-&gt;methodTable()-&gt;put(obj-&gt;imp, exec, identifierFromNPIdentifier(exec, i-&gt;string()), convertNPVariantToValue(exec, variant, rootObject), slot);
</span><span class="cx">         } else
</span><span class="cx">             obj-&gt;imp-&gt;methodTable()-&gt;putByIndex(obj-&gt;imp, exec, i-&gt;number(), convertNPVariantToValue(exec, variant, rootObject), false);
</span></span></pre></div>
<a id="trunkSourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/ChangeLog (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/ChangeLog        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebKit/mac/ChangeLog        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2013-12-23  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Refactor PutPropertySlot to be aware of custom properties
+        https://bugs.webkit.org/show_bug.cgi?id=126187
+
+        Reviewed by Antti Koivisto.
+
+        Update for new method signatures.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+
</ins><span class="cx"> 2013-12-31  Andy Estes  &lt;aestes@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [iOS] Upstream PLATFORM(IOS) changes to Source/WebKit/
</span></span></pre></div>
<a id="trunkSourceWebKitmacPluginsHostedNetscapePluginInstanceProxymm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1060,7 +1060,7 @@
</span><span class="cx">     JSLockHolder lock(exec);    
</span><span class="cx"> 
</span><span class="cx">     JSValue value = demarshalValue(exec, valueData, valueLength);
</span><del>-    PutPropertySlot slot;
</del><ins>+    PutPropertySlot slot(object);
</ins><span class="cx">     object-&gt;methodTable()-&gt;put(object, exec, propertyName, value, slot);
</span><span class="cx">     
</span><span class="cx">     exec-&gt;clearException();
</span></span></pre></div>
<a id="trunkSourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/ChangeLog        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebKit2/ChangeLog        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2013-12-23  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Refactor PutPropertySlot to be aware of custom properties
+        https://bugs.webkit.org/show_bug.cgi?id=126187
+
+        Reviewed by Antti Koivisto.
+
+        Update for new method signatures.
+
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::setProperty):
+
</ins><span class="cx"> 2014-01-02  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Add AsyncScrollingCoordinator, which is a base class for threaded and future remote ScrollingCoordinators
</span></span></pre></div>
<a id="trunkSourceWebKit2WebProcessPluginsNetscapeNPJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp (161219 => 161220)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp        2014-01-02 20:42:13 UTC (rev 161219)
+++ trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp        2014-01-02 20:56:20 UTC (rev 161220)
</span><span class="lines">@@ -192,7 +192,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue jsValue = m_objectMap-&gt;convertNPVariantToJSValue(exec, m_objectMap-&gt;globalObject(), *value);
</span><span class="cx">     if (identifierRep-&gt;isString()) {
</span><del>-        PutPropertySlot slot;
</del><ins>+        PutPropertySlot slot(m_jsObject.get());
</ins><span class="cx">         m_jsObject-&gt;methodTable()-&gt;put(m_jsObject.get(), exec, identifierFromIdentifierRep(exec, identifierRep), jsValue, slot);
</span><span class="cx">     } else
</span><span class="cx">         m_jsObject-&gt;methodTable()-&gt;putByIndex(m_jsObject.get(), exec, identifierRep-&gt;number(), jsValue, false);
</span></span></pre>
</div>
</div>

</body>
</html>