<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[168902] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168902">168902</a></dd>
<dt>Author</dt> <dd>mhahnenberg@apple.com</dd>
<dt>Date</dt> <dd>2014-05-15 11:28:50 -0700 (Thu, 15 May 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Move subframe name getter lookup later in JSDOMWindow::getOwnPropertySlot
https://bugs.webkit.org/show_bug.cgi?id=132922
Reviewed by Geoffrey Garen.
Source/WebCore:
No new tests.
In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow,
then we search the window's subframes for name getters, then we look in the window's prototype
chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but
Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before
looking for subframe name getters. We should change this to match Mozilla. This has the convenient
side effect of allowing us to cache lookups in the window's prototype chain.
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::getOwnPropertySlot):
LayoutTests:
In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow,
then we search the window's subframes for name getters, then we look in the window's prototype
chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but
Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before
looking for subframe name getters. We should change this to match Mozilla. This has the convenient
side effect of allowing us to cache lookups in the window's prototype chain.
* fast/dom/Window/window-function-frame-getter-precedence-expected.txt: Rebaseline to account
for change in behavior.
* fast/dom/Window/window-function-frame-getter-precedence.html:
* http/tests/security/document-all-expected.txt: Rebaseline due to the presenece of a security check
that was previously not done with the old behavior.
* http/tests/security/window-named-proto-expected.txt: Ditto.
* http/tests/security/window-named-valueOf-expected.txt: Ditto.
* http/tests/security/xss-DENIED-window-name-alert.html: Changed test so it actually tests named getters.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowwindowfunctionframegetterprecedenceexpectedtxt">trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowwindowfunctionframegetterprecedencehtml">trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence.html</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritydocumentallexpectedtxt">trunk/LayoutTests/http/tests/security/document-all-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritywindownamedprotoexpectedtxt">trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritywindownamedvalueOfexpectedtxt">trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDwindownamealerthtml">trunk/LayoutTests/http/tests/security/xss-DENIED-window-name-alert.html</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/ChangeLog 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -1,3 +1,26 @@
</span><ins>+2014-05-15 Mark Hahnenberg <mhahnenberg@apple.com>
+
+ Move subframe name getter lookup later in JSDOMWindow::getOwnPropertySlot
+ https://bugs.webkit.org/show_bug.cgi?id=132922
+
+ Reviewed by Geoffrey Garen.
+
+ In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow,
+ then we search the window's subframes for name getters, then we look in the window's prototype
+ chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but
+ Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before
+ looking for subframe name getters. We should change this to match Mozilla. This has the convenient
+ side effect of allowing us to cache lookups in the window's prototype chain.
+
+ * fast/dom/Window/window-function-frame-getter-precedence-expected.txt: Rebaseline to account
+ for change in behavior.
+ * fast/dom/Window/window-function-frame-getter-precedence.html:
+ * http/tests/security/document-all-expected.txt: Rebaseline due to the presenece of a security check
+ that was previously not done with the old behavior.
+ * http/tests/security/window-named-proto-expected.txt: Ditto.
+ * http/tests/security/window-named-valueOf-expected.txt: Ditto.
+ * http/tests/security/xss-DENIED-window-name-alert.html: Changed test so it actually tests named getters.
+
</ins><span class="cx"> 2014-05-15 Commit Queue <commit-queue@webkit.org>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r168893.
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowwindowfunctionframegetterprecedenceexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence-expected.txt (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence-expected.txt 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence-expected.txt 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -1,57 +1,57 @@
</span><span class="cx"> This tests that a frame with a the same name as function on the window object, has precedence in the lookup.
</span><span class="cx">
</span><del>-PASS: typeof window.getSelection should be object and is.
-PASS: typeof window.focus should be object and is.
-PASS: typeof window.blur should be object and is.
-PASS: typeof window.close should be object and is.
-PASS: typeof window.print should be object and is.
-PASS: typeof window.stop should be object and is.
-PASS: typeof window.alert should be object and is.
-PASS: typeof window.confirm should be object and is.
-PASS: typeof window.prompt should be object and is.
-PASS: typeof window.find should be object and is.
-PASS: typeof window.scrollBy should be object and is.
-PASS: typeof window.scrollTo should be object and is.
-PASS: typeof window.scroll should be object and is.
-PASS: typeof window.moveBy should be object and is.
-PASS: typeof window.moveTo should be object and is.
-PASS: typeof window.resizeBy should be object and is.
-PASS: typeof window.resizeTo should be object and is.
-PASS: typeof window.getComputedStyle should be object and is.
-PASS: typeof window.getMatchedCSSRules should be object and is.
-PASS: typeof window.openDatabase should be object and is.
-PASS: typeof window.postMessage should be object and is.
-PASS: typeof window.atob should be object and is.
-PASS: typeof window.btoa should be object and is.
-PASS: typeof window.open should be object and is.
-PASS: typeof window.setTimeout should be object and is.
-PASS: typeof window.clearTimeout should be object and is.
-PASS: typeof window.setInterval should be object and is.
-PASS: typeof window.clearInterval should be object and is.
-PASS: typeof window.addEventListener should be object and is.
-PASS: typeof window.removeEventListener should be object and is.
-PASS: typeof window.captureEvents should be object and is.
-PASS: typeof window.releaseEvents should be object and is.
-FAIL: typeof window.eval should be object but instead is function
-FAIL: typeof window.parseInt should be object but instead is function
-FAIL: typeof window.parseFloat should be object but instead is function
-FAIL: typeof window.isNaN should be object but instead is function
-FAIL: typeof window.isFinite should be object but instead is function
-FAIL: typeof window.escape should be object but instead is function
-FAIL: typeof window.unescape should be object but instead is function
-FAIL: typeof window.decodeURI should be object but instead is function
-FAIL: typeof window.decodeURIComponent should be object but instead is function
-FAIL: typeof window.encodeURI should be object but instead is function
-FAIL: typeof window.encodeURIComponent should be object but instead is function
-PASS: typeof window.toString should be object and is.
-PASS: typeof window.toLocaleString should be object and is.
-PASS: typeof window.valueOf should be object and is.
-PASS: typeof window.hasOwnProperty should be object and is.
-PASS: typeof window.propertyIsEnumerable should be object and is.
-PASS: typeof window.isPrototypeOf should be object and is.
-PASS: typeof window.__defineGetter__ should be object and is.
-PASS: typeof window.__defineSetter__ should be object and is.
-PASS: typeof window.__lookupGetter__ should be object and is.
-PASS: typeof window.__lookupSetter__ should be object and is.
-FAIL: typeof window.myFunction should be object but instead is function
-PASS: typeof window.myPrototypeFunction should be object and is.
</del><ins>+PASS: typeof window.getSelection should be function and is.
+PASS: typeof window.focus should be function and is.
+PASS: typeof window.blur should be function and is.
+PASS: typeof window.close should be function and is.
+PASS: typeof window.print should be function and is.
+PASS: typeof window.stop should be function and is.
+PASS: typeof window.alert should be function and is.
+PASS: typeof window.confirm should be function and is.
+PASS: typeof window.prompt should be function and is.
+PASS: typeof window.find should be function and is.
+PASS: typeof window.scrollBy should be function and is.
+PASS: typeof window.scrollTo should be function and is.
+PASS: typeof window.scroll should be function and is.
+PASS: typeof window.moveBy should be function and is.
+PASS: typeof window.moveTo should be function and is.
+PASS: typeof window.resizeBy should be function and is.
+PASS: typeof window.resizeTo should be function and is.
+PASS: typeof window.getComputedStyle should be function and is.
+PASS: typeof window.getMatchedCSSRules should be function and is.
+PASS: typeof window.openDatabase should be function and is.
+PASS: typeof window.postMessage should be function and is.
+PASS: typeof window.atob should be function and is.
+PASS: typeof window.btoa should be function and is.
+PASS: typeof window.open should be function and is.
+PASS: typeof window.setTimeout should be function and is.
+PASS: typeof window.clearTimeout should be function and is.
+PASS: typeof window.setInterval should be function and is.
+PASS: typeof window.clearInterval should be function and is.
+PASS: typeof window.addEventListener should be function and is.
+PASS: typeof window.removeEventListener should be function and is.
+PASS: typeof window.captureEvents should be function and is.
+PASS: typeof window.releaseEvents should be function and is.
+PASS: typeof window.eval should be function and is.
+PASS: typeof window.parseInt should be function and is.
+PASS: typeof window.parseFloat should be function and is.
+PASS: typeof window.isNaN should be function and is.
+PASS: typeof window.isFinite should be function and is.
+PASS: typeof window.escape should be function and is.
+PASS: typeof window.unescape should be function and is.
+PASS: typeof window.decodeURI should be function and is.
+PASS: typeof window.decodeURIComponent should be function and is.
+PASS: typeof window.encodeURI should be function and is.
+PASS: typeof window.encodeURIComponent should be function and is.
+PASS: typeof window.toString should be function and is.
+PASS: typeof window.toLocaleString should be function and is.
+PASS: typeof window.valueOf should be function and is.
+PASS: typeof window.hasOwnProperty should be function and is.
+PASS: typeof window.propertyIsEnumerable should be function and is.
+PASS: typeof window.isPrototypeOf should be function and is.
+PASS: typeof window.__defineGetter__ should be function and is.
+PASS: typeof window.__defineSetter__ should be function and is.
+PASS: typeof window.__lookupGetter__ should be function and is.
+PASS: typeof window.__lookupSetter__ should be function and is.
+PASS: typeof window.myFunction should be function and is.
+PASS: typeof window.myPrototypeFunction should be function and is.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowwindowfunctionframegetterprecedencehtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence.html (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence.html 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/fast/dom/Window/window-function-frame-getter-precedence.html 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -42,9 +42,9 @@
</span><span class="cx"> // This'll keep the output consistent on all platforms.
</span><span class="cx"> if (functionName == "showModalDialog") {
</span><span class="cx"> if (window.showModalDialog != undefined)
</span><del>- shouldBe("typeof window." + functionName, "object", true);
</del><ins>+ shouldBe("typeof window." + functionName, "function", true);
</ins><span class="cx"> } else
</span><del>- shouldBe("typeof window." + functionName, "object");
</del><ins>+ shouldBe("typeof window." + functionName, "function");
</ins><span class="cx">
</span><span class="cx"> document.body.removeChild(iframe);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritydocumentallexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/document-all-expected.txt (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/document-all-expected.txt 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/http/tests/security/document-all-expected.txt 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -1,2 +1,6 @@
</span><del>-CONSOLE MESSAGE: line 1: TypeError: WindowConstructor is not a function (evaluating 'obj.alert.constructor("return document.body.innerHTML")')
</del><ins>+CONSOLE MESSAGE: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080". The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
</ins><span class="cx">
</span><ins>+CONSOLE MESSAGE: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080". The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
+
+CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'obj.alert.constructor')
+
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritywindownamedprotoexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -1,2 +1,4 @@
</span><del>-CONSOLE MESSAGE: line 1: TypeError: null is not an object (evaluating 'document.body.innerHTML')
</del><ins>+CONSOLE MESSAGE: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080". The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
</ins><span class="cx">
</span><ins>+CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'parent.__proto__.alert')
+
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritywindownamedvalueOfexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -1 +1,3 @@
</span><ins>+CONSOLE MESSAGE: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080". The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
+
</ins><span class="cx"> This passes if it doesn't alert the contents of innocent-victim.
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecurityxssDENIEDwindownamealerthtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/xss-DENIED-window-name-alert.html (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/xss-DENIED-window-name-alert.html 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/LayoutTests/http/tests/security/xss-DENIED-window-name-alert.html 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -4,6 +4,6 @@
</span><span class="cx"> </script>
</span><span class="cx"> <iframe sandbox="allow-scripts"
</span><span class="cx"> src="data:text/html,<script>
</span><del>- window.name='alert';
- alert(top.alert === window ? 'PASS' : 'FAIL');
</del><ins>+ window.name='alert2';
+ alert(top.alert2 === window ? 'PASS' : 'FAIL');
</ins><span class="cx"> </script>"></iframe>
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/Source/WebCore/ChangeLog 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2014-05-15 Mark Hahnenberg <mhahnenberg@apple.com>
+
+ Move subframe name getter lookup later in JSDOMWindow::getOwnPropertySlot
+ https://bugs.webkit.org/show_bug.cgi?id=132922
+
+ Reviewed by Geoffrey Garen.
+
+ No new tests.
+
+ In JSDOMWindow::getOwnPropertySlot, we currently look for the property on the JSDOMWindow,
+ then we search the window's subframes for name getters, then we look in the window's prototype
+ chain. Apparently we were doing the lookup in this order to be compatible with Mozilla, but
+ Mozilla no longer implements this behavior. Instead, they do the lookup on the prototype before
+ looking for subframe name getters. We should change this to match Mozilla. This has the convenient
+ side effect of allowing us to cache lookups in the window's prototype chain.
+
+ * bindings/js/JSDOMWindowCustom.cpp:
+ (WebCore::JSDOMWindow::getOwnPropertySlot):
+
</ins><span class="cx"> 2014-05-15 Simon Fraser <simon.fraser@apple.com>
</span><span class="cx">
</span><span class="cx"> [UI-side compositing] Fix copying animations between layers, and pausing them
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (168901 => 168902)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2014-05-15 17:48:33 UTC (rev 168901)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2014-05-15 18:28:50 UTC (rev 168902)
</span><span class="lines">@@ -196,6 +196,19 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ // Do prototype lookup early so that functions and attributes in the prototype can have
+ // precedence over the index and name getters.
+ JSValue proto = thisObject->prototype();
+ if (proto.isObject()) {
+ if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
+ if (!allowsAccess) {
+ thisObject->printErrorMessage(errorMessage);
+ slot.setUndefined();
+ }
+ return true;
+ }
+ }
+
</ins><span class="cx"> // After this point it is no longer valid to cache any results because of
</span><span class="cx"> // the impure nature of the property accesses which follow. We can move this
</span><span class="cx"> // statement further down when we add ways to mitigate these impurities with,
</span><span class="lines">@@ -212,19 +225,6 @@
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // Do prototype lookup early so that functions and attributes in the prototype can have
- // precedence over the index and name getters.
- JSValue proto = thisObject->prototype();
- if (proto.isObject()) {
- if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
- if (!allowsAccess) {
- thisObject->printErrorMessage(errorMessage);
- slot.setUndefined();
- }
- return true;
- }
- }
-
</del><span class="cx"> // FIXME: Search the whole frame hierarchy somewhere around here.
</span><span class="cx"> // We need to test the correct priority order.
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>