<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[196145] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/196145">196145</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-02-04 13:36:04 -0800 (Thu, 04 Feb 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
https://bugs.webkit.org/show_bug.cgi?id=153817

Reviewed by Geoffrey Garen.

LayoutTests/imported/w3c:

Rebaseline W3C HTML test now that more checks are passing. Some checks are still
failing because getter.call(undefined) / getter.call() currently throws an exception
for Window properties but shouldn't. Global object property getters should not require
an explicit |this|.

* web-platform-tests/html/dom/interfaces-expected.txt:

Source/JavaScriptCore:

Extend support for Object.getOwnPropertyDescriptor() on native bindings
to instance properties (e.g. Unforgeable properties or Global object
properties) so that the returned descriptor has getter / setter
functions, as expected.

* runtime/JSObject.cpp:
(JSC::JSObject::reifyAllStaticProperties):
Add method that reifies all static properties, including the custom
accessors. This is similar to what is done eagerly on the prototype
objects in the bindings code.

(JSC::JSObject::getOwnPropertyDescriptor):
getOwnPropertyDescriptor() would previously fails for custom accessors
that are on the instance because getDirect() does not check the static
property table and those custom accessors were not reified (We only
reified all properties eagerly - including custom accessors - on
prototype objects. To address this issue, we now call
reifyAllStaticProperties() if the call to getDirect() fails and then
call getDirect() again. This fix is however insufficient for Window
properties because |this| is a JSDOMWindowShell / JSProxy in this case
and getDirect() / reifyAllStaticProperties() would fail as the proxy
does not actually have the properties. This issue was addressed by
checking if |this| is a JSProxy and then using JSProxy::target() instead
of |this| for the calls to getDirect() and for the reification.

* runtime/JSObject.h:
* runtime/Lookup.h:
(JSC::reifyStaticProperty):
(JSC::reifyStaticProperties):
Move most code in reifyStaticProperties() to a separate function so the
code can be shared with JSObject::reifyAllStaticProperties().
reifyStaticProperties() is currently called by the bindings on the
prototype objects.

Source/WebCore:

Update the bindings generator so that property getters / setters now
make sure |this| has the right type and throw a TypeError if it does
not, as per:
- http://heycam.github.io/webidl/#dfn-attribute-getter (step 2.4.2)
- http://heycam.github.io/webidl/#dfn-attribute-setter (step 3.5)

This was an issue when doing something like:
Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call(nonWindow)

We would call toJSDOMWindow(thisValue), which would return null as
thisValue is not a JSDOMWindow. We would then dereference this null
pointer and crash. We now do a null check and throw a TypeError in
this case, as per the Web IDL specification.

The generated bindings still have some non-spec compliant behavior
though:
1. The getters / setters of instance properties use slotBase instead
   of thisValue, which means that calling instanceA's getter on
   instanceB returns instanceA's property insteas of instanceB's.
2. Global object property getters should not require an explicit
   |this| so calling the following should work:
   - Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call()
   We currently throw in this case.

These issues will be addressed in follow-up patches.

Tests: js/getOwnPropertyDescriptor-unforgeable-attributes.html
       js/getOwnPropertyDescriptor-window-attributes.html
       js/instance-property-getter-other-instance.html

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::jsTestActiveDOMObjectExcitingAttr):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::jsTestExceptionName):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjConstructorTestSubObj):
(WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::jsTestObjConditionalAttr4Constructor):
(WebCore::jsTestObjConditionalAttr5Constructor):
(WebCore::jsTestObjConditionalAttr6Constructor):
(WebCore::jsTestObjContentDocument):
(WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::setJSTestObjConditionalAttr4Constructor):
(WebCore::setJSTestObjConditionalAttr5Constructor):
(WebCore::setJSTestObjConditionalAttr6Constructor):
(WebCore::setJSTestObjConstructor): Deleted.
(WebCore::setJSTestObjConstructorStaticStringAttr): Deleted.
(WebCore::setJSTestObjConditionalAttr3): Deleted.
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::jsTestTypedefsConstructorTestSubObj):

LayoutTests:

Add layout test coverage for calling Object.getOwnPropertyDescriptor()
on instance properties (e.g. Unforgeable properties and Window properties).

* http/tests/security/cross-origin-window-property-access-expected.txt:
* http/tests/security/cross-origin-window-property-access.html:
- Fix bug causing the onload function to not find the crossOriginWindow variable.
- Update the case for accessing crossOriginWindow.location property as this is
  actually expected to work as per the specification:
  https://html.spec.whatwg.org/multipage/browsers.html#security-window

* js/dom/dom-as-prototype-assignment-exception-expected.txt:
* js/dom/getOwnPropertyDescriptor-expected.txt:
* js/dom/script-tests/dom-as-prototype-assignment-exception.js:
* js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt: Added.
* js/getOwnPropertyDescriptor-unforgeable-attributes.html: Added.
* js/getOwnPropertyDescriptor-window-attributes-expected.txt: Added.
* js/getOwnPropertyDescriptor-window-attributes.html: Added.
* js/instance-property-getter-other-instance-expected.txt: Added.
* js/instance-property-getter-other-instance.html: Added.
* js/resources/getOwnPropertyDescriptor.js:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossoriginwindowpropertyaccessexpectedtxt">trunk/LayoutTests/http/tests/security/cross-origin-window-property-access-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossoriginwindowpropertyaccesshtml">trunk/LayoutTests/http/tests/security/cross-origin-window-property-access.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdomasprototypeassignmentexceptionexpectedtxt">trunk/LayoutTests/js/dom/dom-as-prototype-assignment-exception-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomgetOwnPropertyDescriptorexpectedtxt">trunk/LayoutTests/js/dom/getOwnPropertyDescriptor-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomscripttestsdomasprototypeassignmentexceptionjs">trunk/LayoutTests/js/dom/script-tests/dom-as-prototype-assignment-exception.js</a></li>
<li><a href="#trunkLayoutTestsjsresourcesgetOwnPropertyDescriptorjs">trunk/LayoutTests/js/resources/getOwnPropertyDescriptor.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeLookuph">trunk/Source/JavaScriptCore/runtime/Lookup.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributesexpectedtxt">trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributeshtml">trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributesexpectedtxt">trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributeshtml">trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html</a></li>
<li><a href="#trunkLayoutTestsjsinstancepropertygetterotherinstanceexpectedtxt">trunk/LayoutTests/js/instance-property-getter-other-instance-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsinstancepropertygetterotherinstancehtml">trunk/LayoutTests/js/instance-property-getter-other-instance.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/ChangeLog        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -1,3 +1,31 @@
</span><ins>+2016-02-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
+        https://bugs.webkit.org/show_bug.cgi?id=153817
+
+        Reviewed by Geoffrey Garen.
+
+        Add layout test coverage for calling Object.getOwnPropertyDescriptor()
+        on instance properties (e.g. Unforgeable properties and Window properties).
+
+        * http/tests/security/cross-origin-window-property-access-expected.txt:
+        * http/tests/security/cross-origin-window-property-access.html:
+        - Fix bug causing the onload function to not find the crossOriginWindow variable.
+        - Update the case for accessing crossOriginWindow.location property as this is
+          actually expected to work as per the specification:
+          https://html.spec.whatwg.org/multipage/browsers.html#security-window
+
+        * js/dom/dom-as-prototype-assignment-exception-expected.txt:
+        * js/dom/getOwnPropertyDescriptor-expected.txt:
+        * js/dom/script-tests/dom-as-prototype-assignment-exception.js:
+        * js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt: Added.
+        * js/getOwnPropertyDescriptor-unforgeable-attributes.html: Added.
+        * js/getOwnPropertyDescriptor-window-attributes-expected.txt: Added.
+        * js/getOwnPropertyDescriptor-window-attributes.html: Added.
+        * js/instance-property-getter-other-instance-expected.txt: Added.
+        * js/instance-property-getter-other-instance.html: Added.
+        * js/resources/getOwnPropertyDescriptor.js:
+
</ins><span class="cx"> 2016-02-04  Ryan Haddad  &lt;ryanhaddad@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Marking imported/w3c/web-platform-tests/html/semantics/document-metadata/styling/LinkStyle.html as flaky on Mac
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossoriginwindowpropertyaccessexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-origin-window-property-access-expected.txt (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-origin-window-property-access-expected.txt        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/http/tests/security/cross-origin-window-property-access-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -4,7 +4,7 @@
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(window, &quot;document&quot;).get.call(crossOriginWindow) threw exception TypeError: undefined is not an object (evaluating 'Object.getOwnPropertyDescriptor(window, &quot;document&quot;).get.call').
</span><del>-PASS Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call(crossOriginWindow) threw exception TypeError: undefined is not an object (evaluating 'Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call').
</del><ins>+PASS Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call(crossOriginWindow) === crossOriginWindow.location is true
</ins><span class="cx"> PASS successfullyParsed is true
</span><span class="cx"> 
</span><span class="cx"> TEST COMPLETE
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossoriginwindowpropertyaccesshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-origin-window-property-access.html (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-origin-window-property-access.html        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/http/tests/security/cross-origin-window-property-access.html        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -12,10 +12,10 @@
</span><span class="cx"> 
</span><span class="cx"> function runTest()
</span><span class="cx"> {
</span><del>-    var crossOriginWindow = window.open(&quot;http://127.0.0.1:8000/security/resources/blank.html&quot;);
</del><ins>+    crossOriginWindow = window.open(&quot;http://127.0.0.1:8000/security/resources/blank.html&quot;);
</ins><span class="cx">     crossOriginWindow.onload = function() {
</span><span class="cx">         shouldThrow('Object.getOwnPropertyDescriptor(window, &quot;document&quot;).get.call(crossOriginWindow)');
</span><del>-        shouldThrow('Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call(crossOriginWindow)');
</del><ins>+        shouldBeTrue('Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call(crossOriginWindow) === crossOriginWindow.location')
</ins><span class="cx">         finishJSTest();
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/ChangeLog (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/ChangeLog        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/imported/w3c/ChangeLog        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2016-02-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
+        https://bugs.webkit.org/show_bug.cgi?id=153817
+
+        Reviewed by Geoffrey Garen.
+
+        Rebaseline W3C HTML test now that more checks are passing. Some checks are still
+        failing because getter.call(undefined) / getter.call() currently throws an exception
+        for Window properties but shouldn't. Global object property getters should not require
+        an explicit |this|.
+
+        * web-platform-tests/html/dom/interfaces-expected.txt:
+
</ins><span class="cx"> 2016-02-04  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</span><span class="cx"> 
</span><span class="cx">         [Fetch API] Add support for iterating over Headers
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -198,7 +198,7 @@
</span><span class="cx"> FAIL Document interface: iframe.contentDocument must inherit property &quot;styleSheetSets&quot; with the proper type (32) assert_inherits: property &quot;styleSheetSets&quot; not found in prototype chain
</span><span class="cx"> FAIL Document interface: iframe.contentDocument must inherit property &quot;enableStyleSheetsForSet&quot; with the proper type (33) assert_inherits: property &quot;enableStyleSheetsForSet&quot; not found in prototype chain
</span><span class="cx"> FAIL Document interface: calling enableStyleSheetsForSet(DOMString) on iframe.contentDocument with too few arguments must throw TypeError assert_inherits: property &quot;enableStyleSheetsForSet&quot; not found in prototype chain
</span><del>-FAIL Document interface: iframe.contentDocument must have own property &quot;location&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+PASS Document interface: iframe.contentDocument must have own property &quot;location&quot; 
</ins><span class="cx"> PASS Document interface: iframe.contentDocument must inherit property &quot;domain&quot; with the proper type (35) 
</span><span class="cx"> PASS Document interface: iframe.contentDocument must inherit property &quot;referrer&quot; with the proper type (36) 
</span><span class="cx"> PASS Document interface: iframe.contentDocument must inherit property &quot;cookie&quot; with the proper type (37) 
</span><span class="lines">@@ -513,7 +513,7 @@
</span><span class="cx"> FAIL Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;styleSheetSets&quot; with the proper type (32) assert_inherits: property &quot;styleSheetSets&quot; not found in prototype chain
</span><span class="cx"> FAIL Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;enableStyleSheetsForSet&quot; with the proper type (33) assert_inherits: property &quot;enableStyleSheetsForSet&quot; not found in prototype chain
</span><span class="cx"> FAIL Document interface: calling enableStyleSheetsForSet(DOMString) on document.implementation.createDocument(null, &quot;&quot;, null) with too few arguments must throw TypeError assert_inherits: property &quot;enableStyleSheetsForSet&quot; not found in prototype chain
</span><del>-FAIL Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must have own property &quot;location&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+PASS Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must have own property &quot;location&quot; 
</ins><span class="cx"> PASS Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;domain&quot; with the proper type (35) 
</span><span class="cx"> PASS Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;referrer&quot; with the proper type (36) 
</span><span class="cx"> PASS Document interface: document.implementation.createDocument(null, &quot;&quot;, null) must inherit property &quot;cookie&quot; with the proper type (37) 
</span><span class="lines">@@ -3800,30 +3800,30 @@
</span><span class="cx"> PASS Window interface object name 
</span><span class="cx"> FAIL Window interface: existence and properties of interface prototype object assert_equals: Class name for prototype of Window.prototype is not &quot;WindowProperties&quot; expected &quot;[object WindowProperties]&quot; but got &quot;[object Object]&quot;
</span><span class="cx"> FAIL Window interface: existence and properties of interface prototype object's &quot;constructor&quot; property assert_own_property: Window.prototype does not have own property &quot;constructor&quot; expected property &quot;constructor&quot; missing
</span><del>-FAIL Window interface: attribute self assert_equals: &quot;self&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute name assert_equals: &quot;name&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute history assert_equals: &quot;history&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute locationbar assert_equals: &quot;locationbar&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute menubar assert_equals: &quot;menubar&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute personalbar assert_equals: &quot;personalbar&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute scrollbars assert_equals: &quot;scrollbars&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute statusbar assert_equals: &quot;statusbar&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute toolbar assert_equals: &quot;toolbar&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute status assert_equals: &quot;status&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute self The DOMWindow.self getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute name The DOMWindow.name getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute history The DOMWindow.history getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute locationbar The DOMWindow.locationbar getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute menubar The DOMWindow.menubar getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute personalbar The DOMWindow.personalbar getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute scrollbars The DOMWindow.scrollbars getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute statusbar The DOMWindow.statusbar getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute toolbar The DOMWindow.toolbar getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute status The DOMWindow.status getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: operation close() assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><del>-FAIL Window interface: attribute closed assert_equals: &quot;closed&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute closed The DOMWindow.closed getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: operation stop() desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation focus() assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><span class="cx"> FAIL Window interface: operation blur() assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><del>-FAIL Window interface: attribute frames assert_equals: &quot;frames&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute length assert_equals: &quot;length&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute opener assert_equals: &quot;opener&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute parent assert_equals: &quot;parent&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute frameElement assert_equals: &quot;frameElement&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute frames The DOMWindow.frames getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute length The DOMWindow.length getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute opener The DOMWindow.opener getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute parent The DOMWindow.parent getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute frameElement The DOMWindow.frameElement getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: operation open(DOMString,DOMString,DOMString,boolean) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><del>-FAIL Window interface: attribute navigator assert_equals: &quot;navigator&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute navigator The DOMWindow.navigator getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute external assert_own_property: The global object must have a property &quot;external&quot; expected property &quot;external&quot; missing
</span><del>-FAIL Window interface: attribute applicationCache assert_equals: &quot;applicationCache&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute applicationCache The DOMWindow.applicationCache getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: operation alert() desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation confirm(DOMString) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation prompt(DOMString,DOMString) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="lines">@@ -3832,82 +3832,82 @@
</span><span class="cx"> FAIL Window interface: operation postMessage(any,DOMString,[object Object]) assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><span class="cx"> FAIL Window interface: operation captureEvents() desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation releaseEvents() desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><del>-FAIL Window interface: attribute onabort assert_equals: &quot;onabort&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute onabort The DOMWindow.onabort getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute onautocomplete assert_own_property: The global object must have a property &quot;onautocomplete&quot; expected property &quot;onautocomplete&quot; missing
</span><span class="cx"> FAIL Window interface: attribute onautocompleteerror assert_own_property: The global object must have a property &quot;onautocompleteerror&quot; expected property &quot;onautocompleteerror&quot; missing
</span><del>-FAIL Window interface: attribute onblur assert_equals: &quot;onblur&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute onblur The DOMWindow.onblur getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute oncancel assert_own_property: The global object must have a property &quot;oncancel&quot; expected property &quot;oncancel&quot; missing
</span><del>-FAIL Window interface: attribute oncanplay assert_equals: &quot;oncanplay&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute oncanplaythrough assert_equals: &quot;oncanplaythrough&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onchange assert_equals: &quot;onchange&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onclick assert_equals: &quot;onclick&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute oncanplay The DOMWindow.oncanplay getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute oncanplaythrough The DOMWindow.oncanplaythrough getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onchange The DOMWindow.onchange getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onclick The DOMWindow.onclick getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute onclose assert_own_property: The global object must have a property &quot;onclose&quot; expected property &quot;onclose&quot; missing
</span><del>-FAIL Window interface: attribute oncontextmenu assert_equals: &quot;oncontextmenu&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute oncontextmenu The DOMWindow.oncontextmenu getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute oncuechange assert_own_property: The global object must have a property &quot;oncuechange&quot; expected property &quot;oncuechange&quot; missing
</span><del>-FAIL Window interface: attribute ondblclick assert_equals: &quot;ondblclick&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondrag assert_equals: &quot;ondrag&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondragend assert_equals: &quot;ondragend&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondragenter assert_equals: &quot;ondragenter&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute ondblclick The DOMWindow.ondblclick getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondrag The DOMWindow.ondrag getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondragend The DOMWindow.ondragend getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondragenter The DOMWindow.ondragenter getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute ondragexit assert_own_property: The global object must have a property &quot;ondragexit&quot; expected property &quot;ondragexit&quot; missing
</span><del>-FAIL Window interface: attribute ondragleave assert_equals: &quot;ondragleave&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondragover assert_equals: &quot;ondragover&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondragstart assert_equals: &quot;ondragstart&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondrop assert_equals: &quot;ondrop&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ondurationchange assert_equals: &quot;ondurationchange&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onemptied assert_equals: &quot;onemptied&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onended assert_equals: &quot;onended&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onerror assert_equals: &quot;onerror&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onfocus assert_equals: &quot;onfocus&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute oninput assert_equals: &quot;oninput&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute oninvalid assert_equals: &quot;oninvalid&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onkeydown assert_equals: &quot;onkeydown&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onkeypress assert_equals: &quot;onkeypress&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onkeyup assert_equals: &quot;onkeyup&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onload assert_equals: &quot;onload&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onloadeddata assert_equals: &quot;onloadeddata&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onloadedmetadata assert_equals: &quot;onloadedmetadata&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onloadstart assert_equals: &quot;onloadstart&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmousedown assert_equals: &quot;onmousedown&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmouseenter assert_equals: &quot;onmouseenter&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmouseleave assert_equals: &quot;onmouseleave&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmousemove assert_equals: &quot;onmousemove&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmouseout assert_equals: &quot;onmouseout&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmouseover assert_equals: &quot;onmouseover&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmouseup assert_equals: &quot;onmouseup&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onmousewheel assert_equals: &quot;onmousewheel&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onpause assert_equals: &quot;onpause&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onplay assert_equals: &quot;onplay&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onplaying assert_equals: &quot;onplaying&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onprogress assert_equals: &quot;onprogress&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onratechange assert_equals: &quot;onratechange&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onreset assert_equals: &quot;onreset&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onresize assert_equals: &quot;onresize&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onscroll assert_equals: &quot;onscroll&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onseeked assert_equals: &quot;onseeked&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onseeking assert_equals: &quot;onseeking&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onselect assert_equals: &quot;onselect&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute ondragleave The DOMWindow.ondragleave getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondragover The DOMWindow.ondragover getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondragstart The DOMWindow.ondragstart getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondrop The DOMWindow.ondrop getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ondurationchange The DOMWindow.ondurationchange getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onemptied The DOMWindow.onemptied getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onended The DOMWindow.onended getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onerror The DOMWindow.onerror getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onfocus The DOMWindow.onfocus getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute oninput The DOMWindow.oninput getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute oninvalid The DOMWindow.oninvalid getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onkeydown The DOMWindow.onkeydown getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onkeypress The DOMWindow.onkeypress getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onkeyup The DOMWindow.onkeyup getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onload The DOMWindow.onload getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onloadeddata The DOMWindow.onloadeddata getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onloadedmetadata The DOMWindow.onloadedmetadata getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onloadstart The DOMWindow.onloadstart getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onmousedown The DOMWindow.onmousedown getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onmouseenter assert_equals: Gets on a global should not require an explicit this expected (undefined) undefined but got (object) null
+FAIL Window interface: attribute onmouseleave assert_equals: Gets on a global should not require an explicit this expected (undefined) undefined but got (object) null
+FAIL Window interface: attribute onmousemove The DOMWindow.onmousemove getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onmouseout The DOMWindow.onmouseout getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onmouseover The DOMWindow.onmouseover getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onmouseup The DOMWindow.onmouseup getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onmousewheel The DOMWindow.onmousewheel getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onpause The DOMWindow.onpause getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onplay The DOMWindow.onplay getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onplaying The DOMWindow.onplaying getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onprogress The DOMWindow.onprogress getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onratechange The DOMWindow.onratechange getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onreset The DOMWindow.onreset getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onresize The DOMWindow.onresize getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onscroll The DOMWindow.onscroll getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onseeked The DOMWindow.onseeked getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onseeking The DOMWindow.onseeking getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onselect The DOMWindow.onselect getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute onshow assert_own_property: The global object must have a property &quot;onshow&quot; expected property &quot;onshow&quot; missing
</span><span class="cx"> FAIL Window interface: attribute onsort assert_own_property: The global object must have a property &quot;onsort&quot; expected property &quot;onsort&quot; missing
</span><del>-FAIL Window interface: attribute onstalled assert_equals: &quot;onstalled&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onsubmit assert_equals: &quot;onsubmit&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onsuspend assert_equals: &quot;onsuspend&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ontimeupdate assert_equals: &quot;ontimeupdate&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute onstalled The DOMWindow.onstalled getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onsubmit The DOMWindow.onsubmit getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onsuspend The DOMWindow.onsuspend getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ontimeupdate The DOMWindow.ontimeupdate getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute ontoggle assert_own_property: The global object must have a property &quot;ontoggle&quot; expected property &quot;ontoggle&quot; missing
</span><del>-FAIL Window interface: attribute onvolumechange assert_equals: &quot;onvolumechange&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onwaiting assert_equals: &quot;onwaiting&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute onvolumechange The DOMWindow.onvolumechange getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onwaiting The DOMWindow.onwaiting getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute onafterprint assert_own_property: The global object must have a property &quot;onafterprint&quot; expected property &quot;onafterprint&quot; missing
</span><span class="cx"> FAIL Window interface: attribute onbeforeprint assert_own_property: The global object must have a property &quot;onbeforeprint&quot; expected property &quot;onbeforeprint&quot; missing
</span><del>-FAIL Window interface: attribute onbeforeunload assert_equals: &quot;onbeforeunload&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onhashchange assert_equals: &quot;onhashchange&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute onbeforeunload The DOMWindow.onbeforeunload getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onhashchange The DOMWindow.onhashchange getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: attribute onlanguagechange assert_own_property: The global object must have a property &quot;onlanguagechange&quot; expected property &quot;onlanguagechange&quot; missing
</span><del>-FAIL Window interface: attribute onmessage assert_equals: &quot;onmessage&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onoffline assert_equals: &quot;onoffline&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute ononline assert_equals: &quot;ononline&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onpagehide assert_equals: &quot;onpagehide&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onpageshow assert_equals: &quot;onpageshow&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onpopstate assert_equals: &quot;onpopstate&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onstorage assert_equals: &quot;onstorage&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute onunload assert_equals: &quot;onunload&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute onmessage The DOMWindow.onmessage getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onoffline The DOMWindow.onoffline getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute ononline The DOMWindow.ononline getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onpagehide The DOMWindow.onpagehide getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onpageshow The DOMWindow.onpageshow getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onpopstate The DOMWindow.onpopstate getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onstorage The DOMWindow.onstorage getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute onunload The DOMWindow.onunload getter can only be used on instances of DOMWindow
</ins><span class="cx"> FAIL Window interface: operation btoa(DOMString) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation atob(DOMString) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation setTimeout(Function,long,any) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="lines">@@ -3917,15 +3917,15 @@
</span><span class="cx"> FAIL Window interface: operation setInterval(DOMString,long,any) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation clearInterval(long) desc is not an Object. (evaluating '&quot;get&quot; in desc')
</span><span class="cx"> FAIL Window interface: operation createImageBitmap(ImageBitmapSource,long,long,long,long) assert_own_property: global object missing non-static operation expected property &quot;createImageBitmap&quot; missing
</span><del>-FAIL Window interface: attribute sessionStorage assert_equals: &quot;sessionStorage&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Window interface: attribute localStorage assert_equals: &quot;localStorage&quot; must have a getter expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+FAIL Window interface: attribute sessionStorage The DOMWindow.sessionStorage getter can only be used on instances of DOMWindow
+FAIL Window interface: attribute localStorage The DOMWindow.localStorage getter can only be used on instances of DOMWindow
</ins><span class="cx"> PASS Window must be primary interface of window 
</span><span class="cx"> PASS Stringification of window 
</span><del>-FAIL Window interface: window must have own property &quot;window&quot; assert_false: property descriptor has value but is supposed to be accessor expected false got true
</del><ins>+PASS Window interface: window must have own property &quot;window&quot; 
</ins><span class="cx"> PASS Window interface: window must inherit property &quot;self&quot; with the proper type (1) 
</span><del>-FAIL Window interface: window must have own property &quot;document&quot; assert_false: property descriptor has value but is supposed to be accessor expected false got true
</del><ins>+PASS Window interface: window must have own property &quot;document&quot; 
</ins><span class="cx"> PASS Window interface: window must inherit property &quot;name&quot; with the proper type (3) 
</span><del>-FAIL Window interface: window must have own property &quot;location&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+PASS Window interface: window must have own property &quot;location&quot; 
</ins><span class="cx"> PASS Window interface: window must inherit property &quot;history&quot; with the proper type (5) 
</span><span class="cx"> PASS Window interface: window must inherit property &quot;locationbar&quot; with the proper type (6) 
</span><span class="cx"> PASS Window interface: window must inherit property &quot;menubar&quot; with the proper type (7) 
</span><span class="lines">@@ -3941,7 +3941,7 @@
</span><span class="cx"> PASS Window interface: window must inherit property &quot;blur&quot; with the proper type (17) 
</span><span class="cx"> PASS Window interface: window must inherit property &quot;frames&quot; with the proper type (18) 
</span><span class="cx"> PASS Window interface: window must inherit property &quot;length&quot; with the proper type (19) 
</span><del>-FAIL Window interface: window must have own property &quot;top&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+PASS Window interface: window must have own property &quot;top&quot; 
</ins><span class="cx"> PASS Window interface: window must inherit property &quot;opener&quot; with the proper type (21) 
</span><span class="cx"> PASS Window interface: window must inherit property &quot;parent&quot; with the proper type (22) 
</span><span class="cx"> PASS Window interface: window must inherit property &quot;frameElement&quot; with the proper type (23) 
</span><span class="lines">@@ -4117,21 +4117,21 @@
</span><span class="cx"> PASS Location interface: existence and properties of interface prototype object's &quot;constructor&quot; property 
</span><span class="cx"> PASS Location must be primary interface of window.location 
</span><span class="cx"> PASS Stringification of window.location 
</span><del>-FAIL Location interface: window.location must have own property &quot;href&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;origin&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;protocol&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;host&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;hostname&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;port&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;pathname&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;search&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
-FAIL Location interface: window.location must have own property &quot;hash&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+PASS Location interface: window.location must have own property &quot;href&quot; 
+FAIL Location interface: window.location must have own property &quot;origin&quot; assert_equals: setter must be function for PutForwards, Replaceable, or non-readonly attributes expected &quot;function&quot; but got &quot;undefined&quot;
+PASS Location interface: window.location must have own property &quot;protocol&quot; 
+PASS Location interface: window.location must have own property &quot;host&quot; 
+PASS Location interface: window.location must have own property &quot;hostname&quot; 
+PASS Location interface: window.location must have own property &quot;port&quot; 
+PASS Location interface: window.location must have own property &quot;pathname&quot; 
+PASS Location interface: window.location must have own property &quot;search&quot; 
+PASS Location interface: window.location must have own property &quot;hash&quot; 
</ins><span class="cx"> FAIL Location interface: window.location must have own property &quot;assign&quot; assert_own_property: Doesn't have the unforgeable operation property expected property &quot;assign&quot; missing
</span><span class="cx"> FAIL Location interface: calling assign(USVString) on window.location with too few arguments must throw TypeError assert_own_property: expected property &quot;assign&quot; missing
</span><span class="cx"> FAIL Location interface: window.location must have own property &quot;replace&quot; assert_own_property: Doesn't have the unforgeable operation property expected property &quot;replace&quot; missing
</span><span class="cx"> FAIL Location interface: calling replace(USVString) on window.location with too few arguments must throw TypeError assert_own_property: expected property &quot;replace&quot; missing
</span><span class="cx"> FAIL Location interface: window.location must have own property &quot;reload&quot; assert_own_property: Doesn't have the unforgeable operation property expected property &quot;reload&quot; missing
</span><del>-FAIL Location interface: window.location must have own property &quot;ancestorOrigins&quot; assert_equals: getter must be Function expected &quot;function&quot; but got &quot;undefined&quot;
</del><ins>+PASS Location interface: window.location must have own property &quot;ancestorOrigins&quot; 
</ins><span class="cx"> FAIL PopStateEvent interface: existence and properties of interface object assert_equals: class string of PopStateEvent expected &quot;[object Function]&quot; but got &quot;[object PopStateEventConstructor]&quot;
</span><span class="cx"> PASS PopStateEvent interface object length 
</span><span class="cx"> PASS PopStateEvent interface object name 
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomdomasprototypeassignmentexceptionexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/dom-as-prototype-assignment-exception-expected.txt (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/dom-as-prototype-assignment-exception-expected.txt        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/js/dom/dom-as-prototype-assignment-exception-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -5,7 +5,7 @@
</span><span class="cx"> 
</span><span class="cx"> PASS testObject.id threw exception TypeError: The Element.id getter can only be used on instances of Element.
</span><span class="cx"> PASS testObject.id=&quot;foo&quot; threw exception TypeError: The Element.id setter can only be used on instances of Element.
</span><del>-PASS testObject.length is 1
</del><ins>+PASS testObject.length threw exception TypeError: The HTMLCollection.length getter can only be used on instances of HTMLCollection.
</ins><span class="cx"> PASS div.id is 'test'
</span><span class="cx"> PASS div.hasOwnProperty('id') is false
</span><span class="cx"> PASS div.__proto__.id threw exception TypeError: The Element.id getter can only be used on instances of Element.
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomgetOwnPropertyDescriptorexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/getOwnPropertyDescriptor-expected.txt (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/getOwnPropertyDescriptor-expected.txt        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/js/dom/getOwnPropertyDescriptor-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -124,23 +124,11 @@
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 'XMLHttpRequest').hasOwnProperty('set') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 'XMLHttpRequest').enumerable is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 'XMLHttpRequest').configurable is true
</span><del>-PASS Object.getOwnPropertyDescriptor(global, 'length').get is undefined
-PASS Object.getOwnPropertyDescriptor(global, 'length').set is undefined
-PASS Object.getOwnPropertyDescriptor(global, 'length').hasOwnProperty('value') is false
-PASS Object.getOwnPropertyDescriptor(global, 'length').hasOwnProperty('writable') is false
-PASS Object.getOwnPropertyDescriptor(global, 'length').enumerable is true
-PASS Object.getOwnPropertyDescriptor(global, 'length').configurable is false
</del><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 0).value is global[0]
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 0).hasOwnProperty('get') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 0).hasOwnProperty('set') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 0).enumerable is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(global, 0).configurable is false
</span><del>-PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 'length').get is undefined
-PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 'length').set is undefined
-PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 'length').hasOwnProperty('value') is false
-PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 'length').hasOwnProperty('writable') is false
-PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 'length').enumerable is true
-PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 'length').configurable is false
</del><span class="cx"> PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 0).value is document.getElementsByTagName('div')[0]
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 0).hasOwnProperty('get') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 0).hasOwnProperty('set') is false
</span><span class="lines">@@ -151,23 +139,11 @@
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 0).hasOwnProperty('set') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 0).enumerable is true
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 0).configurable is false
</span><del>-PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 'length').get is undefined
-PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 'length').set is undefined
-PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 'length').hasOwnProperty('value') is false
-PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 'length').hasOwnProperty('writable') is false
-PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 'length').enumerable is true
-PASS Object.getOwnPropertyDescriptor(document.getElementsByClassName('pass'), 'length').configurable is false
</del><span class="cx"> PASS Object.getOwnPropertyDescriptor(canvasPixelArray, 0).value is canvasPixelArray[0]
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(canvasPixelArray, 0).hasOwnProperty('get') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(canvasPixelArray, 0).hasOwnProperty('set') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(canvasPixelArray, 0).enumerable is true
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(canvasPixelArray, 0).configurable is false
</span><del>-PASS Object.getOwnPropertyDescriptor(select, 'length').get is undefined
-PASS Object.getOwnPropertyDescriptor(select, 'length').set is undefined
-PASS Object.getOwnPropertyDescriptor(select, 'length').hasOwnProperty('value') is false
-PASS Object.getOwnPropertyDescriptor(select, 'length').hasOwnProperty('writable') is false
-PASS Object.getOwnPropertyDescriptor(select, 'length').enumerable is true
-PASS Object.getOwnPropertyDescriptor(select, 'length').configurable is false
</del><span class="cx"> PASS Object.getOwnPropertyDescriptor(select, 0).value is select[0]
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(select, 0).hasOwnProperty('get') is false
</span><span class="cx"> PASS Object.getOwnPropertyDescriptor(select, 0).hasOwnProperty('set') is false
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomscripttestsdomasprototypeassignmentexceptionjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/script-tests/dom-as-prototype-assignment-exception.js (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/script-tests/dom-as-prototype-assignment-exception.js        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/js/dom/script-tests/dom-as-prototype-assignment-exception.js        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -11,7 +11,7 @@
</span><span class="cx"> shouldThrow('testObject.id=&quot;foo&quot;')
</span><span class="cx"> 
</span><span class="cx"> testObject = {__proto__: document.getElementsByTagName(&quot;div&quot;)}
</span><del>-shouldBe(&quot;testObject.length&quot;, '1')
</del><ins>+shouldThrow(&quot;testObject.length&quot;)
</ins><span class="cx"> 
</span><span class="cx"> shouldBe(&quot;div.id&quot;, &quot;'test'&quot;)
</span><span class="cx"> shouldBeFalse(&quot;div.hasOwnProperty('id')&quot;)
</span></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributesexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt (0 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -0,0 +1,134 @@
</span><ins>+Tests that Object.getOwnPropertyDescriptor() works correctly for [Unforgeable] IDL attributes.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+* Document.location
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Document.location getter can only be used on instances of Document.
+PASS descriptor.get.call(document) is document.location
+
+* Location.href
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.href getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.href is true
+
+* Location.protocol
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.protocol getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.protocol is true
+
+* Location.host
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.host getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.host is true
+
+* Location.hostname
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.hostname getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.hostname is true
+
+* Location.port
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.port getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.port is true
+
+* Location.pathname
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.pathname getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.pathname is true
+
+* Location.search
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.search getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.search is true
+
+* Location.hash
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.hash getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.hash is true
+
+* Location.origin
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is undefined.
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.origin getter can only be used on instances of Location.
+PASS descriptor.get.call(document.location) === document.location.origin is true
+
+* Location.ancestorOrigins
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is undefined.
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The Location.ancestorOrigins getter can only be used on instances of Location.
+
+* Window.location
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.location getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.location is true
+
+* Window.self
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.self getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.self is true
+
+* Window.window
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is undefined.
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.window getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.window is true
+
+* Window.top
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is undefined.
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.top getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.top is true
+
+* Window.document
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is undefined.
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is false
+PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.document getter can only be used on instances of DOMWindow.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributeshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html (0 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html                                (rev 0)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -0,0 +1,69 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+description(&quot;Tests that Object.getOwnPropertyDescriptor() works correctly for [Unforgeable] IDL attributes.&quot;);
+
+function checkUnforgeablePropertyDescriptor(descriptor, readOnly)
+{
+    shouldBeType(&quot;descriptor.get&quot;, &quot;Function&quot;);
+    if (readOnly)
+        shouldBeUndefined(&quot;descriptor.set&quot;);
+    else
+        shouldBeType(&quot;descriptor.set&quot;, &quot;Function&quot;);
+    shouldBeTrue(&quot;descriptor.enumerable&quot;);
+    shouldBeFalse(&quot;descriptor.configurable&quot;);
+    invalidObject = { };
+    shouldThrow(&quot;descriptor.get.call(invalidObject)&quot;);
+}
+
+debug(&quot;* Document.location&quot;);
+descriptor = Object.getOwnPropertyDescriptor(document, &quot;location&quot;);
+checkUnforgeablePropertyDescriptor(descriptor);
+shouldBe(&quot;descriptor.get.call(document)&quot;, &quot;document.location&quot;);
+
+var locationProperties = Object.getOwnPropertyNames(document.location);
+for (var i = 0; i &lt; locationProperties.length; i++) {
+    var propertyName = locationProperties[i];
+    descriptor = Object.getOwnPropertyDescriptor(document.location, propertyName);
+    if (descriptor.value)
+        continue;
+
+    debug(&quot;&quot;);
+    debug(&quot;* Location.&quot; + propertyName);
+    var isReadOnly = propertyName == &quot;origin&quot; || propertyName == &quot;ancestorOrigins&quot;;
+    checkUnforgeablePropertyDescriptor(descriptor, isReadOnly);
+    if (propertyName != &quot;ancestorOrigins&quot;)
+        shouldBeTrue(&quot;descriptor.get.call(document.location) === document.location.&quot; + propertyName);
+}
+
+debug(&quot;&quot;);
+debug(&quot;* Window.location&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;location&quot;);
+checkUnforgeablePropertyDescriptor(descriptor);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.location&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.self&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;self&quot;);
+checkUnforgeablePropertyDescriptor(descriptor);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.self&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.window&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;window&quot;);
+checkUnforgeablePropertyDescriptor(descriptor, true);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.window&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.top&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;top&quot;);
+checkUnforgeablePropertyDescriptor(descriptor, true);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.top&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.document&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;document&quot;);
+checkUnforgeablePropertyDescriptor(descriptor, true);
+
+&lt;/script&gt;
+&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributesexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt (0 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -0,0 +1,44 @@
</span><ins>+Tests that Object.getOwnPropertyDescriptor() works correctly for Window properties
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+* Window.screen
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+FAIL descriptor.configurable should be true. Was false.
+PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.screen getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.screen is true
+FAIL descriptor.get.call() === window.screen should be true. Threw exception TypeError: The DOMWindow.screen getter can only be used on instances of DOMWindow
+
+* Window.navigator
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+FAIL descriptor.configurable should be true. Was false.
+PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.navigator getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.navigator is true
+FAIL descriptor.get.call() === window.navigator should be true. Threw exception TypeError: The DOMWindow.navigator getter can only be used on instances of DOMWindow
+
+* Window.frameElement
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is undefined.
+PASS descriptor.enumerable is true
+FAIL descriptor.configurable should be true. Was false.
+PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.frameElement getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.frameElement is true
+FAIL descriptor.get.call() === window.frameElement should be true. Threw exception TypeError: The DOMWindow.frameElement getter can only be used on instances of DOMWindow
+
+* Window.name
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+FAIL descriptor.configurable should be true. Was false.
+PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.name getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.name is true
+FAIL descriptor.get.call() === window.name should be true. Threw exception TypeError: The DOMWindow.name getter can only be used on instances of DOMWindow
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributeshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html (0 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html                                (rev 0)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+description(&quot;Tests that Object.getOwnPropertyDescriptor() works correctly for Window properties&quot;);
+
+function checkWindowPropertyDescriptor(descriptor, readOnly)
+{
+    shouldBeType(&quot;descriptor.get&quot;, &quot;Function&quot;);
+    if (readOnly)
+        shouldBeUndefined(&quot;descriptor.set&quot;);
+    else
+        shouldBeType(&quot;descriptor.set&quot;, &quot;Function&quot;);
+    shouldBeTrue(&quot;descriptor.enumerable&quot;);
+    shouldBeTrue(&quot;descriptor.configurable&quot;);
+    nonWindowObject = document;
+    shouldThrow(&quot;descriptor.get.call(nonWindowObject)&quot;);
+}
+
+// The properties of global objects (such as Window) need to be on the instance as per the Web IDL specification,
+// even if they are not marked as [Unforgeable].
+
+debug(&quot;* Window.screen&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;screen&quot;);
+checkWindowPropertyDescriptor(descriptor, false);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.screen&quot;);
+shouldBeTrue(&quot;descriptor.get.call() === window.screen&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.navigator&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;navigator&quot;);
+checkWindowPropertyDescriptor(descriptor, false);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.navigator&quot;);
+shouldBeTrue(&quot;descriptor.get.call() === window.navigator&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.frameElement&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;frameElement&quot;);
+checkWindowPropertyDescriptor(descriptor, true);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.frameElement&quot;);
+shouldBeTrue(&quot;descriptor.get.call() === window.frameElement&quot;);
+
+debug(&quot;&quot;);
+debug(&quot;* Window.name&quot;);
+descriptor = Object.getOwnPropertyDescriptor(window, &quot;name&quot;);
+checkWindowPropertyDescriptor(descriptor, false);
+shouldBeTrue(&quot;descriptor.get.call(window) === window.name&quot;);
+shouldBeTrue(&quot;descriptor.get.call() === window.name&quot;);
+
+&lt;/script&gt;
+&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsinstancepropertygetterotherinstanceexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/instance-property-getter-other-instance-expected.txt (0 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/instance-property-getter-other-instance-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/instance-property-getter-other-instance-expected.txt        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+Tests that calling an instance property getter on another instance works as expected
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS locationGetter is an instance of function Function() {
+    [native code]
+}
+PASS locationGetter.call(otherWindow.document).toString() is &quot;about:blank&quot;
+FAIL locationGetter.call(window.document) === window.document.location should be true. Was false.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsinstancepropertygetterotherinstancehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/instance-property-getter-other-instance.html (0 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/instance-property-getter-other-instance.html                                (rev 0)
+++ trunk/LayoutTests/js/instance-property-getter-other-instance.html        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;body onload=&quot;runTest()&quot;&gt;
+&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script&gt;
+description(&quot;Tests that calling an instance property getter on another instance works as expected&quot;);
+jsTestIsAsync = true;
+
+if (window.testRunner)
+    testRunner.setCanOpenWindows();
+
+function runTest()
+{
+    otherWindow = window.open(&quot;about:blank&quot;);
+        locationGetter = Object.getOwnPropertyDescriptor(otherWindow.document, &quot;location&quot;).get;
+        shouldBeType(&quot;locationGetter&quot;, Function);
+        shouldBeEqualToString(&quot;locationGetter.call(otherWindow.document).toString()&quot;, &quot;about:blank&quot;);
+        // Should return the current document's location.
+        shouldBeTrue(&quot;locationGetter.call(window.document) === window.document.location&quot;);
+        finishJSTest();
+}
+&lt;/script&gt;
+&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsresourcesgetOwnPropertyDescriptorjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/resources/getOwnPropertyDescriptor.js (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/resources/getOwnPropertyDescriptor.js        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/LayoutTests/js/resources/getOwnPropertyDescriptor.js        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -43,18 +43,14 @@
</span><span class="cx"> descriptorShouldBe(&quot;global&quot;, &quot;'Infinity'&quot;, {writable: false, enumerable: false, configurable: false, value:&quot;Infinity&quot;});
</span><span class="cx"> descriptorShouldBe(&quot;global&quot;, &quot;'window'&quot;, {writable: false, enumerable: true, configurable: false, value:&quot;global&quot;});
</span><span class="cx"> descriptorShouldBe(&quot;global&quot;, &quot;'XMLHttpRequest'&quot;, {writable: true, enumerable: false, configurable: true, value:&quot;XMLHttpRequest&quot;});
</span><del>-descriptorShouldBe(&quot;global&quot;, &quot;'length'&quot;, {get: undefined, set: undefined, enumerable: true, configurable: false});
</del><span class="cx"> descriptorShouldBe(&quot;global&quot;, &quot;0&quot;, {writable: true, enumerable: false, configurable: false, value:&quot;global[0]&quot;});
</span><del>-descriptorShouldBe(&quot;document.getElementsByTagName('div')&quot;, &quot;'length'&quot;, {get: undefined, set: undefined, enumerable: true, configurable: false});
</del><span class="cx"> descriptorShouldBe(&quot;document.getElementsByTagName('div')&quot;, &quot;0&quot;, {writable: false, enumerable: true, configurable: false, value:&quot;document.getElementsByTagName('div')[0]&quot;});
</span><span class="cx"> descriptorShouldBe(&quot;document.getElementsByClassName('pass')&quot;, &quot;0&quot;, {writable: false, enumerable: true, configurable: false, value:&quot;document.getElementsByClassName('pass')[0]&quot;});
</span><del>-descriptorShouldBe(&quot;document.getElementsByClassName('pass')&quot;, &quot;'length'&quot;, {get: undefined, set: undefined, enumerable: true, configurable: false});
</del><span class="cx"> var canvas = document.createElement(&quot;canvas&quot;);
</span><span class="cx"> var canvasPixelArray = canvas.getContext(&quot;2d&quot;).createImageData(10,10).data;
</span><span class="cx"> descriptorShouldBe(&quot;canvasPixelArray&quot;, &quot;0&quot;, {writable: true, enumerable: true, configurable: false, value:&quot;canvasPixelArray[0]&quot;});
</span><span class="cx"> var select = document.createElement(&quot;select&quot;);
</span><span class="cx"> select.innerHTML = &quot;&lt;option&gt;foo&lt;/option&gt;&quot;;
</span><del>-descriptorShouldBe(&quot;select&quot;, &quot;'length'&quot;, {get: undefined, set: undefined, enumerable: true, configurable: false});
</del><span class="cx"> descriptorShouldBe(&quot;select&quot;, &quot;0&quot;, {writable: true, enumerable: true, configurable: false, value:&quot;select[0]&quot;});
</span><span class="cx"> 
</span><span class="cx"> var objectWithGetter = {};
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -1,3 +1,44 @@
</span><ins>+2016-02-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
+        https://bugs.webkit.org/show_bug.cgi?id=153817
+
+        Reviewed by Geoffrey Garen.
+
+        Extend support for Object.getOwnPropertyDescriptor() on native bindings
+        to instance properties (e.g. Unforgeable properties or Global object
+        properties) so that the returned descriptor has getter / setter
+        functions, as expected.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::reifyAllStaticProperties):
+        Add method that reifies all static properties, including the custom
+        accessors. This is similar to what is done eagerly on the prototype
+        objects in the bindings code.
+
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        getOwnPropertyDescriptor() would previously fails for custom accessors
+        that are on the instance because getDirect() does not check the static
+        property table and those custom accessors were not reified (We only
+        reified all properties eagerly - including custom accessors - on
+        prototype objects. To address this issue, we now call
+        reifyAllStaticProperties() if the call to getDirect() fails and then
+        call getDirect() again. This fix is however insufficient for Window
+        properties because |this| is a JSDOMWindowShell / JSProxy in this case
+        and getDirect() / reifyAllStaticProperties() would fail as the proxy
+        does not actually have the properties. This issue was addressed by
+        checking if |this| is a JSProxy and then using JSProxy::target() instead
+        of |this| for the calls to getDirect() and for the reification.
+
+        * runtime/JSObject.h:
+        * runtime/Lookup.h:
+        (JSC::reifyStaticProperty):
+        (JSC::reifyStaticProperties):
+        Move most code in reifyStaticProperties() to a separate function so the
+        code can be shared with JSObject::reifyAllStaticProperties().
+        reifyStaticProperties() is currently called by the bindings on the
+        prototype objects.
+
</ins><span class="cx"> 2016-02-04  Alex Christensen  &lt;achristensen@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Fix internal Windows build
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -1683,6 +1683,26 @@
</span><span class="cx">     structure(vm)-&gt;setStaticFunctionsReified(true);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JSObject::reifyAllStaticProperties(ExecState* exec)
+{
+    VM&amp; vm = exec-&gt;vm();
+
+    for (const ClassInfo* info = classInfo(); info; info = info-&gt;parentClass) {
+        const HashTable* hashTable = info-&gt;staticPropHashTable;
+        if (!hashTable)
+            continue;
+
+        for (auto iter = hashTable-&gt;begin(); iter != hashTable-&gt;end(); ++iter) {
+            unsigned attributes;
+            PropertyOffset offset = getDirectOffset(vm, Identifier::fromString(&amp;vm, iter.key()), attributes);
+            if (!isValidOffset(offset))
+                reifyStaticProperty(vm, *iter.value(), *this);
+        }
+    }
+
+    structure(vm)-&gt;setStaticFunctionsReified(true);
+}
+
</ins><span class="cx"> bool JSObject::removeDirect(VM&amp; vm, PropertyName propertyName)
</span><span class="cx"> {
</span><span class="cx">     Structure* structure = this-&gt;structure(vm);
</span><span class="lines">@@ -2555,16 +2575,22 @@
</span><span class="cx">     else if (slot.attributes() &amp; CustomAccessor) {
</span><span class="cx">         descriptor.setCustomDescriptor(slot.attributes());
</span><span class="cx"> 
</span><del>-        JSValue maybeGetterSetter = getDirect(exec-&gt;vm(), propertyName);
-        // FIXME: This currently does not work for properties that are on the instance and not reified.
-        if (maybeGetterSetter) {
-            auto* getterSetter = jsCast&lt;CustomGetterSetter*&gt;(maybeGetterSetter);
-            ASSERT(getterSetter);
-            if (getterSetter-&gt;getter())
-                descriptor.setGetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Getter));
-            if (getterSetter-&gt;setter())
-                descriptor.setSetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Setter));
</del><ins>+        JSObject* thisObject = this;
+        if (auto* proxy = jsDynamicCast&lt;JSProxy*&gt;(this))
+            thisObject = proxy-&gt;target();
+
+        JSValue maybeGetterSetter = thisObject-&gt;getDirect(exec-&gt;vm(), propertyName);
+        if (!maybeGetterSetter) {
+            thisObject-&gt;reifyAllStaticProperties(exec);
+            maybeGetterSetter = thisObject-&gt;getDirect(exec-&gt;vm(), propertyName);
</ins><span class="cx">         }
</span><ins>+
+        ASSERT(maybeGetterSetter);
+        auto* getterSetter = jsCast&lt;CustomGetterSetter*&gt;(maybeGetterSetter);
+        if (getterSetter-&gt;getter())
+            descriptor.setGetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Getter));
+        if (getterSetter-&gt;setter())
+            descriptor.setSetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Setter));
</ins><span class="cx">     } else
</span><span class="cx">         descriptor.setDescriptor(slot.getValue(exec, propertyName), slot.attributes());
</span><span class="cx">     return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -623,7 +623,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     bool staticFunctionsReified() { return structure()-&gt;staticFunctionsReified(); }
</span><del>-    void reifyStaticFunctionsForDelete(ExecState* exec);
</del><ins>+    void reifyStaticFunctionsForDelete(ExecState*);
+    void reifyAllStaticProperties(ExecState*);
</ins><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE Butterfly* growOutOfLineStorage(VM&amp;, size_t oldSize, size_t newSize);
</span><span class="cx">     void setButterflyWithoutChangingStructure(VM&amp;, Butterfly*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeLookuph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.h (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.h        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/JavaScriptCore/runtime/Lookup.h        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -298,45 +298,49 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-template&lt;unsigned numberOfValues&gt;
-inline void reifyStaticProperties(VM&amp; vm, const HashTableValue (&amp;values)[numberOfValues], JSObject&amp; thisObj)
</del><ins>+inline void reifyStaticProperty(VM&amp; vm, const HashTableValue&amp; value, JSObject&amp; thisObj)
</ins><span class="cx"> {
</span><del>-    BatchedTransitionOptimizer transitionOptimizer(vm, &amp;thisObj);
-    for (auto&amp; value : values) {
-        if (!value.m_key)
-            continue;
</del><ins>+    if (!value.m_key)
+        return;
</ins><span class="cx"> 
</span><del>-        Identifier propertyName = Identifier::fromString(&amp;vm, reinterpret_cast&lt;const LChar*&gt;(value.m_key), strlen(value.m_key));
-        if (value.attributes() &amp; Builtin) {
-            if (value.attributes() &amp; Accessor)
-                reifyStaticAccessor(vm, value, thisObj, propertyName);
-            else
-                thisObj.putDirectBuiltinFunction(vm, thisObj.globalObject(), propertyName, value.builtinGenerator()(vm), attributesForStructure(value.attributes()));
-            continue;
-        }
</del><ins>+    Identifier propertyName = Identifier::fromString(&amp;vm, reinterpret_cast&lt;const LChar*&gt;(value.m_key), strlen(value.m_key));
+    if (value.attributes() &amp; Builtin) {
+        if (value.attributes() &amp; Accessor)
+            reifyStaticAccessor(vm, value, thisObj, propertyName);
+        else
+            thisObj.putDirectBuiltinFunction(vm, thisObj.globalObject(), propertyName, value.builtinGenerator()(vm), attributesForStructure(value.attributes()));
+        return;
+    }
</ins><span class="cx"> 
</span><del>-        if (value.attributes() &amp; Function) {
-            thisObj.putDirectNativeFunction(
-                vm, thisObj.globalObject(), propertyName, value.functionLength(),
-                value.function(), value.intrinsic(), attributesForStructure(value.attributes()));
-            continue;
-        }
</del><ins>+    if (value.attributes() &amp; Function) {
+        thisObj.putDirectNativeFunction(
+            vm, thisObj.globalObject(), propertyName, value.functionLength(),
+            value.function(), value.intrinsic(), attributesForStructure(value.attributes()));
+        return;
+    }
</ins><span class="cx"> 
</span><del>-        if (value.attributes() &amp; ConstantInteger) {
-            thisObj.putDirect(vm, propertyName, jsNumber(value.constantInteger()), attributesForStructure(value.attributes()));
-            continue;
-        }
</del><ins>+    if (value.attributes() &amp; ConstantInteger) {
+        thisObj.putDirect(vm, propertyName, jsNumber(value.constantInteger()), attributesForStructure(value.attributes()));
+        return;
+    }
</ins><span class="cx"> 
</span><del>-        if (value.attributes() &amp; Accessor) {
-            reifyStaticAccessor(vm, value, thisObj, propertyName);
-            continue;
-        }
</del><ins>+    if (value.attributes() &amp; Accessor) {
+        reifyStaticAccessor(vm, value, thisObj, propertyName);
+        return;
+    }
</ins><span class="cx"> 
</span><del>-        CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
-        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
-    }
</del><ins>+    CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
+    thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template&lt;unsigned numberOfValues&gt;
+inline void reifyStaticProperties(VM&amp; vm, const HashTableValue (&amp;values)[numberOfValues], JSObject&amp; thisObj)
+{
+    BatchedTransitionOptimizer transitionOptimizer(vm, &amp;thisObj);
+    for (auto&amp; value : values)
+        reifyStaticProperty(vm, value, thisObj);
+}
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><span class="cx"> #endif // Lookup_h
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/WebCore/ChangeLog        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -1,3 +1,63 @@
</span><ins>+2016-02-04  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
+        https://bugs.webkit.org/show_bug.cgi?id=153817
+
+        Reviewed by Geoffrey Garen.
+
+        Update the bindings generator so that property getters / setters now
+        make sure |this| has the right type and throw a TypeError if it does
+        not, as per:
+        - http://heycam.github.io/webidl/#dfn-attribute-getter (step 2.4.2)
+        - http://heycam.github.io/webidl/#dfn-attribute-setter (step 3.5)
+
+        This was an issue when doing something like:
+        Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call(nonWindow)
+
+        We would call toJSDOMWindow(thisValue), which would return null as
+        thisValue is not a JSDOMWindow. We would then dereference this null
+        pointer and crash. We now do a null check and throw a TypeError in
+        this case, as per the Web IDL specification.
+
+        The generated bindings still have some non-spec compliant behavior
+        though:
+        1. The getters / setters of instance properties use slotBase instead
+           of thisValue, which means that calling instanceA's getter on
+           instanceB returns instanceA's property insteas of instanceB's.
+        2. Global object property getters should not require an explicit
+           |this| so calling the following should work:
+           - Object.getOwnPropertyDescriptor(window, &quot;location&quot;).get.call()
+           We currently throw in this case.
+
+        These issues will be addressed in follow-up patches.
+
+        Tests: js/getOwnPropertyDescriptor-unforgeable-attributes.html
+               js/getOwnPropertyDescriptor-window-attributes.html
+               js/instance-property-getter-other-instance.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::jsTestActiveDOMObjectExcitingAttr):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::jsTestExceptionName):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjConstructorTestSubObj):
+        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
+        (WebCore::jsTestObjConditionalAttr4Constructor):
+        (WebCore::jsTestObjConditionalAttr5Constructor):
+        (WebCore::jsTestObjConditionalAttr6Constructor):
+        (WebCore::jsTestObjContentDocument):
+        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
+        (WebCore::setJSTestObjConditionalAttr4Constructor):
+        (WebCore::setJSTestObjConditionalAttr5Constructor):
+        (WebCore::setJSTestObjConditionalAttr6Constructor):
+        (WebCore::setJSTestObjConstructor): Deleted.
+        (WebCore::setJSTestObjConstructorStaticStringAttr): Deleted.
+        (WebCore::setJSTestObjConditionalAttr3): Deleted.
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::jsTestTypedefsConstructorTestSubObj):
+
</ins><span class="cx"> 2016-02-04  Brady Eidson  &lt;beidson@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Modern IDB: LayoutTest imported/w3c/indexeddb/keyorder-private.html is flaky.
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -2285,24 +2285,27 @@
</span><span class="cx">             push(@implContent, &quot;    UNUSED_PARAM(slotBase);\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;);
</span><span class="cx">             if (!$attribute-&gt;isStatic || $attribute-&gt;signature-&gt;type =~ /Constructor$/) {
</span><ins>+                my $variableForTypeCheck = &quot;castedThis&quot;;
</ins><span class="cx">                 if ($interface-&gt;extendedAttributes-&gt;{&quot;CustomProxyToJSObject&quot;}) {
</span><span class="cx">                     push(@implContent, &quot;    auto* castedThis = to${className}(JSValue::decode(thisValue));\n&quot;);
</span><span class="cx">                 } elsif (AttributeShouldBeOnInstance($interface, $attribute)) {
</span><ins>+                    # FIXME: This does not seem right, we should likely use thisValue instead of slotBase here to match the specification:
+                    # http://heycam.github.io/webidl/#dfn-attribute-getter
</ins><span class="cx">                     push(@implContent, &quot;    auto* castedThis = jsCast&lt;JS${interfaceName}*&gt;(slotBase);\n&quot;);
</span><del>-                    if (InterfaceRequiresAttributesOnInstanceForCompatibility($interface)) {
-                        push(@implContent, &quot;    ${className}* castedThisObject = &quot; . GetCastingHelperForThisObject($interface) . &quot;(JSValue::decode(thisValue));\n&quot;);
-                        push(@implContent, &quot;    if (UNLIKELY(!castedThisObject))\n&quot;);
-                        push(@implContent, &quot;        reportDeprecatedGetterError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
-                    }
</del><ins>+                    push(@implContent, &quot;    ${className}* castedThisObject = &quot; . GetCastingHelperForThisObject($interface) . &quot;(JSValue::decode(thisValue));\n&quot;);
+                    $variableForTypeCheck = &quot;castedThisObject&quot;;
</ins><span class="cx">                 } else {
</span><span class="cx">                     push(@implContent, &quot;    ${className}* castedThis = &quot; . GetCastingHelperForThisObject($interface) . &quot;(JSValue::decode(thisValue));\n&quot;);
</span><del>-                    push(@implContent, &quot;    if (UNLIKELY(!castedThis))\n&quot;);
-                    if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;LenientThis&quot;}) {
-                        push(@implContent, &quot;        return JSValue::encode(jsUndefined());\n&quot;);
-                    } else {
-                        push(@implContent, &quot;        return throwGetterTypeError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
-                    }
</del><span class="cx">                 }
</span><ins>+                # FIXME: Getters on a global should not require an explicit this.
+                push(@implContent, &quot;    if (UNLIKELY(!$variableForTypeCheck))\n&quot;);
+                if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;LenientThis&quot;}) {
+                    push(@implContent, &quot;        return JSValue::encode(jsUndefined());\n&quot;);
+                } elsif (InterfaceRequiresAttributesOnInstanceForCompatibility($interface)) {
+                    push(@implContent, &quot;        reportDeprecatedGetterError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
+                } else {
+                    push(@implContent, &quot;        return throwGetterTypeError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
+                }
</ins><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             my @arguments = ();
</span><span class="lines">@@ -2619,28 +2622,26 @@
</span><span class="cx">             push(@implContent, &quot;    JSValue value = JSValue::decode(encodedValue);\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    UNUSED_PARAM(baseObject);\n&quot;);
</span><span class="cx">             if (!$attribute-&gt;isStatic) {
</span><ins>+                my $variableForTypeCheck = &quot;castedThis&quot;;
</ins><span class="cx">                 if ($interface-&gt;extendedAttributes-&gt;{&quot;CustomProxyToJSObject&quot;}) {
</span><span class="cx">                     push(@implContent, &quot;    ${className}* castedThis = to${className}(JSValue::decode(thisValue));\n&quot;);
</span><span class="cx">                 } elsif (AttributeShouldBeOnInstance($interface, $attribute)) {
</span><del>-                    push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;);
</del><span class="cx">                     push(@implContent, &quot;    auto* castedThis = jsCast&lt;JS${interfaceName}*&gt;(baseObject);\n&quot;);
</span><del>-                    if (InterfaceRequiresAttributesOnInstanceForCompatibility($interface)) {
-                        push(@implContent, &quot;    ${className}* castedThisObject = &quot; . GetCastingHelperForThisObject($interface) . &quot;(JSValue::decode(thisValue));\n&quot;);
-                        push(@implContent, &quot;    if (UNLIKELY(!castedThisObject))\n&quot;);
-                        push(@implContent, &quot;        reportDeprecatedSetterError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
-                    } else {
-                        push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;);
-                        push(@implContent, &quot;    UNUSED_PARAM(state);\n&quot;);
-                    }
</del><ins>+                    push(@implContent, &quot;    ${className}* castedThisObject = &quot; . GetCastingHelperForThisObject($interface) . &quot;(JSValue::decode(thisValue));\n&quot;);
+                    $variableForTypeCheck = &quot;castedThisObject&quot;;
</ins><span class="cx">                 } else {
</span><span class="cx">                     push(@implContent, &quot;    ${className}* castedThis = &quot; . GetCastingHelperForThisObject($interface) . &quot;(JSValue::decode(thisValue));\n&quot;);
</span><del>-                    push(@implContent, &quot;    if (UNLIKELY(!castedThis)) {\n&quot;);
-                    if (!$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;LenientThis&quot;}) {
-                        push(@implContent, &quot;        throwSetterTypeError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
-                    }
</del><ins>+                }
+                push(@implContent, &quot;    if (UNLIKELY(!$variableForTypeCheck)) {\n&quot;);
+                if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;LenientThis&quot;}) {
</ins><span class="cx">                     push(@implContent, &quot;        return;\n&quot;);
</span><del>-                    push(@implContent, &quot;    }\n&quot;);
</del><ins>+                } elsif (InterfaceRequiresAttributesOnInstanceForCompatibility($interface)) {
+                    push(@implContent, &quot;        reportDeprecatedSetterError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
+                } else {
+                    push(@implContent, &quot;        throwSetterTypeError(*state, \&quot;$interfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
+                    push(@implContent, &quot;        return;\n&quot;);
</ins><span class="cx">                 }
</span><ins>+                push(@implContent, &quot;    }\n&quot;);
</ins><span class="cx">             }
</span><span class="cx">             if ($interface-&gt;extendedAttributes-&gt;{&quot;CheckSecurity&quot;} &amp;&amp; !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;DoNotCheckSecurity&quot;}) {
</span><span class="cx">                 if ($interfaceName eq &quot;DOMWindow&quot;) {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -150,6 +150,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestActiveDOMObject*&gt;(slotBase);
</span><ins>+    JSTestActiveDOMObject* castedThisObject = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestActiveDOMObject&quot;, &quot;excitingAttr&quot;);
</ins><span class="cx">     if (!BindingSecurity::shouldAllowAccessToDOMWindow(state, castedThis-&gt;wrapped()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -140,6 +140,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestException*&gt;(slotBase);
</span><ins>+    JSTestException* castedThisObject = jsDynamicCast&lt;JSTestException*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestException&quot;, &quot;name&quot;);
</ins><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.name());
</span><span class="cx">     return JSValue::encode(result);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -810,6 +810,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(slotBase);
</span><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestObj&quot;, &quot;TestSubObj&quot;);
</ins><span class="cx">     return JSValue::encode(JSTestSubObj::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -820,6 +823,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(slotBase);
</span><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestObj&quot;, &quot;TestSubObjEnabledBySetting&quot;);
</ins><span class="cx">     if (!castedThis-&gt;wrapped().frame())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Settings&amp; settings = castedThis-&gt;wrapped().frame()-&gt;settings();
</span><span class="lines">@@ -1506,6 +1512,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(slotBase);
</span><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestObj&quot;, &quot;conditionalAttr4&quot;);
</ins><span class="cx">     return JSValue::encode(JSTestObjectA::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1518,6 +1527,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(slotBase);
</span><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestObj&quot;, &quot;conditionalAttr5&quot;);
</ins><span class="cx">     return JSValue::encode(JSTestObjectB::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1530,6 +1542,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(slotBase);
</span><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestObj&quot;, &quot;conditionalAttr6&quot;);
</ins><span class="cx">     return JSValue::encode(JSTestObjectC::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1589,6 +1604,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(slotBase);
</span><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestObj&quot;, &quot;contentDocument&quot;);
</ins><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     return JSValue::encode(shouldAllowAccessToNode(state, impl.contentDocument()) ? toJS(state, castedThis-&gt;globalObject(), WTF::getPtr(impl.contentDocument())) : jsNull());
</span><span class="cx"> }
</span><span class="lines">@@ -1884,10 +1902,12 @@
</span><span class="cx"> {
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     UNUSED_PARAM(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
</del><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
-    UNUSED_PARAM(state);
</del><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject)) {
+        throwSetterTypeError(*state, &quot;TestObj&quot;, &quot;TestSubObjEnabledBySetting&quot;);
+        return;
+    }
</ins><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;TestSubObjEnabledBySetting&quot;), value);
</span><span class="cx"> }
</span><span class="lines">@@ -2670,10 +2690,12 @@
</span><span class="cx"> {
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     UNUSED_PARAM(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
</del><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
-    UNUSED_PARAM(state);
</del><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject)) {
+        throwSetterTypeError(*state, &quot;TestObj&quot;, &quot;conditionalAttr4&quot;);
+        return;
+    }
</ins><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;conditionalAttr4&quot;), value);
</span><span class="cx"> }
</span><span class="lines">@@ -2685,10 +2707,12 @@
</span><span class="cx"> {
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     UNUSED_PARAM(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
</del><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
-    UNUSED_PARAM(state);
</del><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject)) {
+        throwSetterTypeError(*state, &quot;TestObj&quot;, &quot;conditionalAttr5&quot;);
+        return;
+    }
</ins><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;conditionalAttr5&quot;), value);
</span><span class="cx"> }
</span><span class="lines">@@ -2700,10 +2724,12 @@
</span><span class="cx"> {
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     UNUSED_PARAM(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
</del><span class="cx">     auto* castedThis = jsCast&lt;JSTestObj*&gt;(baseObject);
</span><del>-    UNUSED_PARAM(thisValue);
-    UNUSED_PARAM(state);
</del><ins>+    JSTestObj* castedThisObject = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject)) {
+        throwSetterTypeError(*state, &quot;TestObj&quot;, &quot;conditionalAttr6&quot;);
+        return;
+    }
</ins><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;conditionalAttr6&quot;), value);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (196144 => 196145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2016-02-04 21:20:10 UTC (rev 196144)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2016-02-04 21:36:04 UTC (rev 196145)
</span><span class="lines">@@ -244,6 +244,9 @@
</span><span class="cx">     UNUSED_PARAM(slotBase);
</span><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     auto* castedThis = jsCast&lt;JSTestTypedefs*&gt;(slotBase);
</span><ins>+    JSTestTypedefs* castedThisObject = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
+    if (UNLIKELY(!castedThisObject))
+        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;TestSubObj&quot;);
</ins><span class="cx">     return JSValue::encode(JSTestSubObj::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>