<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[188590] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/188590">188590</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2015-08-18 12:15:44 -0700 (Tue, 18 Aug 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Make our bindings' GetOwnPropertySlot() behave according to specification
https://bugs.webkit.org/show_bug.cgi?id=148092

Reviewed by Geoffrey Garen.

Source/WebCore:

Make our bindings' GetOwnPropertySlot() behave according to
specification. In particular, our bindings use to do:
1. Indexed getter
2. Check static properties
3. Prototype check
4. Named getter
5. Check own properties

According to the specification [1][2], we should do:
- If the interface has [OverrideBuiltins]:
    1. Indexed getter
    2. Named getter
    3. Static / own properties
- Otherwise:
    1. Indexed getter
    2. Static / own properties
    3. Prototype check
    4. Named getter

This patch adds support for the [OverrideBuiltins] IDL extended
attribute [3] and aligns our bindings implementation with the Web IDL
specification weither that IDL extended attribute is present or
not.

[1] https://heycam.github.io/webidl/#getownproperty-guts
[2] https://heycam.github.io/webidl/#dfn-named-property-visibility
[3] https://heycam.github.io/webidl/#OverrideBuiltins

Performance:
- PerformanceTests/Bindings/childNodes-traversal.html: ~Same
- PerformanceTests/Bindings/children-traversal.html: +104% :)

No new tests, covered by:
fast/dom/htmlcollection-getownproperty.html
fast/dom/collection-length-should-not-be-overridden.html
fast/forms/input-named-action-overrides-action-attribute.html

* bindings/js/JSHTMLCollectionCustom.cpp:
(WebCore::JSHTMLCollection::nameGetter):
Add assertions to make sure we don't use HTMLCollection's namedGetter()
for HTMLFormControlsCollection / HTMLOptionsCollection subclasses.
We should use the subclasses' namedGetter() instead.

* bindings/js/JSHTMLOptionsCollectionCustom.cpp:
(WebCore::JSHTMLOptionsCollection::canGetItemsForName):
(WebCore::JSHTMLOptionsCollection::nameGetter):
Add code for handling named getter requests on
HTMLOptionsCollection.

* bindings/js/JSNodeListCustom.cpp:
(WebCore::JSNodeList::canGetItemsForName):
(WebCore::JSNodeList::nameGetter):
Refactor custom code for the NodeList named getter, now that the
IDL interface is using [CustomNamedGetter] instead of
[JSCustomGetOwnPropertySlotAndDescriptor].

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody):
(GenerateHeaderContentHeader): Deleted.
- Add support for the [OverrideBuiltins] IDL extended attribute and
update the generated getOwnPropertySlot() methods to match the
Web IDL specification.
- Also drop the JSC::HasImpureGetOwnPropertySlot flag for interfaces
that have a named getter but NOT the [OverrideBuiltins] IDL extended
attribute. Without [OverrideBuiltins], named properties can no longer
shadow own properties so we no longer need to mark GetOwnPropertySlot
as impure. This allows caching of properties.

* bindings/scripts/IDLAttributes.txt:
Add [OverrideBuiltins] IDL extended attribute [3].

* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::JSTestActiveDOMObject::getOwnPropertySlot):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::JSTestCustomNamedGetter::getOwnPropertySlot):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::JSTestEventTarget::getOwnPropertySlot):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::JSTestException::getOwnPropertySlot):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterface::getOwnPropertySlot):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObj::getOwnPropertySlot):
Rebaseline the bindings tests as their getOwnPropertySlot() method
is now different.

* bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.cpp: Added.
* bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.h: Added.
* bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltinsPrivate.h: Added.
* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp: Added.
* bindings/scripts/test/JS/JSTestOverrideBuiltins.h: Added.
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
* bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.h: Added.
* bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm: Added.
* bindings/scripts/test/ObjC/DOMTestOverrideBuiltinsInternal.h: Added.
* bindings/scripts/test/TestOverrideBuiltins.idl: Added.
Add bindings test coverage for the new [OverrideBuiltins] IDL extended
attribute [3].

* dom/DOMStringMap.idl:
Add [OverrideBuiltins] IDL extended attribute to match the specification:
https://html.spec.whatwg.org/multipage/infrastructure.html#domstringmap

* dom/NodeList.idl:
Use CustomNamedGetter IDL extended attribute instead of
JSCustomGetOwnPropertySlotAndDescriptor as NodeList merely implements
a custom named getter. This makes sure that the order in which the
named getter is called is correct as per the Web IDL specification.

* html/HTMLDocument.idl:
Add [OverrideBuiltins] IDL extended attribute to match the specification:
https://html.spec.whatwg.org/multipage/dom.html#the-document-object

* html/HTMLFormElement.idl:
Add [OverrideBuiltins] IDL extended attribute to match the specification:
https://html.spec.whatwg.org/multipage/forms.html#the-form-element

* html/HTMLOptionsCollection.idl:
Add missing 'getter' in front of the named getter, as the per the HTML
specification. Without this, HTMLOptionsCollection would not be
recognized as a named properties object, which means that we would not
check the HTMLOptionsCollection prototype before querying the named
getter on HTMLCollection. This used to work because the bindings
generator was hard-coding the prototype check for every HTML*Collection
IDL interface. In this patch, we generalized the check to every
interface that has a named getter.

LayoutTests:

* fast/dom/childnode-item-after-itemname.html:
Update the test so the item's id in the NodeList is &quot;testItem&quot;
instead of &quot;item&quot;. NodeList has a method called item() which now
takes priority over the name when accessing Nodelist.item, as per
the Web IDL specification.

* fast/dom/htmlcollection-getownproperty-expected.txt:
Rebaseline test. This is a progression.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsfastdomchildnodeitemafteritemnamehtml">trunk/LayoutTests/fast/dom/childnode-item-after-itemname.html</a></li>
<li><a href="#trunkLayoutTestsfastdomhtmlcollectiongetownpropertyexpectedtxt">trunk/LayoutTests/fast/dom/htmlcollection-getownproperty-expected.txt</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSHTMLCollectionCustomcpp">trunk/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSHTMLOptionsCollectionCustomcpp">trunk/Source/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSNodeListCustomcpp">trunk/Source/WebCore/bindings/js/JSNodeListCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsIDLAttributestxt">trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargeth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDOMStringMapidl">trunk/Source/WebCore/dom/DOMStringMap.idl</a></li>
<li><a href="#trunkSourceWebCoredomNodeListidl">trunk/Source/WebCore/dom/NodeList.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLDocumentidl">trunk/Source/WebCore/html/HTMLDocument.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLFormElementidl">trunk/Source/WebCore/html/HTMLFormElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLOptionsCollectionidl">trunk/Source/WebCore/html/HTMLOptionsCollection.idl</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceWebCorebindingsscriptstestGObjectWebKitDOMTestOverrideBuiltinscpp">trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestGObjectWebKitDOMTestOverrideBuiltinsh">trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestGObjectWebKitDOMTestOverrideBuiltinsPrivateh">trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltinsPrivate.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestObjCDOMTestOverrideBuiltinsh">trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestObjCDOMTestOverrideBuiltinsmm">trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestObjCDOMTestOverrideBuiltinsInternalh">trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltinsInternal.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestTestOverrideBuiltinsidl">trunk/Source/WebCore/bindings/scripts/test/TestOverrideBuiltins.idl</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/LayoutTests/ChangeLog        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -1,3 +1,19 @@
</span><ins>+2015-08-18  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Make our bindings' GetOwnPropertySlot() behave according to specification
+        https://bugs.webkit.org/show_bug.cgi?id=148092
+
+        Reviewed by Geoffrey Garen.
+
+        * fast/dom/childnode-item-after-itemname.html:
+        Update the test so the item's id in the NodeList is &quot;testItem&quot;
+        instead of &quot;item&quot;. NodeList has a method called item() which now
+        takes priority over the name when accessing Nodelist.item, as per
+        the Web IDL specification.
+
+        * fast/dom/htmlcollection-getownproperty-expected.txt:
+        Rebaseline test. This is a progression.
+
</ins><span class="cx"> 2015-08-18  Jon Honeycutt  &lt;jhoneycutt@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Remove failing expectations for some WK1 tests that have passed recent
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomchildnodeitemafteritemnamehtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/childnode-item-after-itemname.html (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/childnode-item-after-itemname.html        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/LayoutTests/fast/dom/childnode-item-after-itemname.html        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -3,14 +3,14 @@
</span><span class="cx"> &lt;body&gt;
</span><span class="cx"> &lt;p&gt;This tests accessing the first element in childNodes after accessing the second element by its id.
</span><span class="cx"> WebKit should retrieve each element correctly, and you should see 2 1 below:&lt;/p&gt;
</span><del>-&lt;span id=&quot;item&quot;&gt;&lt;/span&gt;&lt;span id=&quot;tests&quot; style=&quot;display: none;&quot;&gt;1&lt;span id=&quot;item&quot;&gt;2&lt;/span&gt;&lt;/span&gt;
</del><ins>+&lt;span id=&quot;testItem&quot;&gt;&lt;/span&gt;&lt;span id=&quot;tests&quot; style=&quot;display: none;&quot;&gt;1&lt;span id=&quot;testItem&quot;&gt;2&lt;/span&gt;&lt;/span&gt;
</ins><span class="cx"> &lt;script&gt;
</span><span class="cx"> 
</span><span class="cx"> if (window.testRunner)
</span><span class="cx">     testRunner.dumpAsText();
</span><span class="cx"> 
</span><span class="cx"> var tests = document.querySelector('#tests');
</span><del>-document.writeln(tests.childNodes['item'].textContent);
</del><ins>+document.writeln(tests.childNodes['testItem'].textContent);
</ins><span class="cx"> document.writeln(tests.childNodes[0].textContent);
</span><span class="cx"> 
</span><span class="cx"> &lt;/script&gt;
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomhtmlcollectiongetownpropertyexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/htmlcollection-getownproperty-expected.txt (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/htmlcollection-getownproperty-expected.txt        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/LayoutTests/fast/dom/htmlcollection-getownproperty-expected.txt        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -14,7 +14,7 @@
</span><span class="cx"> * Named properties should not mask own properties on HTMLCollection
</span><span class="cx"> htmlCollection.foo = 'foo'
</span><span class="cx"> PASS htmlCollection.namedItem('foo') is document.getElementById('fooP')
</span><del>-FAIL htmlCollection.foo should be foo (of type string). Was [object HTMLParagraphElement] (of type object).
</del><ins>+PASS htmlCollection.foo is &quot;foo&quot;
</ins><span class="cx"> 
</span><span class="cx"> * Named properties should not mask indexed properties
</span><span class="cx"> PASS htmlCollection.item(0) is testDiv.firstElementChild
</span><span class="lines">@@ -24,9 +24,7 @@
</span><span class="cx"> 
</span><span class="cx"> * Own properties on HTMLCollection should mask properties on prototype
</span><span class="cx"> htmlCollection.toString = 'InstanceToString'
</span><del>-FAIL htmlCollection.toString should be InstanceToString (of type string). Was function toString() {
-    [native code]
-} (of type function).
</del><ins>+PASS htmlCollection.toString is &quot;InstanceToString&quot;
</ins><span class="cx"> PASS successfullyParsed is true
</span><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/ChangeLog        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -1,3 +1,137 @@
</span><ins>+2015-08-18  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Make our bindings' GetOwnPropertySlot() behave according to specification
+        https://bugs.webkit.org/show_bug.cgi?id=148092
+
+        Reviewed by Geoffrey Garen.
+
+        Make our bindings' GetOwnPropertySlot() behave according to
+        specification. In particular, our bindings use to do:
+        1. Indexed getter
+        2. Check static properties
+        3. Prototype check
+        4. Named getter
+        5. Check own properties
+
+        According to the specification [1][2], we should do:
+        - If the interface has [OverrideBuiltins]:
+            1. Indexed getter
+            2. Named getter
+            3. Static / own properties
+        - Otherwise:
+            1. Indexed getter
+            2. Static / own properties
+            3. Prototype check
+            4. Named getter
+
+        This patch adds support for the [OverrideBuiltins] IDL extended
+        attribute [3] and aligns our bindings implementation with the Web IDL
+        specification weither that IDL extended attribute is present or
+        not.
+        
+        [1] https://heycam.github.io/webidl/#getownproperty-guts
+        [2] https://heycam.github.io/webidl/#dfn-named-property-visibility
+        [3] https://heycam.github.io/webidl/#OverrideBuiltins
+
+        Performance:
+        - PerformanceTests/Bindings/childNodes-traversal.html: ~Same
+        - PerformanceTests/Bindings/children-traversal.html: +104% :)
+
+        No new tests, covered by:
+        fast/dom/htmlcollection-getownproperty.html
+        fast/dom/collection-length-should-not-be-overridden.html
+        fast/forms/input-named-action-overrides-action-attribute.html
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::JSHTMLCollection::nameGetter):
+        Add assertions to make sure we don't use HTMLCollection's namedGetter()
+        for HTMLFormControlsCollection / HTMLOptionsCollection subclasses.
+        We should use the subclasses' namedGetter() instead.
+
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
+        (WebCore::JSHTMLOptionsCollection::nameGetter):
+        Add code for handling named getter requests on
+        HTMLOptionsCollection.
+
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeList::canGetItemsForName):
+        (WebCore::JSNodeList::nameGetter):
+        Refactor custom code for the NodeList named getter, now that the
+        IDL interface is using [CustomNamedGetter] instead of
+        [JSCustomGetOwnPropertySlotAndDescriptor].
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody):
+        (GenerateHeaderContentHeader): Deleted.
+        - Add support for the [OverrideBuiltins] IDL extended attribute and
+        update the generated getOwnPropertySlot() methods to match the
+        Web IDL specification.
+        - Also drop the JSC::HasImpureGetOwnPropertySlot flag for interfaces
+        that have a named getter but NOT the [OverrideBuiltins] IDL extended
+        attribute. Without [OverrideBuiltins], named properties can no longer
+        shadow own properties so we no longer need to mark GetOwnPropertySlot
+        as impure. This allows caching of properties.
+
+        * bindings/scripts/IDLAttributes.txt:
+        Add [OverrideBuiltins] IDL extended attribute [3].
+
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::JSTestActiveDOMObject::getOwnPropertySlot):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::JSTestCustomNamedGetter::getOwnPropertySlot):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTarget::getOwnPropertySlot):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::JSTestException::getOwnPropertySlot):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterface::getOwnPropertySlot):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObj::getOwnPropertySlot):
+        Rebaseline the bindings tests as their getOwnPropertySlot() method
+        is now different.
+
+        * bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.cpp: Added.
+        * bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.h: Added.
+        * bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltinsPrivate.h: Added.
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp: Added.
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h: Added.
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        * bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.h: Added.
+        * bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm: Added.
+        * bindings/scripts/test/ObjC/DOMTestOverrideBuiltinsInternal.h: Added.
+        * bindings/scripts/test/TestOverrideBuiltins.idl: Added.
+        Add bindings test coverage for the new [OverrideBuiltins] IDL extended
+        attribute [3].
+
+        * dom/DOMStringMap.idl:
+        Add [OverrideBuiltins] IDL extended attribute to match the specification:
+        https://html.spec.whatwg.org/multipage/infrastructure.html#domstringmap
+
+        * dom/NodeList.idl:
+        Use CustomNamedGetter IDL extended attribute instead of
+        JSCustomGetOwnPropertySlotAndDescriptor as NodeList merely implements
+        a custom named getter. This makes sure that the order in which the
+        named getter is called is correct as per the Web IDL specification.
+
+        * html/HTMLDocument.idl:
+        Add [OverrideBuiltins] IDL extended attribute to match the specification:
+        https://html.spec.whatwg.org/multipage/dom.html#the-document-object
+
+        * html/HTMLFormElement.idl:
+        Add [OverrideBuiltins] IDL extended attribute to match the specification:
+        https://html.spec.whatwg.org/multipage/forms.html#the-form-element
+
+        * html/HTMLOptionsCollection.idl:
+        Add missing 'getter' in front of the named getter, as the per the HTML
+        specification. Without this, HTMLOptionsCollection would not be
+        recognized as a named properties object, which means that we would not
+        check the HTMLOptionsCollection prototype before querying the named
+        getter on HTMLCollection. This used to work because the bindings
+        generator was hard-coding the prototype check for every HTML*Collection
+        IDL interface. In this patch, we generalized the check to every
+        interface that has a named getter.
+
</ins><span class="cx"> 2015-08-18  Per Arne Vollan  &lt;peavo@outlook.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [Win] Popup menu displayed at incorrect position when page is scrolled and device scale factor != 1.
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSHTMLCollectionCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/js/JSHTMLCollectionCustom.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -48,6 +48,8 @@
</span><span class="cx"> EncodedJSValue JSHTMLCollection::nameGetter(ExecState* exec, JSObject* slotBase, EncodedJSValue, PropertyName propertyName)
</span><span class="cx"> {
</span><span class="cx">     JSHTMLCollection* collection = jsCast&lt;JSHTMLCollection*&gt;(slotBase);
</span><ins>+    ASSERT_WITH_MESSAGE(collection-&gt;impl().type() != FormControls, &quot;Should call the subclass' nameGetter&quot;);
+    ASSERT_WITH_MESSAGE(collection-&gt;impl().type() != SelectOptions, &quot;Should call the subclass' nameGetter&quot;);
</ins><span class="cx">     const AtomicString&amp; name = propertyNameToAtomicString(propertyName);
</span><span class="cx">     return JSValue::encode(toJS(exec, collection-&gt;globalObject(), collection-&gt;impl().namedItem(name)));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSHTMLOptionsCollectionCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -37,6 +37,18 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><ins>+bool JSHTMLOptionsCollection::canGetItemsForName(ExecState*, HTMLOptionsCollection* collection, PropertyName propertyName)
+{
+    return collection-&gt;hasNamedItem(propertyNameToAtomicString(propertyName));
+}
+
+EncodedJSValue JSHTMLOptionsCollection::nameGetter(ExecState* exec, JSObject* slotBase, EncodedJSValue, PropertyName propertyName)
+{
+    JSHTMLCollection* collection = jsCast&lt;JSHTMLCollection*&gt;(slotBase);
+    const AtomicString&amp; name = propertyNameToAtomicString(propertyName);
+    return JSValue::encode(toJS(exec, collection-&gt;globalObject(), collection-&gt;impl().namedItem(name)));
+}
+
</ins><span class="cx"> void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><span class="cx">     ExceptionCode ec = 0;
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSNodeListCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSNodeListCustom.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSNodeListCustom.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/js/JSNodeListCustom.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -51,15 +51,22 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool JSNodeList::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</del><ins>+bool JSNodeList::canGetItemsForName(ExecState*, NodeList* nodeList, PropertyName propertyName)
</ins><span class="cx"> {
</span><del>-    if (Node* item = impl().namedItem(propertyNameToAtomicString(propertyName))) {
-        slot.setValue(this, ReadOnly | DontDelete | DontEnum, toJS(exec, globalObject(), item));
-        return true;
-    }
-    return false;
</del><ins>+    // FIXME: NodeList should not have a named getter. It currently has one because getElementByTagName()
+    // returns a NodeList instead of an HTMLCollection.
+    return nodeList-&gt;namedItem(propertyNameToAtomicString(propertyName));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSNodeList::nameGetter(ExecState* exec, JSObject* slotBase, EncodedJSValue, PropertyName propertyName)
+{
+    // FIXME: NodeList should not have a named getter. It currently has one because getElementByTagName()
+    // returns a NodeList instead of an HTMLCollection.
+    JSNodeList* nodeList = jsCast&lt;JSNodeList*&gt;(slotBase);
+    const AtomicString&amp; name = propertyNameToAtomicString(propertyName);
+    return JSValue::encode(toJS(exec, nodeList-&gt;globalObject(), nodeList-&gt;impl().namedItem(name)));
+}
+
</ins><span class="cx"> JSC::JSValue createWrapper(JSDOMGlobalObject&amp; globalObject, NodeList&amp; nodeList)
</span><span class="cx"> {
</span><span class="cx">     // FIXME: Adopt reportExtraMemoryVisited, and switch to reportExtraMemoryAllocated.
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -381,17 +381,28 @@
</span><span class="cx"> 
</span><span class="cx">     my @getOwnPropertySlotImpl = ();
</span><span class="cx"> 
</span><del>-    my $manualLookupGetterGeneration = sub {
-        my $requiresManualLookup = $indexedGetterFunction || $namedGetterFunction;
-        if ($requiresManualLookup) {
-            push(@getOwnPropertySlotImpl, &quot;    const ${namespaceMaybe}HashTableValue* entry = getStaticValueSlotEntryWithoutCaching&lt;$className&gt;(exec, propertyName);\n&quot;);
-            push(@getOwnPropertySlotImpl, &quot;    if (entry) {\n&quot;);
-            push(@getOwnPropertySlotImpl, &quot;        slot.setCacheableCustom(thisObject, entry-&gt;attributes(), entry-&gt;propertyGetter());\n&quot;);
-            push(@getOwnPropertySlotImpl, &quot;        return true;\n&quot;);
-            push(@getOwnPropertySlotImpl, &quot;    }\n&quot;);
</del><ins>+    my $ownPropertyCheck = sub {
+        if ($hasAttributes) {
+            if ($inlined) {
+                push(@getOwnPropertySlotImpl, &quot;    if (${namespaceMaybe}getStaticValueSlot&lt;$className, Base&gt;(exec, *info()-&gt;staticPropHashTable, thisObject, propertyName, slot))\n&quot;);
+            } else {
+                push(@getOwnPropertySlotImpl, &quot;    if (${namespaceMaybe}getStaticValueSlot&lt;$className, Base&gt;(exec, ${className}Table, thisObject, propertyName, slot))\n&quot;);
+            }
+        } else {
+            push(@getOwnPropertySlotImpl, &quot;    if (Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))\n&quot;);
</ins><span class="cx">         }
</span><ins>+        push(@getOwnPropertySlotImpl, &quot;        return true;\n&quot;);
</ins><span class="cx">     };
</span><span class="cx"> 
</span><ins>+    # FIXME: As per the Web IDL specification, the prototype check is supposed to skip &quot;named properties objects&quot;:
+    # https://heycam.github.io/webidl/#dfn-named-property-visibility
+    # https://heycam.github.io/webidl/#dfn-named-properties-object
+    my $prototypeCheck = sub {
+        push(@getOwnPropertySlotImpl, &quot;    ${namespaceMaybe}JSValue proto = thisObject-&gt;prototype();\n&quot;);
+        push(@getOwnPropertySlotImpl, &quot;    if (proto.isObject() &amp;&amp; jsCast&lt;${namespaceMaybe}JSObject*&gt;(proto)-&gt;hasProperty(exec, propertyName))\n&quot;);
+        push(@getOwnPropertySlotImpl, &quot;        return false;\n\n&quot;);
+    };
+
</ins><span class="cx">     if ($indexedGetterFunction) {
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;    Optional&lt;uint32_t&gt; optionalIndex = parseIndex(propertyName);\n&quot;);
</span><span class="cx"> 
</span><span class="lines">@@ -414,19 +425,15 @@
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;    }\n&quot;);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (!$interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;} and InstanceAttributeCount($interface) &gt; 0) {
-        &amp;$manualLookupGetterGeneration();
-    }
</del><ins>+    my $hasNamedGetter = $namedGetterFunction || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;};
+    if ($hasNamedGetter) {
+        if (!$interface-&gt;extendedAttributes-&gt;{&quot;OverrideBuiltins&quot;}) {
+            &amp;$ownPropertyCheck();
+            &amp;$prototypeCheck();
+        }
</ins><span class="cx"> 
</span><del>-    # FIXME: We should do this for every interface for every interface that has a named getter.
-    if ($interfaceName eq &quot;NamedNodeMap&quot; or $interfaceName =~ /^HTML\w*Collection$/) {
-        push(@getOwnPropertySlotImpl, &quot;    ${namespaceMaybe}JSValue proto = thisObject-&gt;prototype();\n&quot;);
-        push(@getOwnPropertySlotImpl, &quot;    if (proto.isObject() &amp;&amp; jsCast&lt;${namespaceMaybe}JSObject*&gt;(proto)-&gt;hasProperty(exec, propertyName))\n&quot;);
-        push(@getOwnPropertySlotImpl, &quot;        return false;\n\n&quot;);
-    }
-
-    if ($namedGetterFunction || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;}) {
-        push(@getOwnPropertySlotImpl, &quot;    if (canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {\n&quot;);
</del><ins>+        # The first condition is to make sure we use the subclass' named getter instead of the base class one when possible.
+        push(@getOwnPropertySlotImpl, &quot;    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {\n&quot;);
</ins><span class="cx">         push(@getOwnPropertySlotImpl, &quot;        slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);\n&quot;);
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;        return true;\n&quot;);
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;    }\n&quot;);
</span><span class="lines">@@ -437,26 +444,17 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if ($interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;}) {
-        &amp;$manualLookupGetterGeneration();
-    }
-
</del><span class="cx">     if ($interface-&gt;extendedAttributes-&gt;{&quot;JSCustomGetOwnPropertySlotAndDescriptor&quot;}) {
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;    if (thisObject-&gt;getOwnPropertySlotDelegate(exec, propertyName, slot))\n&quot;);
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;        return true;\n&quot;);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if ($hasAttributes) {
-        # FIXME: We are supposed to check for own properties *before* calling the named getter.
-        if ($inlined) {
-            push(@getOwnPropertySlotImpl, &quot;    return ${namespaceMaybe}getStaticValueSlot&lt;$className, Base&gt;(exec, *info()-&gt;staticPropHashTable, thisObject, propertyName, slot);\n&quot;);
-        } else {
-            push(@getOwnPropertySlotImpl, &quot;    return ${namespaceMaybe}getStaticValueSlot&lt;$className, Base&gt;(exec, ${className}Table, thisObject, propertyName, slot);\n&quot;);
-        }
-    } else {
-        push(@getOwnPropertySlotImpl, &quot;    return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);\n&quot;);
</del><ins>+    if (!$hasNamedGetter || $interface-&gt;extendedAttributes-&gt;{&quot;OverrideBuiltins&quot;}) {
+        &amp;$ownPropertyCheck();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    push(@getOwnPropertySlotImpl, &quot;    return false;\n&quot;);
+
</ins><span class="cx">     return @getOwnPropertySlotImpl;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -578,13 +576,12 @@
</span><span class="cx">     my $namedGetterFunction = GetNamedGetterFunction($interface);
</span><span class="cx">     my $indexedGetterFunction = GetIndexedGetterFunction($interface);
</span><span class="cx"> 
</span><del>-    my $hasImpureNamedGetter = $namedGetterFunction
-        || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;};
</del><ins>+    my $hasNamedGetter = $namedGetterFunction || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;};
</ins><span class="cx"> 
</span><span class="cx">     my $hasComplexGetter = $indexedGetterFunction
</span><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;JSCustomGetOwnPropertySlotAndDescriptor&quot;}
</span><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;CustomGetOwnPropertySlot&quot;}
</span><del>-        || $hasImpureNamedGetter;
</del><ins>+        || $hasNamedGetter;
</ins><span class="cx"> 
</span><span class="cx">     return 1 if $interface-&gt;extendedAttributes-&gt;{&quot;CheckSecurity&quot;};
</span><span class="cx">     return 1 if IsDOMGlobalObject($interface);
</span><span class="lines">@@ -730,13 +727,13 @@
</span><span class="cx">     my $namedGetterFunction = GetNamedGetterFunction($interface);
</span><span class="cx">     my $indexedGetterFunction = GetIndexedGetterFunction($interface);
</span><span class="cx"> 
</span><del>-    my $hasImpureNamedGetter = $namedGetterFunction
</del><ins>+    my $hasNamedGetter = $namedGetterFunction
</ins><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;};
</span><span class="cx"> 
</span><span class="cx">     my $hasComplexGetter = $indexedGetterFunction
</span><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;JSCustomGetOwnPropertySlotAndDescriptor&quot;}
</span><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;CustomGetOwnPropertySlot&quot;}
</span><del>-        || $hasImpureNamedGetter;
</del><ins>+        || $hasNamedGetter;
</ins><span class="cx"> 
</span><span class="cx">     return $numInstanceAttributes &gt; 0 || $hasComplexGetter;
</span><span class="cx"> 
</span><span class="lines">@@ -915,14 +912,15 @@
</span><span class="cx">     my $namedGetterFunction = GetNamedGetterFunction($interface);
</span><span class="cx">     my $indexedGetterFunction = GetIndexedGetterFunction($interface);
</span><span class="cx"> 
</span><del>-    my $hasImpureNamedGetter = $namedGetterFunction
-        || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;};
</del><ins>+    my $hasImpureNamedGetter = $interface-&gt;extendedAttributes-&gt;{&quot;OverrideBuiltins&quot;}
+        &amp;&amp; ($namedGetterFunction || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;});
</ins><span class="cx"> 
</span><span class="cx">     my $hasComplexGetter =
</span><span class="cx">         $indexedGetterFunction
</span><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;JSCustomGetOwnPropertySlotAndDescriptor&quot;}
</span><span class="cx">         || $interface-&gt;extendedAttributes-&gt;{&quot;CustomGetOwnPropertySlot&quot;}
</span><del>-        || $hasImpureNamedGetter;
</del><ins>+        || $namedGetterFunction
+        || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;};
</ins><span class="cx">     
</span><span class="cx">     my $hasGetter = InstanceOverridesGetOwnPropertySlot($interface);
</span><span class="cx"> 
</span><span class="lines">@@ -2186,7 +2184,9 @@
</span><span class="cx"> 
</span><span class="cx">             if ($namedGetterFunction || $interface-&gt;extendedAttributes-&gt;{&quot;CustomNamedGetter&quot;}) {
</span><span class="cx">                 &amp;$propertyNameGeneration();
</span><del>-                push(@implContent, &quot;    if (canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {\n&quot;);
</del><ins>+
+                # The first condition is to make sure we use the subclass' named getter instead of the base class one when possible.
+                push(@implContent, &quot;    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {\n&quot;);
</ins><span class="cx">                 push(@implContent, &quot;        slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);\n&quot;);
</span><span class="cx">                 push(@implContent, &quot;        return true;\n&quot;);
</span><span class="cx">                 push(@implContent, &quot;    }\n&quot;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsIDLAttributestxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -99,6 +99,7 @@
</span><span class="cx"> ObjCProtocol
</span><span class="cx"> ObjCUseDefaultView
</span><span class="cx"> OperationsNotDeletable
</span><ins>+OverrideBuiltins
</ins><span class="cx"> PassContext
</span><span class="cx"> RaisesException
</span><span class="cx"> Reflect=*
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestGObjectWebKitDOMTestOverrideBuiltinscpp"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.cpp (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.cpp                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,116 @@
</span><ins>+/*
+ *  This file is part of the WebKit open source project.
+ *  This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;WebKitDOMTestOverrideBuiltins.h&quot;
+
+#include &quot;CSSImportRule.h&quot;
+#include &quot;DOMObjectCache.h&quot;
+#include &quot;Document.h&quot;
+#include &quot;ExceptionCode.h&quot;
+#include &quot;ExceptionCodeDescription.h&quot;
+#include &quot;JSMainThreadExecState.h&quot;
+#include &quot;WebKitDOMNodePrivate.h&quot;
+#include &quot;WebKitDOMPrivate.h&quot;
+#include &quot;WebKitDOMTestOverrideBuiltinsPrivate.h&quot;
+#include &quot;gobject/ConvertToUTF8String.h&quot;
+#include &lt;wtf/GetPtr.h&gt;
+#include &lt;wtf/RefPtr.h&gt;
+
+#define WEBKIT_DOM_TEST_OVERRIDE_BUILTINS_GET_PRIVATE(obj) G_TYPE_INSTANCE_GET_PRIVATE(obj, WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS, WebKitDOMTestOverrideBuiltinsPrivate)
+
+typedef struct _WebKitDOMTestOverrideBuiltinsPrivate {
+    RefPtr&lt;WebCore::TestOverrideBuiltins&gt; coreObject;
+} WebKitDOMTestOverrideBuiltinsPrivate;
+
+namespace WebKit {
+
+WebKitDOMTestOverrideBuiltins* kit(WebCore::TestOverrideBuiltins* obj)
+{
+    if (!obj)
+        return 0;
+
+    if (gpointer ret = DOMObjectCache::get(obj))
+        return WEBKIT_DOM_TEST_OVERRIDE_BUILTINS(ret);
+
+    return wrapTestOverrideBuiltins(obj);
+}
+
+WebCore::TestOverrideBuiltins* core(WebKitDOMTestOverrideBuiltins* request)
+{
+    return request ? static_cast&lt;WebCore::TestOverrideBuiltins*&gt;(WEBKIT_DOM_OBJECT(request)-&gt;coreObject) : 0;
+}
+
+WebKitDOMTestOverrideBuiltins* wrapTestOverrideBuiltins(WebCore::TestOverrideBuiltins* coreObject)
+{
+    ASSERT(coreObject);
+    return WEBKIT_DOM_TEST_OVERRIDE_BUILTINS(g_object_new(WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS, &quot;core-object&quot;, coreObject, nullptr));
+}
+
+} // namespace WebKit
+
+G_DEFINE_TYPE(WebKitDOMTestOverrideBuiltins, webkit_dom_test_override_builtins, WEBKIT_DOM_TYPE_OBJECT)
+
+static void webkit_dom_test_override_builtins_finalize(GObject* object)
+{
+    WebKitDOMTestOverrideBuiltinsPrivate* priv = WEBKIT_DOM_TEST_OVERRIDE_BUILTINS_GET_PRIVATE(object);
+
+    WebKit::DOMObjectCache::forget(priv-&gt;coreObject.get());
+
+    priv-&gt;~WebKitDOMTestOverrideBuiltinsPrivate();
+    G_OBJECT_CLASS(webkit_dom_test_override_builtins_parent_class)-&gt;finalize(object);
+}
+
+static GObject* webkit_dom_test_override_builtins_constructor(GType type, guint constructPropertiesCount, GObjectConstructParam* constructProperties)
+{
+    GObject* object = G_OBJECT_CLASS(webkit_dom_test_override_builtins_parent_class)-&gt;constructor(type, constructPropertiesCount, constructProperties);
+
+    WebKitDOMTestOverrideBuiltinsPrivate* priv = WEBKIT_DOM_TEST_OVERRIDE_BUILTINS_GET_PRIVATE(object);
+    priv-&gt;coreObject = static_cast&lt;WebCore::TestOverrideBuiltins*&gt;(WEBKIT_DOM_OBJECT(object)-&gt;coreObject);
+    WebKit::DOMObjectCache::put(priv-&gt;coreObject.get(), object);
+
+    return object;
+}
+
+static void webkit_dom_test_override_builtins_class_init(WebKitDOMTestOverrideBuiltinsClass* requestClass)
+{
+    GObjectClass* gobjectClass = G_OBJECT_CLASS(requestClass);
+    g_type_class_add_private(gobjectClass, sizeof(WebKitDOMTestOverrideBuiltinsPrivate));
+    gobjectClass-&gt;constructor = webkit_dom_test_override_builtins_constructor;
+    gobjectClass-&gt;finalize = webkit_dom_test_override_builtins_finalize;
+}
+
+static void webkit_dom_test_override_builtins_init(WebKitDOMTestOverrideBuiltins* request)
+{
+    WebKitDOMTestOverrideBuiltinsPrivate* priv = WEBKIT_DOM_TEST_OVERRIDE_BUILTINS_GET_PRIVATE(request);
+    new (priv) WebKitDOMTestOverrideBuiltinsPrivate();
+}
+
+WebKitDOMNode* webkit_dom_test_override_builtins_named_item(WebKitDOMTestOverrideBuiltins* self, const gchar* name)
+{
+    WebCore::JSMainThreadNullState state;
+    g_return_val_if_fail(WEBKIT_DOM_IS_TEST_OVERRIDE_BUILTINS(self), 0);
+    g_return_val_if_fail(name, 0);
+    WebCore::TestOverrideBuiltins* item = WebKit::core(self);
+    WTF::String convertedName = WTF::String::fromUTF8(name);
+    RefPtr&lt;WebCore::Node&gt; gobjectResult = WTF::getPtr(item-&gt;namedItem(convertedName));
+    return WebKit::kit(gobjectResult.get());
+}
+
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestGObjectWebKitDOMTestOverrideBuiltinsh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.h (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.h                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltins.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,65 @@
</span><ins>+/*
+ *  This file is part of the WebKit open source project.
+ *  This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitDOMTestOverrideBuiltins_h
+#define WebKitDOMTestOverrideBuiltins_h
+
+#ifdef WEBKIT_DOM_USE_UNSTABLE_API
+
+#include &lt;glib-object.h&gt;
+#include &lt;webkitdom/WebKitDOMObject.h&gt;
+#include &lt;webkitdom/webkitdomdefines-unstable.h&gt;
+
+G_BEGIN_DECLS
+
+#define WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS            (webkit_dom_test_override_builtins_get_type())
+#define WEBKIT_DOM_TEST_OVERRIDE_BUILTINS(obj)            (G_TYPE_CHECK_INSTANCE_CAST((obj), WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS, WebKitDOMTestOverrideBuiltins))
+#define WEBKIT_DOM_TEST_OVERRIDE_BUILTINS_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST((klass),  WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS, WebKitDOMTestOverrideBuiltinsClass)
+#define WEBKIT_DOM_IS_TEST_OVERRIDE_BUILTINS(obj)         (G_TYPE_CHECK_INSTANCE_TYPE((obj), WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS))
+#define WEBKIT_DOM_IS_TEST_OVERRIDE_BUILTINS_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE((klass),  WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS))
+#define WEBKIT_DOM_TEST_OVERRIDE_BUILTINS_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS((obj),  WEBKIT_DOM_TYPE_TEST_OVERRIDE_BUILTINS, WebKitDOMTestOverrideBuiltinsClass))
+
+struct _WebKitDOMTestOverrideBuiltins {
+    WebKitDOMObject parent_instance;
+};
+
+struct _WebKitDOMTestOverrideBuiltinsClass {
+    WebKitDOMObjectClass parent_class;
+};
+
+WEBKIT_API GType
+webkit_dom_test_override_builtins_get_type(void);
+
+/**
+ * webkit_dom_test_override_builtins_named_item:
+ * @self: A #WebKitDOMTestOverrideBuiltins
+ * @name: A #gchar
+ *
+ * Returns: (transfer none): A #WebKitDOMNode
+ *
+ * Stability: Unstable
+**/
+WEBKIT_API WebKitDOMNode*
+webkit_dom_test_override_builtins_named_item(WebKitDOMTestOverrideBuiltins* self, const gchar* name);
+
+G_END_DECLS
+
+#endif /* WEBKIT_DOM_USE_UNSTABLE_API */
+#endif /* WebKitDOMTestOverrideBuiltins_h */
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestGObjectWebKitDOMTestOverrideBuiltinsPrivateh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltinsPrivate.h (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltinsPrivate.h                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestOverrideBuiltinsPrivate.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,33 @@
</span><ins>+/*
+ *  This file is part of the WebKit open source project.
+ *  This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WebKitDOMTestOverrideBuiltinsPrivate_h
+#define WebKitDOMTestOverrideBuiltinsPrivate_h
+
+#include &quot;TestOverrideBuiltins.h&quot;
+#include &lt;webkitdom/WebKitDOMTestOverrideBuiltins.h&gt;
+
+namespace WebKit {
+WebKitDOMTestOverrideBuiltins* wrapTestOverrideBuiltins(WebCore::TestOverrideBuiltins*);
+WebKitDOMTestOverrideBuiltins* kit(WebCore::TestOverrideBuiltins*);
+WebCore::TestOverrideBuiltins* core(WebKitDOMTestOverrideBuiltins*);
+} // namespace WebKit
+
+#endif /* WebKitDOMTestOverrideBuiltinsPrivate_h */
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -170,7 +170,9 @@
</span><span class="cx"> {
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestActiveDOMObject*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><del>-    return getStaticValueSlot&lt;JSTestActiveDOMObject, Base&gt;(exec, JSTestActiveDOMObjectTable, thisObject, propertyName, slot);
</del><ins>+    if (getStaticValueSlot&lt;JSTestActiveDOMObject, Base&gt;(exec, JSTestActiveDOMObjectTable, thisObject, propertyName, slot))
+        return true;
+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestActiveDOMObjectExcitingAttr(ExecState* exec, JSObject* slotBase, EncodedJSValue thisValue, PropertyName)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -164,11 +164,17 @@
</span><span class="cx"> {
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestCustomNamedGetter*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><del>-    if (canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</del><ins>+    if (getStaticValueSlot&lt;JSTestCustomNamedGetter, Base&gt;(exec, JSTestCustomNamedGetterTable, thisObject, propertyName, slot))
+        return true;
+    JSValue proto = thisObject-&gt;prototype();
+    if (proto.isObject() &amp;&amp; jsCast&lt;JSObject*&gt;(proto)-&gt;hasProperty(exec, propertyName))
+        return false;
+
+    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</ins><span class="cx">         slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    return getStaticValueSlot&lt;JSTestCustomNamedGetter, Base&gt;(exec, JSTestCustomNamedGetterTable, thisObject, propertyName, slot);
</del><ins>+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSTestCustomNamedGetter::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned index, PropertySlot&amp; slot)
</span><span class="lines">@@ -176,7 +182,7 @@
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestCustomNamedGetter*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     Identifier propertyName = Identifier::from(exec, index);
</span><del>-    if (canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</del><ins>+    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</ins><span class="cx">         slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx"> private:
</span><span class="cx">     TestCustomNamedGetter* m_impl;
</span><span class="cx"> public:
</span><del>-    static const unsigned StructureFlags = JSC::HasImpureGetOwnPropertySlot | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
</ins><span class="cx"> protected:
</span><span class="cx">     JSTestCustomNamedGetter(JSC::Structure*, JSDOMGlobalObject*, Ref&lt;TestCustomNamedGetter&gt;&amp;&amp;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -183,16 +183,17 @@
</span><span class="cx">         slot.setValue(thisObject, attributes, toJS(exec, thisObject-&gt;globalObject(), thisObject-&gt;impl().item(index)));
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    const HashTableValue* entry = getStaticValueSlotEntryWithoutCaching&lt;JSTestEventTarget&gt;(exec, propertyName);
-    if (entry) {
-        slot.setCacheableCustom(thisObject, entry-&gt;attributes(), entry-&gt;propertyGetter());
</del><ins>+    if (getStaticValueSlot&lt;JSTestEventTarget, Base&gt;(exec, JSTestEventTargetTable, thisObject, propertyName, slot))
</ins><span class="cx">         return true;
</span><del>-    }
-    if (canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</del><ins>+    JSValue proto = thisObject-&gt;prototype();
+    if (proto.isObject() &amp;&amp; jsCast&lt;JSObject*&gt;(proto)-&gt;hasProperty(exec, propertyName))
+        return false;
+
+    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</ins><span class="cx">         slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-    return getStaticValueSlot&lt;JSTestEventTarget, Base&gt;(exec, JSTestEventTargetTable, thisObject, propertyName, slot);
</del><ins>+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSTestEventTarget::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned index, PropertySlot&amp; slot)
</span><span class="lines">@@ -205,7 +206,7 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx">     Identifier propertyName = Identifier::from(exec, index);
</span><del>-    if (canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</del><ins>+    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
</ins><span class="cx">         slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);
</span><span class="cx">         return true;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -63,7 +63,7 @@
</span><span class="cx"> private:
</span><span class="cx">     TestEventTarget* m_impl;
</span><span class="cx"> public:
</span><del>-    static const unsigned StructureFlags = JSC::HasImpureGetOwnPropertySlot | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::MasqueradesAsUndefined | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::MasqueradesAsUndefined | JSC::OverridesGetOwnPropertySlot | JSC::OverridesGetPropertyNames | Base::StructureFlags;
</ins><span class="cx"> protected:
</span><span class="cx">     JSTestEventTarget(JSC::Structure*, JSDOMGlobalObject*, Ref&lt;TestEventTarget&gt;&amp;&amp;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -160,7 +160,9 @@
</span><span class="cx"> {
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestException*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><del>-    return getStaticValueSlot&lt;JSTestException, Base&gt;(exec, JSTestExceptionTable, thisObject, propertyName, slot);
</del><ins>+    if (getStaticValueSlot&lt;JSTestException, Base&gt;(exec, JSTestExceptionTable, thisObject, propertyName, slot))
+        return true;
+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestExceptionName(ExecState* exec, JSObject* slotBase, EncodedJSValue thisValue, PropertyName)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -441,7 +441,9 @@
</span><span class="cx"> {
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestInterface*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><del>-    return getStaticValueSlot&lt;JSTestInterface, Base&gt;(exec, JSTestInterfaceTable, thisObject, propertyName, slot);
</del><ins>+    if (getStaticValueSlot&lt;JSTestInterface, Base&gt;(exec, JSTestInterfaceTable, thisObject, propertyName, slot))
+        return true;
+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -703,7 +703,9 @@
</span><span class="cx"> {
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestObj*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><del>-    return getStaticValueSlot&lt;JSTestObj, Base&gt;(exec, JSTestObjTable, thisObject, propertyName, slot);
</del><ins>+    if (getStaticValueSlot&lt;JSTestObj, Base&gt;(exec, JSTestObjTable, thisObject, propertyName, slot))
+        return true;
+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReadOnlyLongAttr(ExecState* exec, JSObject* slotBase, EncodedJSValue thisValue, PropertyName)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,275 @@
</span><ins>+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include &quot;config.h&quot;
+#include &quot;JSTestOverrideBuiltins.h&quot;
+
+#include &quot;ExceptionCode.h&quot;
+#include &quot;JSDOMBinding.h&quot;
+#include &quot;JSNode.h&quot;
+#include &quot;Node.h&quot;
+#include &quot;TestOverrideBuiltins.h&quot;
+#include &quot;wtf/text/AtomicString.h&quot;
+#include &lt;runtime/Error.h&gt;
+#include &lt;wtf/GetPtr.h&gt;
+
+using namespace JSC;
+
+namespace WebCore {
+
+// Functions
+
+JSC::EncodedJSValue JSC_HOST_CALL jsTestOverrideBuiltinsPrototypeFunctionNamedItem(JSC::ExecState*);
+
+// Attributes
+
+JSC::EncodedJSValue jsTestOverrideBuiltinsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::EncodedJSValue, JSC::PropertyName);
+
+class JSTestOverrideBuiltinsPrototype : public JSC::JSNonFinalObject {
+public:
+    typedef JSC::JSNonFinalObject Base;
+    static JSTestOverrideBuiltinsPrototype* create(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
+    {
+        JSTestOverrideBuiltinsPrototype* ptr = new (NotNull, JSC::allocateCell&lt;JSTestOverrideBuiltinsPrototype&gt;(vm.heap)) JSTestOverrideBuiltinsPrototype(vm, globalObject, structure);
+        ptr-&gt;finishCreation(vm);
+        return ptr;
+    }
+
+    DECLARE_INFO;
+    static JSC::Structure* createStructure(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+private:
+    JSTestOverrideBuiltinsPrototype(JSC::VM&amp; vm, JSC::JSGlobalObject*, JSC::Structure* structure)
+        : JSC::JSNonFinalObject(vm, structure)
+    {
+    }
+
+    void finishCreation(JSC::VM&amp;);
+};
+
+class JSTestOverrideBuiltinsConstructor : public DOMConstructorObject {
+private:
+    JSTestOverrideBuiltinsConstructor(JSC::Structure*, JSDOMGlobalObject*);
+    void finishCreation(JSC::VM&amp;, JSDOMGlobalObject*);
+
+public:
+    typedef DOMConstructorObject Base;
+    static JSTestOverrideBuiltinsConstructor* create(JSC::VM&amp; vm, JSC::Structure* structure, JSDOMGlobalObject* globalObject)
+    {
+        JSTestOverrideBuiltinsConstructor* ptr = new (NotNull, JSC::allocateCell&lt;JSTestOverrideBuiltinsConstructor&gt;(vm.heap)) JSTestOverrideBuiltinsConstructor(structure, globalObject);
+        ptr-&gt;finishCreation(vm, globalObject);
+        return ptr;
+    }
+
+    DECLARE_INFO;
+    static JSC::Structure* createStructure(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+};
+
+/* Hash table */
+
+static const struct CompactHashIndex JSTestOverrideBuiltinsTableIndex[2] = {
+    { -1, -1 },
+    { 0, -1 },
+};
+
+
+static const HashTableValue JSTestOverrideBuiltinsTableValues[] =
+{
+    { &quot;constructor&quot;, DontEnum | ReadOnly, NoIntrinsic, (intptr_t)static_cast&lt;PropertySlot::GetValueFunc&gt;(jsTestOverrideBuiltinsConstructor), (intptr_t) static_cast&lt;PutPropertySlot::PutValueFunc&gt;(0) },
+};
+
+static const HashTable JSTestOverrideBuiltinsTable = { 1, 1, true, JSTestOverrideBuiltinsTableValues, 0, JSTestOverrideBuiltinsTableIndex };
+const ClassInfo JSTestOverrideBuiltinsConstructor::s_info = { &quot;TestOverrideBuiltinsConstructor&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSTestOverrideBuiltinsConstructor) };
+
+JSTestOverrideBuiltinsConstructor::JSTestOverrideBuiltinsConstructor(Structure* structure, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(structure, globalObject)
+{
+}
+
+void JSTestOverrideBuiltinsConstructor::finishCreation(VM&amp; vm, JSDOMGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestOverrideBuiltins::getPrototype(vm, globalObject), DontDelete | ReadOnly | DontEnum);
+    putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestOverrideBuiltins&quot;))), ReadOnly | DontEnum);
+    putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSTestOverrideBuiltinsPrototypeTableValues[] =
+{
+    { &quot;namedItem&quot;, JSC::Function, NoIntrinsic, (intptr_t)static_cast&lt;NativeFunction&gt;(jsTestOverrideBuiltinsPrototypeFunctionNamedItem), (intptr_t) (0) },
+};
+
+const ClassInfo JSTestOverrideBuiltinsPrototype::s_info = { &quot;TestOverrideBuiltinsPrototype&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSTestOverrideBuiltinsPrototype) };
+
+void JSTestOverrideBuiltinsPrototype::finishCreation(VM&amp; vm)
+{
+    Base::finishCreation(vm);
+    reifyStaticProperties(vm, JSTestOverrideBuiltinsPrototypeTableValues, *this);
+}
+
+const ClassInfo JSTestOverrideBuiltins::s_info = { &quot;TestOverrideBuiltins&quot;, &amp;Base::s_info, &amp;JSTestOverrideBuiltinsTable, CREATE_METHOD_TABLE(JSTestOverrideBuiltins) };
+
+JSTestOverrideBuiltins::JSTestOverrideBuiltins(Structure* structure, JSDOMGlobalObject* globalObject, Ref&lt;TestOverrideBuiltins&gt;&amp;&amp; impl)
+    : JSDOMWrapper(structure, globalObject)
+    , m_impl(&amp;impl.leakRef())
+{
+}
+
+JSObject* JSTestOverrideBuiltins::createPrototype(VM&amp; vm, JSGlobalObject* globalObject)
+{
+    return JSTestOverrideBuiltinsPrototype::create(vm, globalObject, JSTestOverrideBuiltinsPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
+}
+
+JSObject* JSTestOverrideBuiltins::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype&lt;JSTestOverrideBuiltins&gt;(vm, globalObject);
+}
+
+void JSTestOverrideBuiltins::destroy(JSC::JSCell* cell)
+{
+    JSTestOverrideBuiltins* thisObject = static_cast&lt;JSTestOverrideBuiltins*&gt;(cell);
+    thisObject-&gt;JSTestOverrideBuiltins::~JSTestOverrideBuiltins();
+}
+
+JSTestOverrideBuiltins::~JSTestOverrideBuiltins()
+{
+    releaseImpl();
+}
+
+bool JSTestOverrideBuiltins::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
+{
+    auto* thisObject = jsCast&lt;JSTestOverrideBuiltins*&gt;(object);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
+        slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);
+        return true;
+    }
+    if (getStaticValueSlot&lt;JSTestOverrideBuiltins, Base&gt;(exec, JSTestOverrideBuiltinsTable, thisObject, propertyName, slot))
+        return true;
+    return false;
+}
+
+bool JSTestOverrideBuiltins::getOwnPropertySlotByIndex(JSObject* object, ExecState* exec, unsigned index, PropertySlot&amp; slot)
+{
+    auto* thisObject = jsCast&lt;JSTestOverrideBuiltins*&gt;(object);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Identifier propertyName = Identifier::from(exec, index);
+    if (thisObject-&gt;classInfo() == info() &amp;&amp; canGetItemsForName(exec, &amp;thisObject-&gt;impl(), propertyName)) {
+        slot.setCustom(thisObject, ReadOnly | DontDelete | DontEnum, thisObject-&gt;nameGetter);
+        return true;
+    }
+    return Base::getOwnPropertySlotByIndex(thisObject, exec, index, slot);
+}
+
+EncodedJSValue jsTestOverrideBuiltinsConstructor(ExecState* exec, JSObject*, EncodedJSValue thisValue, PropertyName)
+{
+    JSTestOverrideBuiltins* domObject = jsDynamicCast&lt;JSTestOverrideBuiltins*&gt;(JSValue::decode(thisValue));
+    if (!domObject)
+        return throwVMTypeError(exec);
+    return JSValue::encode(JSTestOverrideBuiltins::getConstructor(exec-&gt;vm(), domObject-&gt;globalObject()));
+}
+
+JSValue JSTestOverrideBuiltins::getConstructor(VM&amp; vm, JSGlobalObject* globalObject)
+{
+    return getDOMConstructor&lt;JSTestOverrideBuiltinsConstructor&gt;(vm, jsCast&lt;JSDOMGlobalObject*&gt;(globalObject));
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestOverrideBuiltinsPrototypeFunctionNamedItem(ExecState* exec)
+{
+    JSValue thisValue = exec-&gt;thisValue();
+    JSTestOverrideBuiltins* castedThis = jsDynamicCast&lt;JSTestOverrideBuiltins*&gt;(thisValue);
+    if (UNLIKELY(!castedThis))
+        return throwThisTypeError(*exec, &quot;TestOverrideBuiltins&quot;, &quot;namedItem&quot;);
+    ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestOverrideBuiltins::info());
+    auto&amp; impl = castedThis-&gt;impl();
+    String name = exec-&gt;argument(0).toString(exec)-&gt;value(exec);
+    if (UNLIKELY(exec-&gt;hadException()))
+        return JSValue::encode(jsUndefined());
+    JSValue result = toJS(exec, castedThis-&gt;globalObject(), WTF::getPtr(impl.namedItem(name)));
+    return JSValue::encode(result);
+}
+
+bool JSTestOverrideBuiltinsOwner::isReachableFromOpaqueRoots(JSC::Handle&lt;JSC::Unknown&gt; handle, void*, SlotVisitor&amp; visitor)
+{
+    UNUSED_PARAM(handle);
+    UNUSED_PARAM(visitor);
+    return false;
+}
+
+void JSTestOverrideBuiltinsOwner::finalize(JSC::Handle&lt;JSC::Unknown&gt; handle, void* context)
+{
+    auto* jsTestOverrideBuiltins = jsCast&lt;JSTestOverrideBuiltins*&gt;(handle.slot()-&gt;asCell());
+    auto&amp; world = *static_cast&lt;DOMWrapperWorld*&gt;(context);
+    uncacheWrapper(world, &amp;jsTestOverrideBuiltins-&gt;impl(), jsTestOverrideBuiltins);
+}
+
+#if ENABLE(BINDING_INTEGRITY)
+#if PLATFORM(WIN)
+#pragma warning(disable: 4483)
+extern &quot;C&quot; { extern void (*const __identifier(&quot;??_7TestOverrideBuiltins@WebCore@@6B@&quot;)[])(); }
+#else
+extern &quot;C&quot; { extern void* _ZTVN7WebCore20TestOverrideBuiltinsE[]; }
+#endif
+#endif
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject* globalObject, TestOverrideBuiltins* impl)
+{
+    if (!impl)
+        return jsNull();
+    if (JSValue result = getExistingWrapper&lt;JSTestOverrideBuiltins&gt;(globalObject, impl))
+        return result;
+
+#if ENABLE(BINDING_INTEGRITY)
+    void* actualVTablePointer = *(reinterpret_cast&lt;void**&gt;(impl));
+#if PLATFORM(WIN)
+    void* expectedVTablePointer = reinterpret_cast&lt;void*&gt;(__identifier(&quot;??_7TestOverrideBuiltins@WebCore@@6B@&quot;));
+#else
+    void* expectedVTablePointer = &amp;_ZTVN7WebCore20TestOverrideBuiltinsE[2];
+#if COMPILER(CLANG)
+    // If this fails TestOverrideBuiltins does not have a vtable, so you need to add the
+    // ImplementationLacksVTable attribute to the interface definition
+    COMPILE_ASSERT(__is_polymorphic(TestOverrideBuiltins), TestOverrideBuiltins_is_not_polymorphic);
+#endif
+#endif
+    // If you hit this assertion you either have a use after free bug, or
+    // TestOverrideBuiltins has subclasses. If TestOverrideBuiltins has subclasses that get passed
+    // to toJS() we currently require TestOverrideBuiltins you to opt out of binding hardening
+    // by adding the SkipVTableValidation attribute to the interface IDL definition
+    RELEASE_ASSERT(actualVTablePointer == expectedVTablePointer);
+#endif
+    return createNewWrapper&lt;JSTestOverrideBuiltins&gt;(globalObject, impl);
+}
+
+TestOverrideBuiltins* JSTestOverrideBuiltins::toWrapped(JSC::JSValue value)
+{
+    if (auto* wrapper = jsDynamicCast&lt;JSTestOverrideBuiltins*&gt;(value))
+        return &amp;wrapper-&gt;impl();
+    return nullptr;
+}
+
+}
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinshfromrev188589trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh"></a>
<div class="copfile"><h4>Copied: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h (from rev 188589, trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h) (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,95 @@
</span><ins>+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSTestOverrideBuiltins_h
+#define JSTestOverrideBuiltins_h
+
+#include &quot;JSDOMWrapper.h&quot;
+#include &quot;TestOverrideBuiltins.h&quot;
+#include &lt;wtf/NeverDestroyed.h&gt;
+
+namespace WebCore {
+
+class JSTestOverrideBuiltins : public JSDOMWrapper {
+public:
+    typedef JSDOMWrapper Base;
+    static JSTestOverrideBuiltins* create(JSC::Structure* structure, JSDOMGlobalObject* globalObject, Ref&lt;TestOverrideBuiltins&gt;&amp;&amp; impl)
+    {
+        JSTestOverrideBuiltins* ptr = new (NotNull, JSC::allocateCell&lt;JSTestOverrideBuiltins&gt;(globalObject-&gt;vm().heap)) JSTestOverrideBuiltins(structure, globalObject, WTF::move(impl));
+        ptr-&gt;finishCreation(globalObject-&gt;vm());
+        return ptr;
+    }
+
+    static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
+    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
+    static TestOverrideBuiltins* toWrapped(JSC::JSValue);
+    static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
+    static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);
+    static void destroy(JSC::JSCell*);
+    ~JSTestOverrideBuiltins();
+
+    DECLARE_INFO;
+
+    static JSC::Structure* createStructure(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+    static JSC::JSValue getConstructor(JSC::VM&amp;, JSC::JSGlobalObject*);
+    TestOverrideBuiltins&amp; impl() const { return *m_impl; }
+    void releaseImpl() { std::exchange(m_impl, nullptr)-&gt;deref(); }
+
+private:
+    TestOverrideBuiltins* m_impl;
+public:
+    static const unsigned StructureFlags = JSC::HasImpureGetOwnPropertySlot | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+protected:
+    JSTestOverrideBuiltins(JSC::Structure*, JSDOMGlobalObject*, Ref&lt;TestOverrideBuiltins&gt;&amp;&amp;);
+
+    void finishCreation(JSC::VM&amp; vm)
+    {
+        Base::finishCreation(vm);
+        ASSERT(inherits(info()));
+    }
+
+private:
+    static bool canGetItemsForName(JSC::ExecState*, TestOverrideBuiltins*, JSC::PropertyName);
+    static JSC::EncodedJSValue nameGetter(JSC::ExecState*, JSC::JSObject*, JSC::EncodedJSValue, JSC::PropertyName);
+};
+
+class JSTestOverrideBuiltinsOwner : public JSC::WeakHandleOwner {
+public:
+    virtual bool isReachableFromOpaqueRoots(JSC::Handle&lt;JSC::Unknown&gt;, void* context, JSC::SlotVisitor&amp;);
+    virtual void finalize(JSC::Handle&lt;JSC::Unknown&gt;, void* context);
+};
+
+inline JSC::WeakHandleOwner* wrapperOwner(DOMWrapperWorld&amp;, TestOverrideBuiltins*)
+{
+    static NeverDestroyed&lt;JSTestOverrideBuiltinsOwner&gt; owner;
+    return &amp;owner.get();
+}
+
+JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TestOverrideBuiltins*);
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TestOverrideBuiltins&amp; impl) { return toJS(exec, globalObject, &amp;impl); }
+
+
+} // namespace WebCore
+
+#endif
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -245,7 +245,9 @@
</span><span class="cx"> {
</span><span class="cx">     auto* thisObject = jsCast&lt;JSTestTypedefs*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><del>-    return getStaticValueSlot&lt;JSTestTypedefs, Base&gt;(exec, JSTestTypedefsTable, thisObject, propertyName, slot);
</del><ins>+    if (getStaticValueSlot&lt;JSTestTypedefs, Base&gt;(exec, JSTestTypedefsTable, thisObject, propertyName, slot))
+        return true;
+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsUnsignedLongLongAttr(ExecState* exec, JSObject* slotBase, EncodedJSValue thisValue, PropertyName)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestObjCDOMTestOverrideBuiltinsh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.h (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.h                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,35 @@
</span><ins>+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Samuel Weinig &lt;sam.weinig@gmail.com&gt;
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import &lt;WebCore/DOMObject.h&gt;
+
+@class DOMNode;
+@class NSString;
+
+WEBKIT_CLASS_AVAILABLE_MAC(9876_5)
+WEBCORE_EXPORT @interface DOMTestOverrideBuiltins : DOMObject
+- (DOMNode *)namedItem:(NSString *)name;
+@end
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestObjCDOMTestOverrideBuiltinsmm"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltins.mm        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,90 @@
</span><ins>+/*
+ * This file is part of the WebKit open source project.
+ * This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import &quot;config.h&quot;
+#import &quot;DOMInternal.h&quot;
+
+#import &quot;DOMTestOverrideBuiltins.h&quot;
+
+#import &quot;DOMNodeInternal.h&quot;
+#import &quot;DOMTestOverrideBuiltinsInternal.h&quot;
+#import &quot;ExceptionHandlers.h&quot;
+#import &quot;JSMainThreadExecState.h&quot;
+#import &quot;Node.h&quot;
+#import &quot;TestOverrideBuiltins.h&quot;
+#import &quot;ThreadCheck.h&quot;
+#import &quot;URL.h&quot;
+#import &quot;WebCoreObjCExtras.h&quot;
+#import &quot;WebScriptObjectPrivate.h&quot;
+#import &lt;wtf/GetPtr.h&gt;
+
+#define IMPL reinterpret_cast&lt;WebCore::TestOverrideBuiltins*&gt;(_internal)
+
+@implementation DOMTestOverrideBuiltins
+
+- (void)dealloc
+{
+    if (WebCoreObjCScheduleDeallocateOnMainThread([DOMTestOverrideBuiltins class], self))
+        return;
+
+    if (_internal)
+        IMPL-&gt;deref();
+    [super dealloc];
+}
+
+- (void)finalize
+{
+    if (_internal)
+        IMPL-&gt;deref();
+    [super finalize];
+}
+
+- (DOMNode *)namedItem:(NSString *)name
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL-&gt;namedItem(name)));
+}
+
+@end
+
+WebCore::TestOverrideBuiltins* core(DOMTestOverrideBuiltins *wrapper)
+{
+    return wrapper ? reinterpret_cast&lt;WebCore::TestOverrideBuiltins*&gt;(wrapper-&gt;_internal) : 0;
+}
+
+DOMTestOverrideBuiltins *kit(WebCore::TestOverrideBuiltins* value)
+{
+    WebCoreThreadViolationCheckRoundOne();
+    if (!value)
+        return nil;
+    if (DOMTestOverrideBuiltins *wrapper = getDOMWrapper(value))
+        return [[wrapper retain] autorelease];
+    DOMTestOverrideBuiltins *wrapper = [[DOMTestOverrideBuiltins alloc] _init];
+    wrapper-&gt;_internal = reinterpret_cast&lt;DOMObjectInternal*&gt;(value);
+    value-&gt;ref();
+    addDOMWrapper(wrapper, value);
+    return [wrapper autorelease];
+}
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestObjCDOMTestOverrideBuiltinsInternalh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltinsInternal.h (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltinsInternal.h                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/ObjC/DOMTestOverrideBuiltinsInternal.h        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,34 @@
</span><ins>+/*
+ * This file is part of the WebKit open source project.
+ * This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import &lt;WebCore/DOMTestOverrideBuiltins.h&gt;
+
+namespace WebCore {
+class TestOverrideBuiltins;
+}
+
+WEBCORE_EXPORT WebCore::TestOverrideBuiltins* core(DOMTestOverrideBuiltins *);
+WEBCORE_EXPORT DOMTestOverrideBuiltins *kit(WebCore::TestOverrideBuiltins*);
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestTestOverrideBuiltinsidl"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/scripts/test/TestOverrideBuiltins.idl (0 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/TestOverrideBuiltins.idl                                (rev 0)
+++ trunk/Source/WebCore/bindings/scripts/test/TestOverrideBuiltins.idl        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -0,0 +1,6 @@
</span><ins>+[
+    OverrideBuiltins
+] interface TestOverrideBuiltins
+{
+    getter Node namedItem([Default=Undefined] optional DOMString name);
+};
</ins></span></pre></div>
<a id="trunkSourceWebCoredomDOMStringMapidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DOMStringMap.idl (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DOMStringMap.idl        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/dom/DOMStringMap.idl        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -29,6 +29,7 @@
</span><span class="cx">     CustomEnumerateProperty,
</span><span class="cx">     CustomNamedSetter,
</span><span class="cx">     JSCustomGetOwnPropertySlotAndDescriptor,
</span><ins>+    OverrideBuiltins,
</ins><span class="cx">     SkipVTableValidation,
</span><span class="cx"> ] interface DOMStringMap {
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCoredomNodeListidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/NodeList.idl (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/NodeList.idl        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/dom/NodeList.idl        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -20,8 +20,8 @@
</span><span class="cx"> 
</span><span class="cx"> [
</span><span class="cx">     CustomIsReachable,
</span><ins>+    CustomNamedGetter,
</ins><span class="cx">     CustomToJSObject,
</span><del>-    JSCustomGetOwnPropertySlotAndDescriptor,
</del><span class="cx">     JSCustomHeader,
</span><span class="cx">     SkipVTableValidation,
</span><span class="cx">     ReportExtraMemoryCost,
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLDocumentidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLDocument.idl (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLDocument.idl        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/html/HTMLDocument.idl        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -22,6 +22,7 @@
</span><span class="cx">     CustomGetOwnPropertySlot,
</span><span class="cx">     CustomNamedGetter,
</span><span class="cx">     NewImpurePropertyFiresWatchpoints,
</span><ins>+    OverrideBuiltins,
</ins><span class="cx"> ] interface HTMLDocument : Document {
</span><span class="cx">     [Custom, ForwardDeclareInHeader] void open();
</span><span class="cx">     void close();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLFormElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLFormElement.idl (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLFormElement.idl        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/html/HTMLFormElement.idl        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -20,6 +20,7 @@
</span><span class="cx"> 
</span><span class="cx"> [
</span><span class="cx">     CustomNamedGetter,
</span><ins>+    OverrideBuiltins,
</ins><span class="cx"> ] interface HTMLFormElement : HTMLElement {
</span><span class="cx">     [Reflect=accept_charset] attribute DOMString acceptCharset;
</span><span class="cx">     [Reflect, URL] attribute DOMString action;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLOptionsCollectionidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLOptionsCollection.idl (188589 => 188590)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLOptionsCollection.idl        2015-08-18 19:09:12 UTC (rev 188589)
+++ trunk/Source/WebCore/html/HTMLOptionsCollection.idl        2015-08-18 19:15:44 UTC (rev 188590)
</span><span class="lines">@@ -26,7 +26,7 @@
</span><span class="cx">     attribute long selectedIndex;
</span><span class="cx">     [CustomSetter, SetterRaisesException] attribute unsigned long length;
</span><span class="cx"> 
</span><del>-    Node namedItem([Default=Undefined] optional DOMString name);
</del><ins>+    getter Node namedItem([Default=Undefined] optional DOMString name);
</ins><span class="cx"> 
</span><span class="cx"> #if (!defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C) &amp;&amp; (!defined(LANGUAGE_GOBJECT) || !LANGUAGE_GOBJECT)
</span><span class="cx">     [RaisesException] void add(HTMLElement element, [Default=Undefined] optional HTMLElement? before);
</span></span></pre>
</div>
</div>

</body>
</html>