<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[185889] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/185889">185889</a></dd>
<dt>Author</dt> <dd>mmirman@apple.com</dd>
<dt>Date</dt> <dd>2015-06-23 16:36:57 -0700 (Tue, 23 Jun 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Completes native binding descriptors with native getters and potentially setters.
https://bugs.webkit.org/show_bug.cgi?id=140575
rdar://problem/19506502

Reviewed by Mark Lam.

Source/JavaScriptCore:

* CMakeLists.txt:  Added JSBoundSlotBaseFunction.cpp
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* inspector/InjectedScriptSource.js: Added case for descriptor having a native getter.
* runtime/JSBoundSlotBaseFunction.cpp: Added.
(JSC::boundSlotBaseFunctionCall):
(JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):
Necessary wrapper for custom getters and setters as objects.
(JSC::JSBoundSlotBaseFunction::create):
(JSC::JSBoundSlotBaseFunction::visitChildren):
(JSC::JSBoundSlotBaseFunction::finishCreation):
* runtime/JSBoundSlotBaseFunction.h: Added.
(JSC::JSBoundSlotBaseFunction::createStructure):
(JSC::JSBoundSlotBaseFunction::boundSlotBase):
(JSC::JSBoundSlotBaseFunction::customGetterSetter):
(JSC::JSBoundSlotBaseFunction::isGetter):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init): Added a globally initialized structure for JSBoundSlotBaseFunction
(JSC::JSGlobalObject::visitChildren): visits that structure
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::boundSlotBaseFunctionStructure): added a getter for that structure
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertyDescriptor): extends the case for CustomGetterSetter to
actually include GetterSetter as a JSBoundSlotBaseFunction
* runtime/VM.cpp: Added initializer for customGetterSetterFunctionMap
* runtime/VM.h: Added cache for JSBoundSlotBaseFunction

LayoutTests:

* inspector-protocol/runtime/getProperties-expected.txt: updated.
* js/dom/native-bindings-descriptors-expected.txt: Added.
* js/dom/native-bindings-descriptors.html: Added.
* js/dom/script-tests/native-bindings-descriptors.js: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsinspectorprotocolruntimegetPropertiesexpectedtxt">trunk/LayoutTests/inspector-protocol/runtime/getProperties-expected.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorInjectedScriptSourcejs">trunk/Source/JavaScriptCore/inspector/InjectedScriptSource.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsdomnativebindingsdescriptorsexpectedtxt">trunk/LayoutTests/js/dom/native-bindings-descriptors-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomnativebindingsdescriptorshtml">trunk/LayoutTests/js/dom/native-bindings-descriptors.html</a></li>
<li><a href="#trunkLayoutTestsjsdomscripttestsnativebindingsdescriptorsjs">trunk/LayoutTests/js/dom/script-tests/native-bindings-descriptors.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundSlotBaseFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundSlotBaseFunctionh">trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/LayoutTests/ChangeLog        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2015-06-23  Matthew Mirman  &lt;mmirman@apple.com&gt;
+
+        Completes native binding descriptors with native getters and potentially setters.
+        https://bugs.webkit.org/show_bug.cgi?id=140575
+        rdar://problem/19506502
+
+        Reviewed by Mark Lam.
+
+        * inspector-protocol/runtime/getProperties-expected.txt: updated.
+        * js/dom/native-bindings-descriptors-expected.txt: Added.
+        * js/dom/native-bindings-descriptors.html: Added.
+        * js/dom/script-tests/native-bindings-descriptors.js: Added.
+
</ins><span class="cx"> 2015-06-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed test gardening after r185842
</span></span></pre></div>
<a id="trunkLayoutTestsinspectorprotocolruntimegetPropertiesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/inspector-protocol/runtime/getProperties-expected.txt (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/inspector-protocol/runtime/getProperties-expected.txt        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/LayoutTests/inspector-protocol/runtime/getProperties-expected.txt        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -11,8 +11,8 @@
</span><span class="cx">   __proto__ function function () {
</span><span class="cx">     [native code]
</span><span class="cx"> }
</span><del>-  arguments
-  caller
</del><ins>+  arguments object TypeError: Type error
+  caller object TypeError: Type error
</ins><span class="cx">   length number 0
</span><span class="cx">   name string Number
</span><span class="cx"> Internal properties
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomnativebindingsdescriptorsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/native-bindings-descriptors-expected.txt (0 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/native-bindings-descriptors-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/dom/native-bindings-descriptors-expected.txt        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -0,0 +1,48 @@
</span><ins>+CONSOLE MESSAGE: line 1: Deprecated attempt to access property 'title' on a non-Document object.
+CONSOLE MESSAGE: line 1: Deprecated attempt to access property 'title' on a non-Document object.
+CONSOLE MESSAGE: line 1: Deprecated attempt to access property 'title' on a non-Document object.
+CONSOLE MESSAGE: line 1: [object Object]
+CONSOLE MESSAGE: line 1: function nodeType() {
+    [native code]
+}
+document.title
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title') is not Object.getOwnPropertyDescriptor(Document.prototype, 'title')
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get is Object.getOwnPropertyDescriptor(Document.prototype, 'title').get
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set is Object.getOwnPropertyDescriptor(Document.prototype, 'title').set
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.toString() is &quot;function title() {\n    [native code]\n}&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.length is 0
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.toString() is &quot;function title() {\n    [native code]\n}&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.length is 1
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document) is document.title
+PASS document.title is &quot;old title&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document) is &quot;old title&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call() is undefined.
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(null) is undefined.
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document.documentElement) is undefined.
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document, 'new title') is undefined.
+PASS document.title is &quot;new title&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document) is &quot;new title&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call() threw exception TypeError: The Document.title setter can only be used on instances of Document.
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(null) threw exception TypeError: The Document.title setter can only be used on instances of Document.
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document.documentElement) threw exception TypeError: The Document.title setter can only be used on instances of Document.
+
+document.readyState
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState') is not Object.getOwnPropertyDescriptor(Document.prototype, 'readyState')
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get is Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set is Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.toString() is &quot;function readyState() {\n    [native code]\n}&quot;
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.length is 0
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.call(document) is document.readyState
+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set is undefined.
+
+Node.nodeType
+PASS console.log(node_type) did not throw exception.
+PASS console.log(getter) did not throw exception.
+PASS node_type.get is defined.
+PASS node_type.get.call(document.body) is 1
+PASS node_type.enumerable is true
+PASS getter === otherGetter is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomnativebindingsdescriptorshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/native-bindings-descriptors.html (0 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/native-bindings-descriptors.html                                (rev 0)
+++ trunk/LayoutTests/js/dom/native-bindings-descriptors.html        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;title&gt;old title&lt;/title&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;script-tests/native-bindings-descriptors.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomscripttestsnativebindingsdescriptorsjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/script-tests/native-bindings-descriptors.js (0 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/script-tests/native-bindings-descriptors.js                                (rev 0)
+++ trunk/LayoutTests/js/dom/script-tests/native-bindings-descriptors.js        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -0,0 +1,54 @@
</span><ins>+debug(&quot;document.title&quot;);
+shouldNotBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title')&quot;, &quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title')&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get&quot;, &quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set&quot;, &quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set&quot;);
+shouldBeEqualToString(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.toString()&quot;, &quot;function title() {\n    [native code]\n}&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.length&quot;, &quot;0&quot;);
+shouldBeEqualToString(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.toString()&quot;, &quot;function title() {\n    [native code]\n}&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.length&quot;, &quot;1&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document)&quot;, &quot;document.title&quot;);
+shouldBeEqualToString('document.title', 'old title');
+shouldBeEqualToString(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document)&quot;, 'old title');
+shouldBeUndefined(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call()&quot;);
+shouldBeUndefined(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(null)&quot;);
+shouldBeUndefined(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document.documentElement)&quot;);
+shouldBeUndefined(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document, 'new title')&quot;);
+shouldBeEqualToString('document.title', 'new title');
+shouldBeEqualToString(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document)&quot;, 'new title');
+shouldThrow(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call()&quot;);
+shouldThrow(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(null)&quot;);
+shouldThrow(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document.documentElement)&quot;);
+
+// document.readyState CustomAccessor: getter
+// readonly attribute DOMString readyState;
+debug(&quot;&quot;);
+debug(&quot;document.readyState&quot;);
+shouldNotBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState')&quot;, &quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState')&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get&quot;, &quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set&quot;, &quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set&quot;);
+shouldBeEqualToString(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.toString()&quot;, &quot;function readyState() {\n    [native code]\n}&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.length&quot;, &quot;0&quot;);
+shouldBe(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.call(document)&quot;, &quot;document.readyState&quot;);
+shouldBeUndefined(&quot;Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set&quot;);
+
+
+debug(&quot;&quot;);
+debug(&quot;Node.nodeType&quot;);
+
+var node_type = Object.getOwnPropertyDescriptor(Node.prototype, 'nodeType');
+
+// tests that logging one of these to the console does not cause a crash or throw an exception.
+shouldNotThrow(&quot;console.log(node_type)&quot;);
+
+var getter = node_type.get;
+shouldNotThrow(&quot;console.log(getter)&quot;);
+
+shouldBeDefined(&quot;node_type.get&quot;);
+shouldBe(&quot;node_type.get.call(document.body)&quot;, &quot;1&quot;);
+shouldBeTrue(&quot;node_type.enumerable&quot;);
+
+
+
+// tests that the getter on native descriptors is always the same under strict equality. 
+var otherGetter = Object.getOwnPropertyDescriptor(Node.prototype, 'nodeType').get;
+shouldBeTrue(&quot;getter === otherGetter&quot;);
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -476,6 +476,7 @@
</span><span class="cx">     runtime/IteratorOperations.cpp
</span><span class="cx">     runtime/IteratorPrototype.cpp
</span><span class="cx">     runtime/JSAPIValueWrapper.cpp
</span><ins>+    runtime/JSBoundSlotBaseFunction.cpp
</ins><span class="cx">     runtime/JSArray.cpp
</span><span class="cx">     runtime/JSArrayBuffer.cpp
</span><span class="cx">     runtime/JSArrayBufferConstructor.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/ChangeLog        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -1,3 +1,39 @@
</span><ins>+2015-06-23  Matthew Mirman  &lt;mmirman@apple.com&gt;
+
+        Completes native binding descriptors with native getters and potentially setters.
+        https://bugs.webkit.org/show_bug.cgi?id=140575
+        rdar://problem/19506502
+
+        Reviewed by Mark Lam.
+
+        * CMakeLists.txt:  Added JSBoundSlotBaseFunction.cpp
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * inspector/InjectedScriptSource.js: Added case for descriptor having a native getter.
+        * runtime/JSBoundSlotBaseFunction.cpp: Added.
+        (JSC::boundSlotBaseFunctionCall):
+        (JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):  
+        Necessary wrapper for custom getters and setters as objects.
+        (JSC::JSBoundSlotBaseFunction::create):
+        (JSC::JSBoundSlotBaseFunction::visitChildren):
+        (JSC::JSBoundSlotBaseFunction::finishCreation):
+        * runtime/JSBoundSlotBaseFunction.h: Added.
+        (JSC::JSBoundSlotBaseFunction::createStructure):
+        (JSC::JSBoundSlotBaseFunction::boundSlotBase):
+        (JSC::JSBoundSlotBaseFunction::customGetterSetter):
+        (JSC::JSBoundSlotBaseFunction::isGetter):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Added a globally initialized structure for JSBoundSlotBaseFunction
+        (JSC::JSGlobalObject::visitChildren): visits that structure
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure): added a getter for that structure
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor): extends the case for CustomGetterSetter to 
+        actually include GetterSetter as a JSBoundSlotBaseFunction
+        * runtime/VM.cpp: Added initializer for customGetterSetterFunctionMap
+        * runtime/VM.h: Added cache for JSBoundSlotBaseFunction
+
</ins><span class="cx"> 2015-06-22  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [ES6] Allow trailing comma in ArrayBindingPattern and ObjectBindingPattern
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -740,6 +740,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSArrayBufferPrototype.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSArrayBufferView.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSBoundFunction.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\runtime\JSBoundSlotBaseFunction.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCJSValue.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCallee.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCatchScope.cpp&quot; /&gt;
</span><span class="lines">@@ -1545,6 +1546,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSArrayBufferViewInlines.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSArrayIterator.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSBoundFunction.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\runtime\JSBoundSlotBaseFunction.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCInlines.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCJSValue.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCJSValueInlines.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -642,6 +642,9 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSBoundFunction.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\runtime\JSBoundSlotBaseFunction.cpp&quot;&gt;
+      &lt;Filter&gt;runtime&lt;/Filter&gt;
+    &lt;/ClCompile&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCallee.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><span class="lines">@@ -2697,6 +2700,9 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSBoundFunction.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\runtime\JSBoundSlotBaseFunction.h&quot;&gt;
+      &lt;Filter&gt;runtime&lt;/Filter&gt;
+    &lt;/ClInclude&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCallee.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -1310,6 +1310,8 @@
</span><span class="cx">                 A5FD0082189B191A00633231 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A5FD0085189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */; };
</span><span class="cx">                 A5FD0086189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */; };
</span><ins>+                A6738B041B2BB37D00027B28 /* JSBoundSlotBaseFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = A6738B031B2BB36C00027B28 /* JSBoundSlotBaseFunction.h */; };
+                A6738B051B2BB39600027B28 /* JSBoundSlotBaseFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A6738B021B2BB36C00027B28 /* JSBoundSlotBaseFunction.cpp */; };
</ins><span class="cx">                 A700873917CBE85300C3E643 /* MapConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873717CBE85300C3E643 /* MapConstructor.cpp */; };
</span><span class="cx">                 A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A700873817CBE85300C3E643 /* MapConstructor.h */; };
</span><span class="cx">                 A700873D17CBE8D300C3E643 /* MapPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873B17CBE8D300C3E643 /* MapPrototype.cpp */; };
</span><span class="lines">@@ -3076,6 +3078,8 @@
</span><span class="cx">                 A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectConsoleAgent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectConsoleAgent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                A6738B021B2BB36C00027B28 /* JSBoundSlotBaseFunction.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSBoundSlotBaseFunction.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                A6738B031B2BB36C00027B28 /* JSBoundSlotBaseFunction.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSBoundSlotBaseFunction.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 A700873717CBE85300C3E643 /* MapConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapConstructor.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A700873817CBE85300C3E643 /* MapConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapConstructor.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A700873B17CBE8D300C3E643 /* MapPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapPrototype.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4329,6 +4333,8 @@
</span><span class="cx">                 7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><ins>+                                A6738B021B2BB36C00027B28 /* JSBoundSlotBaseFunction.cpp */,
+                                A6738B031B2BB36C00027B28 /* JSBoundSlotBaseFunction.h */,
</ins><span class="cx">                                 BCF605110E203EF800B9A64D /* ArgList.cpp */,
</span><span class="cx">                                 BCF605120E203EF800B9A64D /* ArgList.h */,
</span><span class="cx">                                 0FE0500C1AA9091100D33B33 /* ArgumentsMode.h */,
</span><span class="lines">@@ -6430,6 +6436,7 @@
</span><span class="cx">                                 A503FA22188EFF6800110F14 /* ScriptDebugListener.h in Headers */,
</span><span class="cx">                                 A503FA26188EFFFD00110F14 /* ScriptDebugServer.h in Headers */,
</span><span class="cx">                                 A55D93A6185012A800400DED /* ScriptFunctionCall.h in Headers */,
</span><ins>+                                A6738B041B2BB37D00027B28 /* JSBoundSlotBaseFunction.h in Headers */,
</ins><span class="cx">                                 A54CF2FA184EAEDA00237F19 /* ScriptObject.h in Headers */,
</span><span class="cx">                                 A54CF2F6184EAB2400237F19 /* ScriptValue.h in Headers */,
</span><span class="cx">                                 A7299DA617D12858005F5FF9 /* SetConstructor.h in Headers */,
</span><span class="lines">@@ -7019,6 +7026,7 @@
</span><span class="cx">                         isa = PBXSourcesBuildPhase;
</span><span class="cx">                         buildActionMask = 2147483647;
</span><span class="cx">                         files = (
</span><ins>+                                A6738B051B2BB39600027B28 /* JSBoundSlotBaseFunction.cpp in Sources */,
</ins><span class="cx">                                 9EA5C7A2190F088700508EBE /* InitializeLLVMMac.cpp in Sources */,
</span><span class="cx">                                 9EA5C7A1190F084200508EBE /* BundlePath.mm in Sources */,
</span><span class="cx">                                 52B310FF1975B4240080857C /* TypeLocationCache.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorInjectedScriptSourcejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/InjectedScriptSource.js (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/InjectedScriptSource.js        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/inspector/InjectedScriptSource.js        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -54,6 +54,14 @@
</span><span class="cx">     return &quot;&quot; + (obj &gt;&gt;&gt; 0) === obj;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+function endsWith(str, suffix)
+{
+    var position = str.length - suffix.length;
+    if (position &lt; 0)
+        return false;
+    return str.indexOf(suffix, position) === position;
+}
+
</ins><span class="cx"> function isSymbol(obj)
</span><span class="cx"> {
</span><span class="cx">     return typeof obj === &quot;symbol&quot;;
</span><span class="lines">@@ -680,8 +688,10 @@
</span><span class="cx">                     continue;
</span><span class="cx">                 }
</span><span class="cx"> 
</span><del>-                if (descriptor.hasOwnProperty(&quot;get&quot;) &amp;&amp; descriptor.hasOwnProperty(&quot;set&quot;) &amp;&amp; !descriptor.get &amp;&amp; !descriptor.set) {
-                    // FIXME: &lt;https://webkit.org/b/140575&gt; Web Inspector: Native Bindings Descriptors are Incomplete
</del><ins>+                if (endsWith(String(descriptor.get), &quot;[native code]\n}&quot;) || 
+                     (!descriptor.get &amp;&amp; descriptor.hasOwnProperty(&quot;get&quot;) &amp;&amp; !descriptor.set &amp;&amp; descriptor.hasOwnProperty(&quot;set&quot;))) {
+                    // FIXME: Some Native Bindings Descriptors are Incomplete
+                    // &lt;https://webkit.org/b/141585&gt; Some IDL attributes appear on the instances instead of on prototypes
</ins><span class="cx">                     // Developers may create such a descriptors, so we should be resilient:
</span><span class="cx">                     // var x = {}; Object.defineProperty(x, &quot;p&quot;, {get:undefined}); Object.getOwnPropertyDescriptor(x, &quot;p&quot;)
</span><span class="cx">                     var fakeDescriptor = createFakeValueDescriptor(name, symbol, descriptor, isOwnProperty, true);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundSlotBaseFunctioncpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.cpp (0 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.cpp        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -0,0 +1,94 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;JSBoundSlotBaseFunction.h&quot;
+
+#include &quot;CustomGetterSetter.h&quot;
+#include &quot;GetterSetter.h&quot;
+#include &quot;JSCInlines.h&quot;
+#include &quot;JSGlobalObject.h&quot;
+
+namespace JSC {
+
+const ClassInfo JSBoundSlotBaseFunction::s_info = { &quot;Function&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSBoundSlotBaseFunction) };
+
+EncodedJSValue JSC_HOST_CALL boundSlotBaseFunctionCall(ExecState* exec)
+{
+    JSBoundSlotBaseFunction* boundSlotBaseFunction = jsCast&lt;JSBoundSlotBaseFunction*&gt;(exec-&gt;callee());
+    JSObject* baseObject = boundSlotBaseFunction-&gt;boundSlotBase();
+    CustomGetterSetter* customGetterSetter = boundSlotBaseFunction-&gt;customGetterSetter();
+
+    if (boundSlotBaseFunction-&gt;isSetter()) {
+        callCustomSetter(exec, customGetterSetter, baseObject, exec-&gt;thisValue(), exec-&gt;argument(0));
+        return JSValue::encode(jsUndefined());
+    }
+
+    CustomGetterSetter::CustomGetter getter = customGetterSetter-&gt;getter();
+    if (!getter)
+        return JSValue::encode(jsUndefined());
+
+    const String&amp; name = boundSlotBaseFunction-&gt;name(exec);
+    return getter(exec, baseObject, JSValue::encode(exec-&gt;thisValue()), PropertyName(Identifier::fromString(exec, name)));
+}
+
+JSBoundSlotBaseFunction::JSBoundSlotBaseFunction(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure, const Type type)
+    : Base(vm, globalObject, structure)
+    , m_type(type)
+{
+}
+
+JSBoundSlotBaseFunction* JSBoundSlotBaseFunction::create(VM&amp; vm, JSGlobalObject* globalObject, JSObject* boundSlotBase, CustomGetterSetter* getterSetter, const Type type, const String&amp; name)
+{
+    NativeExecutable* executable = vm.getHostFunction(boundSlotBaseFunctionCall, callHostFunctionAsConstructor);
+
+    JSBoundSlotBaseFunction* function = new (NotNull, allocateCell&lt;JSBoundSlotBaseFunction&gt;(vm.heap)) JSBoundSlotBaseFunction(vm, globalObject, globalObject-&gt;boundSlotBaseFunctionStructure(), type);
+
+    // Can't do this during initialization because getHostFunction might do a GC allocation.
+    function-&gt;finishCreation(vm, executable, boundSlotBase, getterSetter, name);
+    return function;
+}
+
+void JSBoundSlotBaseFunction::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
+{
+    JSBoundSlotBaseFunction* thisObject = jsCast&lt;JSBoundSlotBaseFunction*&gt;(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(&amp;thisObject-&gt;m_boundSlotBase);
+    visitor.append(&amp;thisObject-&gt;m_getterSetter);
+}
+
+void JSBoundSlotBaseFunction::finishCreation(VM&amp; vm, NativeExecutable* executable, JSObject* boundSlotBase, CustomGetterSetter* getterSetter, const String&amp; name)
+{
+    Base::finishCreation(vm, executable, isSetter(), name);
+    ASSERT(inherits(info()));
+    ASSERT(!boundSlotBase);
+    ASSERT(!getterSetter);
+    m_boundSlotBase.set(vm, this, boundSlotBase);
+    m_getterSetter.set(vm, this, getterSetter);
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundSlotBaseFunctionh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.h (0 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.h        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -0,0 +1,78 @@
</span><ins>+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSBoundSlotBaseFunction_h
+#define JSBoundSlotBaseFunction_h
+
+#include &quot;JSFunction.h&quot;
+
+namespace JSC {
+
+class CustomGetterSetter;
+
+EncodedJSValue JSC_HOST_CALL boundSlotBaseFunctionCall(ExecState*);
+
+class JSBoundSlotBaseFunction : public JSFunction {
+
+public:
+
+    typedef JSFunction Base;
+
+    // The Type is set to the number of arguments the resultant function will have.
+    enum class Type { Getter = 0, Setter = 1 };
+
+    static const unsigned StructureFlags = Base::StructureFlags;
+
+    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info()); 
+    }
+
+    static JSBoundSlotBaseFunction* create(VM&amp;, JSGlobalObject*, JSObject*, CustomGetterSetter*, const Type, const String&amp;);
+
+    JSObject* boundSlotBase() const { return m_boundSlotBase.get(); }
+    CustomGetterSetter* customGetterSetter() const { return m_getterSetter.get(); }
+    bool isSetter() const { return m_type == Type::Setter; }
+
+    DECLARE_EXPORT_INFO;
+
+protected:
+
+    static void visitChildren(JSCell*, SlotVisitor&amp;);
+
+private:
+
+    JSBoundSlotBaseFunction(VM&amp;, JSGlobalObject*, Structure*, Type);
+
+    void finishCreation(VM&amp;, NativeExecutable*, JSObject*, CustomGetterSetter*, const String&amp;);
+
+    WriteBarrier&lt;JSObject&gt; m_boundSlotBase;
+    WriteBarrier&lt;CustomGetterSetter&gt; m_getterSetter;
+    Type m_type;
+};
+} // namespace JSC
+
+#endif // JSBoundSlotBaseFunction_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -60,6 +60,7 @@
</span><span class="cx"> #include &quot;JSArrayBufferPrototype.h&quot;
</span><span class="cx"> #include &quot;JSArrayIterator.h&quot;
</span><span class="cx"> #include &quot;JSBoundFunction.h&quot;
</span><ins>+#include &quot;JSBoundSlotBaseFunction.h&quot;
</ins><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;JSCallbackConstructor.h&quot;
</span><span class="cx"> #include &quot;JSCallbackFunction.h&quot;
</span><span class="lines">@@ -241,6 +242,7 @@
</span><span class="cx">     exec-&gt;setCallee(m_globalCallee.get());
</span><span class="cx"> 
</span><span class="cx">     m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
</span><ins>+    m_boundSlotBaseFunctionStructure.set(vm, this, JSBoundSlotBaseFunction::createStructure(vm, this, m_functionPrototype.get()));
</ins><span class="cx">     m_boundFunctionStructure.set(vm, this, JSBoundFunction::createStructure(vm, this, m_functionPrototype.get()));
</span><span class="cx">     m_namedFunctionStructure.set(vm, this, Structure::addPropertyTransition(vm, m_functionStructure.get(), vm.propertyNames-&gt;name, DontDelete | ReadOnly | DontEnum, m_functionNameOffset));
</span><span class="cx">     m_internalFunctionStructure.set(vm, this, InternalFunction::createStructure(vm, this, m_functionPrototype.get()));
</span><span class="lines">@@ -775,6 +777,7 @@
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_errorStructure);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_calleeStructure);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_functionStructure);
</span><ins>+    visitor.append(&amp;thisObject-&gt;m_boundSlotBaseFunctionStructure);
</ins><span class="cx">     visitor.append(&amp;thisObject-&gt;m_boundFunctionStructure);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_namedFunctionStructure);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_symbolObjectStructure);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -238,6 +238,7 @@
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_calleeStructure;
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_functionStructure;
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_boundFunctionStructure;
</span><ins>+    WriteBarrier&lt;Structure&gt; m_boundSlotBaseFunctionStructure;
</ins><span class="cx">     WriteBarrier&lt;Structure&gt; m_namedFunctionStructure;
</span><span class="cx">     PropertyOffset m_functionNameOffset;
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_privateNameStructure;
</span><span class="lines">@@ -478,6 +479,7 @@
</span><span class="cx">     Structure* calleeStructure() const { return m_calleeStructure.get(); }
</span><span class="cx">     Structure* functionStructure() const { return m_functionStructure.get(); }
</span><span class="cx">     Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(); }
</span><ins>+    Structure* boundSlotBaseFunctionStructure() const { return m_boundSlotBaseFunctionStructure.get(); }
</ins><span class="cx">     Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(); }
</span><span class="cx">     PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
</span><span class="cx">     Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include &quot;Executable.h&quot;
</span><span class="cx"> #include &quot;GetterSetter.h&quot;
</span><span class="cx"> #include &quot;IndexingHeaderInlines.h&quot;
</span><ins>+#include &quot;JSBoundSlotBaseFunction.h&quot;
</ins><span class="cx"> #include &quot;JSCatchScope.h&quot;
</span><span class="cx"> #include &quot;JSFunction.h&quot;
</span><span class="cx"> #include &quot;JSFunctionNameScope.h&quot;
</span><span class="lines">@@ -2488,6 +2489,17 @@
</span><span class="cx">     return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static JSBoundSlotBaseFunction* getBoundSlotBaseFunctionForGetterSetter(ExecState* exec, PropertyName propertyName, JSC::PropertySlot&amp; slot, CustomGetterSetter* getterSetter, JSBoundSlotBaseFunction::Type type)
+{
+    auto key = std::make_pair(getterSetter, (int)type);
+    JSBoundSlotBaseFunction* boundSlotBase = exec-&gt;vm().customGetterSetterFunctionMap.get(key);
+    if (!boundSlotBase) {
+        boundSlotBase = JSBoundSlotBaseFunction::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), slot.slotBase(), getterSetter, type, propertyName.publicName());
+        exec-&gt;vm().customGetterSetterFunctionMap.set(key, boundSlotBase);
+    }
+    return boundSlotBase;
+}
+
</ins><span class="cx"> bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor&amp; descriptor)
</span><span class="cx"> {
</span><span class="cx">     JSC::PropertySlot slot(this);
</span><span class="lines">@@ -2498,9 +2510,22 @@
</span><span class="cx">         return false;
</span><span class="cx">     if (slot.isAccessor())
</span><span class="cx">         descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
</span><del>-    else if (slot.attributes() &amp; CustomAccessor)
</del><ins>+    else if (slot.attributes() &amp; CustomAccessor) {
</ins><span class="cx">         descriptor.setCustomDescriptor(slot.attributes());
</span><del>-    else
</del><ins>+        
+        JSValue maybeGetterSetter = getDirect(exec-&gt;vm(), propertyName);
+        if (maybeGetterSetter) {
+
+            CustomGetterSetter* getterSetter = jsCast&lt;CustomGetterSetter*&gt;(maybeGetterSetter);
+            ASSERT(getterSetter);
+
+            if (getterSetter-&gt;getter())
+                descriptor.setGetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Getter));
+            if (getterSetter-&gt;setter())
+                descriptor.setSetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Setter));
+            descriptor.setEnumerable(true);
+        }
+    } else
</ins><span class="cx">         descriptor.setDescriptor(slot.getValue(exec, propertyName), slot.attributes());
</span><span class="cx">     return true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -152,6 +152,7 @@
</span><span class="cx">     , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
</span><span class="cx">     , propertyNames(nullptr)
</span><span class="cx">     , emptyList(new MarkedArgumentBuffer)
</span><ins>+    , customGetterSetterFunctionMap(*this)
</ins><span class="cx">     , stringCache(*this)
</span><span class="cx">     , prototypeMap(*this)
</span><span class="cx">     , keywords(std::make_unique&lt;Keywords&gt;(*this))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (185888 => 185889)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2015-06-23 22:47:04 UTC (rev 185888)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2015-06-23 23:36:57 UTC (rev 185889)
</span><span class="lines">@@ -76,6 +76,7 @@
</span><span class="cx"> class CodeBlock;
</span><span class="cx"> class CodeCache;
</span><span class="cx"> class CommonIdentifiers;
</span><ins>+class CustomGetterSetter;
</ins><span class="cx"> class ExecState;
</span><span class="cx"> class Exception;
</span><span class="cx"> class HandleStack;
</span><span class="lines">@@ -83,6 +84,7 @@
</span><span class="cx"> class TypeProfilerLog;
</span><span class="cx"> class Identifier;
</span><span class="cx"> class Interpreter;
</span><ins>+class JSBoundSlotBaseFunction;
</ins><span class="cx"> class JSGlobalObject;
</span><span class="cx"> class JSObject;
</span><span class="cx"> class Keywords;
</span><span class="lines">@@ -290,6 +292,7 @@
</span><span class="cx">     NumericStrings numericStrings;
</span><span class="cx">     DateInstanceCache dateInstanceCache;
</span><span class="cx">     WTF::SimpleStats machineCodeBytesPerBytecodeWordForBaselineJIT;
</span><ins>+    WeakGCMap&lt;std::pair&lt;CustomGetterSetter*, int&gt;, JSBoundSlotBaseFunction&gt; customGetterSetterFunctionMap;
</ins><span class="cx">     WeakGCMap&lt;StringImpl*, JSString, PtrHash&lt;StringImpl*&gt;&gt; stringCache;
</span><span class="cx">     Strong&lt;JSString&gt; lastCachedString;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>