<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[196374] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/196374">196374</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-02-10 11:47:10 -0800 (Wed, 10 Feb 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Attributes on the Window instance should be configurable unless [Unforgeable]
https://bugs.webkit.org/show_bug.cgi?id=153920
<rdar://problem/24563211>
Reviewed by Darin Adler.
Source/JavaScriptCore:
Marking the Window instance attributes as configurable but cause
getOwnPropertyDescriptor() to report them as configurable, as
expected. However, trying to delete them would actually lead to
unexpected behavior because:
- We did not reify custom accessor properties (most of the Window
properties are custom accessors) upon deletion.
- For non-reified static properties marked as configurable,
JSObject::deleteProperty() would attempt to call the property
setter with undefined. As a result, calling delete window.name
would cause window.name to become the string "undefined" instead
of the undefined value.
* runtime/JSObject.cpp:
(JSC::getClassPropertyNames):
Now that we reify ALL properties, we only need to check the property table
if we have not reified. As a result, I dropped the 'didReify' parameter for
this function and instead only call this function if we have not yet reified.
(JSC::JSObject::putInlineSlow):
Only call putEntry() if we have not reified: Drop the
'|| !(entry->attributes() & BuiltinOrFunctionOrAccessor)'
check as such properties now get reified as well.
(JSC::JSObject::deleteProperty):
- Call reifyAllStaticProperties() instead of reifyStaticFunctionsForDelete()
so that we now reify all properties upon deletion, including the custom
accessors. reifyStaticFunctionsForDelete() is now removed and the same
reification function is now used by: deletion, getOwnPropertyDescriptor()
and eager reification of the prototype objects in the bindings.
- Drop code that falls back to calling the static property setter with
undefined if we cannot find the property in the property storage. As
we now reify ALL properties, the code removing the property from the
property storage should succeed, provided that the property actually
exists.
(JSC::JSObject::getOwnNonIndexPropertyNames):
Only call getClassPropertyNames() if we have not reified. We should no longer
check the static property table after reifying now that we reify all
properties.
(JSC::JSObject::reifyAllStaticProperties):
Merge with reifyStaticFunctionsForDelete(). The only behavior change is the
flattening to an uncacheable dictionary, like reifyStaticFunctionsForDelete()
used to do.
* runtime/JSObject.h:
Source/WebCore:
Attributes on the Window instance should be configurable unless [Unforgeable]:
1. 'constructor' property:
- http://www.w3.org/TR/WebIDL/#interface-prototype-object
2. Constructor properties (e.g. window.Node):
- http://www.w3.org/TR/WebIDL/#es-interfaces
3. IDL attributes:
- http://heycam.github.io/webidl/#es-attributes (configurable unless
[Unforgeable], e.g. window.location)
Firefox complies with the WebIDL specification but WebKit does not for 1. and 3.
Test: fast/dom/Window/window-properties-configurable.html
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::getOwnPropertySlot):
For known Window properties (i.e. properties in the static property table),
if we have reified and this is same-origin access, then call
Base::getOwnPropertySlot() to get the property from the local property
storage. If we have not reified yet, or this is cross-origin access, query
the static property table. This is to match the behavior of Firefox and
Chrome which seem to keep returning the original properties upon cross
origin access, even if those were deleted or redefined.
(WebCore::JSDOMWindow::put):
The previous code used to call the static property setter for properties in
the static table. However, this does not do the right thing if properties
were reified. For example, deleting window.name and then trying to set it
again would not work. Therefore, update this code to only do this if the
properties have not been reified, similarly to what is done in
JSObject::putInlineSlow().
* bindings/scripts/CodeGeneratorJS.pm:
(ConstructorShouldBeOnInstance):
Add a FIXME comment indicating that window.constructor should be on
the prototype as per the Web IDL specification.
(GenerateAttributesHashTable):
- Mark 'constructor' property as configurable for Window, as per the
specification and consistently with other 'constructor' properties:
http://www.w3.org/TR/WebIDL/#interface-prototype-object
- Mark properties as configurable even though they are on the instance.
Window has its properties on the instance as per the specification:
1. http://heycam.github.io/webidl/#es-attributes
2. http://heycam.github.io/webidl/#PrimaryGlobal (window is [PrimaryGlobal]
However, these properties should be configurable as long as they are
not marked as [Unforgeable], as per 1.
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
* bindings/scripts/test/JS/JSTestException.cpp:
* bindings/scripts/test/JS/JSTestObj.cpp:
Rebaseline bindings tests.
LayoutTests:
* fast/dom/Window/window-properties-configurable-expected.txt: Added.
* fast/dom/Window/window-properties-configurable.html: Added.
Add a test to check that Window properties are reported as configurable
unless the [Unforgeable] ones and that deleting them actually works.
* fast/dom/global-constructors.html:
Update test so it no longer expects window.Node to be shadowable. As per
the specification, the "Node" property is on the window instance, not its
prototype. Therefore, it should cannot be shadowed and setting it to
something actually overwites the previous value, given that the property
is writable as per:
- http://heycam.github.io/webidl/#es-interfaces
I have verified that the new behavior is consistent with Firefox.
* http/tests/security/cross-origin-reified-window-property-access-expected.txt: Added.
* http/tests/security/cross-origin-reified-window-property-access.html: Added.
* http/tests/security/resources/reify-window.html: Added.
Add a test case to cover cross-origin access of Window properties after
reification.
* js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt:
* js/getOwnPropertyDescriptor-unforgeable-attributes.html:
Drop window.self from the list of unforgeable attributes. This attribute
is not unforgeable in our implementation or in the specification:
- https://html.spec.whatwg.org/multipage/browsers.html#the-window-object
* js/getOwnPropertyDescriptor-window-attributes-expected.txt:
* js/getOwnPropertyDescriptor-window-attributes.html:
- Add coverage for window.self which is a regular Window property.
- Add coverage for window.Node which is a constructor property
- Add coverage for window.constructor. It should really be on the prototype
as per the specification but this at least checks that the property is
configurable, as per the specification.
- Rebaseline the test as more checks are passing now that Window properties
are marked as configurable.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsfastdomglobalconstructorshtml">trunk/LayoutTests/fast/dom/global-constructors.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributesexpectedtxt">trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributeshtml">trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributesexpectedtxt">trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributeshtml">trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeLookuph">trunk/Source/JavaScriptCore/runtime/Lookup.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastdomWindowwindowpropertiesconfigurableexpectedtxt">trunk/LayoutTests/fast/dom/Window/window-properties-configurable-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowwindowpropertiesconfigurablehtml">trunk/LayoutTests/fast/dom/Window/window-properties-configurable.html</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossoriginreifiedwindowpropertyaccessexpectedtxt">trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritycrossoriginreifiedwindowpropertyaccesshtml">trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access.html</a></li>
<li><a href="#trunkLayoutTestshttptestssecurityresourcesreifywindowhtml">trunk/LayoutTests/http/tests/security/resources/reify-window.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/ChangeLog 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -1,3 +1,47 @@
</span><ins>+2016-02-10 Chris Dumez <cdumez@apple.com>
+
+ Attributes on the Window instance should be configurable unless [Unforgeable]
+ https://bugs.webkit.org/show_bug.cgi?id=153920
+ <rdar://problem/24563211>
+
+ Reviewed by Darin Adler.
+
+ * fast/dom/Window/window-properties-configurable-expected.txt: Added.
+ * fast/dom/Window/window-properties-configurable.html: Added.
+ Add a test to check that Window properties are reported as configurable
+ unless the [Unforgeable] ones and that deleting them actually works.
+
+ * fast/dom/global-constructors.html:
+ Update test so it no longer expects window.Node to be shadowable. As per
+ the specification, the "Node" property is on the window instance, not its
+ prototype. Therefore, it should cannot be shadowed and setting it to
+ something actually overwites the previous value, given that the property
+ is writable as per:
+ - http://heycam.github.io/webidl/#es-interfaces
+ I have verified that the new behavior is consistent with Firefox.
+
+ * http/tests/security/cross-origin-reified-window-property-access-expected.txt: Added.
+ * http/tests/security/cross-origin-reified-window-property-access.html: Added.
+ * http/tests/security/resources/reify-window.html: Added.
+ Add a test case to cover cross-origin access of Window properties after
+ reification.
+
+ * js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt:
+ * js/getOwnPropertyDescriptor-unforgeable-attributes.html:
+ Drop window.self from the list of unforgeable attributes. This attribute
+ is not unforgeable in our implementation or in the specification:
+ - https://html.spec.whatwg.org/multipage/browsers.html#the-window-object
+
+ * js/getOwnPropertyDescriptor-window-attributes-expected.txt:
+ * js/getOwnPropertyDescriptor-window-attributes.html:
+ - Add coverage for window.self which is a regular Window property.
+ - Add coverage for window.Node which is a constructor property
+ - Add coverage for window.constructor. It should really be on the prototype
+ as per the specification but this at least checks that the property is
+ configurable, as per the specification.
+ - Rebaseline the test as more checks are passing now that Window properties
+ are marked as configurable.
+
</ins><span class="cx"> 2016-02-10 Ryan Haddad <ryanhaddad@apple.com>
</span><span class="cx">
</span><span class="cx"> Skop fast/regions/text-break-properties.html on ios-simulator
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowwindowpropertiesconfigurableexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/Window/window-properties-configurable-expected.txt (0 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/window-properties-configurable-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/Window/window-properties-configurable-expected.txt 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -0,0 +1,37 @@
</span><ins>+Tests that Window properties are indeed configurable unless [Unforgeable]
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+* Regular IDL attribute.
+PASS Object.getOwnPropertyDescriptor(window, 'name').configurable is true
+PASS window.name is ""
+PASS delete window.name is true
+PASS window.name is undefined.
+window.name = 3
+PASS window.name is 3
+PASS delete window.name is true
+PASS window.name is undefined.
+
+* Constructor attributes.
+PASS Object.getOwnPropertyDescriptor(window, 'Node').configurable is true
+PASS window.Node is not undefined
+PASS delete window.Node is true
+PASS window.Node is undefined.
+window.Node = 3
+PASS window.Node is 3
+PASS delete window.Node is true
+PASS window.Node is undefined.
+
+* [Unforgeable] IDL attribute.
+PASS Object.getOwnPropertyDescriptor(window, 'window').configurable is false
+PASS window.window is not undefined
+PASS delete window.window is false
+PASS window.window is not undefined
+window.window = 3
+PASS window.window is not 3
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowwindowpropertiesconfigurablehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/dom/Window/window-properties-configurable.html (0 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/window-properties-configurable.html (rev 0)
+++ trunk/LayoutTests/fast/dom/Window/window-properties-configurable.html 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -0,0 +1,42 @@
</span><ins>+<!DOCYTPE html>
+<html>
+<body>
+<script src="../../../resources/js-test-pre.js"></script>
+<script>
+description("Tests that Window properties are indeed configurable unless [Unforgeable]");
+
+debug("* Regular IDL attribute.");
+shouldBeTrue("Object.getOwnPropertyDescriptor(window, 'name').configurable");
+shouldBeEqualToString("window.name", "");
+shouldBeTrue("delete window.name");
+shouldBeUndefined("window.name");
+evalAndLog("window.name = 3");
+shouldBe("window.name", "3");
+shouldBeTrue("delete window.name");
+shouldBeUndefined("window.name");
+
+debug("");
+debug("* Constructor attributes.");
+shouldBeTrue("Object.getOwnPropertyDescriptor(window, 'Node').configurable");
+shouldNotBe("window.Node", "undefined");
+shouldBeTrue("delete window.Node");
+shouldBeUndefined("window.Node");
+evalAndLog("window.Node = 3");
+shouldBe("window.Node", "3");
+shouldBeTrue("delete window.Node");
+shouldBeUndefined("window.Node");
+
+debug("");
+debug("* [Unforgeable] IDL attribute.");
+shouldBeFalse("Object.getOwnPropertyDescriptor(window, 'window').configurable");
+shouldNotBe("window.window", "undefined");
+shouldBeFalse("delete window.window");
+shouldNotBe("window.window", "undefined");
+evalAndLog("window.window = 3");
+shouldNotBe("window.window", "3");
+
+debug("");
+</script>
+<script src="../../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsfastdomglobalconstructorshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/global-constructors.html (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/global-constructors.html 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/fast/dom/global-constructors.html 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -95,16 +95,18 @@
</span><span class="cx">
</span><span class="cx"> originalNodeConstructor = window.Node;
</span><span class="cx">
</span><del>- // Shadow window.Node
</del><ins>+ // Set window.Node
</ins><span class="cx"> window.Node = 1;
</span><span class="cx"> print("[Set window.Node = 1]");
</span><span class="cx"> shouldBe("window.Node", 1);
</span><span class="cx">
</span><del>- // Unshadow window.Node
</del><ins>+ // Delete window.Node
</ins><span class="cx"> delete window.Node;
</span><span class="cx"> print("[Deleted window.Node]");
</span><del>- shouldBe("window.Node", originalNodeConstructor);
</del><ins>+ shouldBe("window.Node", undefined);
</ins><span class="cx">
</span><ins>+ window.Node = originalNodeConstructor;
+
</ins><span class="cx"> // Attempt to shadow window.Node with a frame named 'Node'
</span><span class="cx"> var iframe = document.createElement('iframe');
</span><span class="cx"> iframe.setAttribute('name', "Node");
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossoriginreifiedwindowpropertyaccessexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access-expected.txt (0 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access-expected.txt 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+CONSOLE MESSAGE: line 16: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 16: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 16: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+Tests that reification does not bypass cross-origin checks.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS crossOriginWindow.document returned undefined.
+PASS crossOriginWindow.name returned undefined.
+PASS crossOriginWindow.menubar returned undefined.
+PASS crossOriginWindow.scrollbars") threw exception SyntaxError: Unexpected EOF.
+PASS crossOriginWindow.navigator") threw exception SyntaxError: Unexpected EOF.
+PASS crossOriginWindow.screenX") threw exception SyntaxError: Unexpected EOF.
+PASS crossOriginWindow.location is not undefined
+PASS crossOriginWindow.self is crossOriginWindow.window
+PASS sameOriginWindow.self is "secret"
+PASS crossOriginWindow.parent is window
+PASS sameOriginWindow.parent is sameOriginWindow.document.getElementById("parent")
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritycrossoriginreifiedwindowpropertyaccesshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access.html (0 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access.html 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -0,0 +1,54 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body onload="runTest()">
+<iframe id="crossOriginFrame" src="http://localhost:8000/security/resources/reify-window.html"></iframe>
+<iframe id="sameOriginFrame" src="resources/reify-window.html"></iframe>
+<script>
+description("Tests that reification does not bypass cross-origin checks.");
+jsTestIsAsync = true;
+
+function shouldThrowOrReturnUndefined(expression)
+{
+ try {
+ result = eval(expression);
+ } catch (e) {
+ testPassed(expression + " threw exception " + e + ".");
+ return;
+ }
+ if (result === undefined)
+ testPassed(expression + " returned undefined.");
+ else
+ testFailed(expression + " returned " + result);
+}
+
+function runTest()
+{
+ crossOriginWindow = crossOriginFrame.window;
+ sameOriginWindow = sameOriginFrame.window;
+
+ shouldThrowOrReturnUndefined('crossOriginWindow.document');
+ shouldThrowOrReturnUndefined('crossOriginWindow.name');
+ shouldThrowOrReturnUndefined('crossOriginWindow.menubar');
+ shouldThrowOrReturnUndefined('crossOriginWindow.scrollbars")');
+ shouldThrowOrReturnUndefined('crossOriginWindow.navigator")');
+ shouldThrowOrReturnUndefined('crossOriginWindow.screenX")');
+ shouldNotBe('crossOriginWindow.location', 'undefined');
+
+ // Even though window.self was deleted, we still use the original static property getter, to match
+ // Firefox and Chrome.
+ shouldBe('crossOriginWindow.self', 'crossOriginWindow.window');
+ shouldBeEqualToString("sameOriginWindow.self", "secret");
+
+ // Test the case where a deleted window attribute was shadowing a named property.
+ shouldBe('crossOriginWindow.parent', 'window');
+ shouldBe('sameOriginWindow.parent', 'sameOriginWindow.document.getElementById("parent")');
+
+ finishJSTest();
+}
+</script>
+</body>
+<script src="../../resources/js-test-post.js"></script>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecurityresourcesreifywindowhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/http/tests/security/resources/reify-window.html (0 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/resources/reify-window.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/reify-window.html 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -0,0 +1,8 @@
</span><ins>+<script>
+delete window.self;
+window.self = "secret";
+
+// Deleting window.parent exposes the div with id "parent" returned by the named property getter.
+delete window.parent;
+</script>
+<div id="parent"></div>
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -3800,30 +3800,34 @@
</span><span class="cx"> PASS Window interface object name
</span><span class="cx"> FAIL Window interface: existence and properties of interface prototype object assert_equals: Class name for prototype of Window.prototype is not "WindowProperties" expected "[object WindowProperties]" but got "[object Object]"
</span><span class="cx"> FAIL Window interface: existence and properties of interface prototype object's "constructor" property assert_own_property: Window.prototype does not have own property "constructor" expected property "constructor" missing
</span><del>-FAIL Window interface: attribute self assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute name assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute history assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute locationbar assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute menubar assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute personalbar assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute scrollbars assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute statusbar assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute toolbar assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute status assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute self
+PASS Window interface: attribute name
+FAIL Window interface: attribute history assert_equals: setter must be undefined for readonly attributes expected (undefined) undefined but got (function) function "function history() {
+ [native code]
+}"
+PASS Window interface: attribute locationbar
+PASS Window interface: attribute menubar
+PASS Window interface: attribute personalbar
+PASS Window interface: attribute scrollbars
+PASS Window interface: attribute statusbar
+PASS Window interface: attribute toolbar
+PASS Window interface: attribute status
</ins><span class="cx"> FAIL Window interface: operation close() assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><del>-FAIL Window interface: attribute closed assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute closed
</ins><span class="cx"> FAIL Window interface: operation stop() desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation focus() assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><span class="cx"> FAIL Window interface: operation blur() assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><del>-FAIL Window interface: attribute frames assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute length assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute opener assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute parent assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute frameElement assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute frames
+PASS Window interface: attribute length
+PASS Window interface: attribute opener
+PASS Window interface: attribute parent
+PASS Window interface: attribute frameElement
</ins><span class="cx"> FAIL Window interface: operation open(DOMString,DOMString,DOMString,boolean) desc is not an Object. (evaluating '"get" in desc')
</span><del>-FAIL Window interface: attribute navigator assert_true: property must be configurable expected true got false
</del><ins>+FAIL Window interface: attribute navigator assert_equals: setter must be undefined for readonly attributes expected (undefined) undefined but got (function) function "function navigator() {
+ [native code]
+}"
</ins><span class="cx"> FAIL Window interface: attribute external assert_own_property: The global object must have a property "external" expected property "external" missing
</span><del>-FAIL Window interface: attribute applicationCache assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute applicationCache
</ins><span class="cx"> FAIL Window interface: operation alert() desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation confirm(DOMString) desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation prompt(DOMString,DOMString) desc is not an Object. (evaluating '"get" in desc')
</span><span class="lines">@@ -3832,82 +3836,82 @@
</span><span class="cx"> FAIL Window interface: operation postMessage(any,DOMString,[object Object]) assert_equals: property should be writable if and only if not unforgeable expected true but got false
</span><span class="cx"> FAIL Window interface: operation captureEvents() desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation releaseEvents() desc is not an Object. (evaluating '"get" in desc')
</span><del>-FAIL Window interface: attribute onabort assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute onabort
</ins><span class="cx"> FAIL Window interface: attribute onautocomplete assert_own_property: The global object must have a property "onautocomplete" expected property "onautocomplete" missing
</span><span class="cx"> FAIL Window interface: attribute onautocompleteerror assert_own_property: The global object must have a property "onautocompleteerror" expected property "onautocompleteerror" missing
</span><del>-FAIL Window interface: attribute onblur assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute onblur
</ins><span class="cx"> FAIL Window interface: attribute oncancel assert_own_property: The global object must have a property "oncancel" expected property "oncancel" missing
</span><del>-FAIL Window interface: attribute oncanplay assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute oncanplaythrough assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onchange assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onclick assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute oncanplay
+PASS Window interface: attribute oncanplaythrough
+PASS Window interface: attribute onchange
+PASS Window interface: attribute onclick
</ins><span class="cx"> FAIL Window interface: attribute onclose assert_own_property: The global object must have a property "onclose" expected property "onclose" missing
</span><del>-FAIL Window interface: attribute oncontextmenu assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute oncontextmenu
</ins><span class="cx"> FAIL Window interface: attribute oncuechange assert_own_property: The global object must have a property "oncuechange" expected property "oncuechange" missing
</span><del>-FAIL Window interface: attribute ondblclick assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondrag assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondragend assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondragenter assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute ondblclick
+PASS Window interface: attribute ondrag
+PASS Window interface: attribute ondragend
+PASS Window interface: attribute ondragenter
</ins><span class="cx"> FAIL Window interface: attribute ondragexit assert_own_property: The global object must have a property "ondragexit" expected property "ondragexit" missing
</span><del>-FAIL Window interface: attribute ondragleave assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondragover assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondragstart assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondrop assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ondurationchange assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onemptied assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onended assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onerror assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onfocus assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute oninput assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute oninvalid assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onkeydown assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onkeypress assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onkeyup assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onload assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onloadeddata assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onloadedmetadata assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onloadstart assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmousedown assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmouseenter assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmouseleave assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmousemove assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmouseout assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmouseover assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmouseup assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onmousewheel assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onpause assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onplay assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onplaying assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onprogress assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onratechange assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onreset assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onresize assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onscroll assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onseeked assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onseeking assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onselect assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute ondragleave
+PASS Window interface: attribute ondragover
+PASS Window interface: attribute ondragstart
+PASS Window interface: attribute ondrop
+PASS Window interface: attribute ondurationchange
+PASS Window interface: attribute onemptied
+PASS Window interface: attribute onended
+PASS Window interface: attribute onerror
+PASS Window interface: attribute onfocus
+PASS Window interface: attribute oninput
+PASS Window interface: attribute oninvalid
+PASS Window interface: attribute onkeydown
+PASS Window interface: attribute onkeypress
+PASS Window interface: attribute onkeyup
+PASS Window interface: attribute onload
+PASS Window interface: attribute onloadeddata
+PASS Window interface: attribute onloadedmetadata
+PASS Window interface: attribute onloadstart
+PASS Window interface: attribute onmousedown
+PASS Window interface: attribute onmouseenter
+PASS Window interface: attribute onmouseleave
+PASS Window interface: attribute onmousemove
+PASS Window interface: attribute onmouseout
+PASS Window interface: attribute onmouseover
+PASS Window interface: attribute onmouseup
+PASS Window interface: attribute onmousewheel
+PASS Window interface: attribute onpause
+PASS Window interface: attribute onplay
+PASS Window interface: attribute onplaying
+PASS Window interface: attribute onprogress
+PASS Window interface: attribute onratechange
+PASS Window interface: attribute onreset
+PASS Window interface: attribute onresize
+PASS Window interface: attribute onscroll
+PASS Window interface: attribute onseeked
+PASS Window interface: attribute onseeking
+PASS Window interface: attribute onselect
</ins><span class="cx"> FAIL Window interface: attribute onshow assert_own_property: The global object must have a property "onshow" expected property "onshow" missing
</span><span class="cx"> FAIL Window interface: attribute onsort assert_own_property: The global object must have a property "onsort" expected property "onsort" missing
</span><del>-FAIL Window interface: attribute onstalled assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onsubmit assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onsuspend assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ontimeupdate assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute onstalled
+PASS Window interface: attribute onsubmit
+PASS Window interface: attribute onsuspend
+PASS Window interface: attribute ontimeupdate
</ins><span class="cx"> FAIL Window interface: attribute ontoggle assert_own_property: The global object must have a property "ontoggle" expected property "ontoggle" missing
</span><del>-FAIL Window interface: attribute onvolumechange assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onwaiting assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute onvolumechange
+PASS Window interface: attribute onwaiting
</ins><span class="cx"> FAIL Window interface: attribute onafterprint assert_own_property: The global object must have a property "onafterprint" expected property "onafterprint" missing
</span><span class="cx"> FAIL Window interface: attribute onbeforeprint assert_own_property: The global object must have a property "onbeforeprint" expected property "onbeforeprint" missing
</span><del>-FAIL Window interface: attribute onbeforeunload assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onhashchange assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute onbeforeunload
+PASS Window interface: attribute onhashchange
</ins><span class="cx"> FAIL Window interface: attribute onlanguagechange assert_own_property: The global object must have a property "onlanguagechange" expected property "onlanguagechange" missing
</span><del>-FAIL Window interface: attribute onmessage assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onoffline assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute ononline assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onpagehide assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onpageshow assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onpopstate assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onstorage assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute onunload assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute onmessage
+PASS Window interface: attribute onoffline
+PASS Window interface: attribute ononline
+PASS Window interface: attribute onpagehide
+PASS Window interface: attribute onpageshow
+PASS Window interface: attribute onpopstate
+PASS Window interface: attribute onstorage
+PASS Window interface: attribute onunload
</ins><span class="cx"> FAIL Window interface: operation btoa(DOMString) desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation atob(DOMString) desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation setTimeout(Function,long,any) desc is not an Object. (evaluating '"get" in desc')
</span><span class="lines">@@ -3917,8 +3921,8 @@
</span><span class="cx"> FAIL Window interface: operation setInterval(DOMString,long,any) desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation clearInterval(long) desc is not an Object. (evaluating '"get" in desc')
</span><span class="cx"> FAIL Window interface: operation createImageBitmap(ImageBitmapSource,long,long,long,long) assert_own_property: global object missing non-static operation expected property "createImageBitmap" missing
</span><del>-FAIL Window interface: attribute sessionStorage assert_true: property must be configurable expected true got false
-FAIL Window interface: attribute localStorage assert_true: property must be configurable expected true got false
</del><ins>+PASS Window interface: attribute sessionStorage
+PASS Window interface: attribute localStorage
</ins><span class="cx"> PASS Window must be primary interface of window
</span><span class="cx"> PASS Stringification of window
</span><span class="cx"> PASS Window interface: window must have own property "window"
</span></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes-expected.txt 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -98,14 +98,6 @@
</span><span class="cx"> PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.location getter can only be used on instances of DOMWindow.
</span><span class="cx"> PASS descriptor.get.call(window) === window.location is true
</span><span class="cx">
</span><del>-* Window.self
-PASS descriptor.get is an instance of Function
-PASS descriptor.set is an instance of Function
-PASS descriptor.enumerable is true
-PASS descriptor.configurable is false
-PASS descriptor.get.call(invalidObject) threw exception TypeError: The DOMWindow.self getter can only be used on instances of DOMWindow.
-PASS descriptor.get.call(window) === window.self is true
-
</del><span class="cx"> * Window.window
</span><span class="cx"> PASS descriptor.get is an instance of Function
</span><span class="cx"> PASS descriptor.set is undefined.
</span></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorunforgeableattributeshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-unforgeable-attributes.html 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -43,12 +43,6 @@
</span><span class="cx"> shouldBeTrue("descriptor.get.call(window) === window.location");
</span><span class="cx">
</span><span class="cx"> debug("");
</span><del>-debug("* Window.self");
-descriptor = Object.getOwnPropertyDescriptor(window, "self");
-checkUnforgeablePropertyDescriptor(descriptor);
-shouldBeTrue("descriptor.get.call(window) === window.self");
-
-debug("");
</del><span class="cx"> debug("* Window.window");
</span><span class="cx"> descriptor = Object.getOwnPropertyDescriptor(window, "window");
</span><span class="cx"> checkUnforgeablePropertyDescriptor(descriptor, true);
</span></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes-expected.txt 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -7,7 +7,7 @@
</span><span class="cx"> PASS descriptor.get is an instance of Function
</span><span class="cx"> PASS descriptor.set is an instance of Function
</span><span class="cx"> PASS descriptor.enumerable is true
</span><del>-FAIL descriptor.configurable should be true. Was false.
</del><ins>+PASS descriptor.configurable is true
</ins><span class="cx"> PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.screen getter can only be used on instances of DOMWindow.
</span><span class="cx"> PASS descriptor.get.call(window) === window.screen is true
</span><span class="cx"> PASS descriptor.get.call() === window.screen is true
</span><span class="lines">@@ -16,16 +16,25 @@
</span><span class="cx"> PASS descriptor.get is an instance of Function
</span><span class="cx"> PASS descriptor.set is an instance of Function
</span><span class="cx"> PASS descriptor.enumerable is true
</span><del>-FAIL descriptor.configurable should be true. Was false.
</del><ins>+PASS descriptor.configurable is true
</ins><span class="cx"> PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.navigator getter can only be used on instances of DOMWindow.
</span><span class="cx"> PASS descriptor.get.call(window) === window.navigator is true
</span><span class="cx"> PASS descriptor.get.call() === window.navigator is true
</span><span class="cx">
</span><ins>+* Window.self
+PASS descriptor.get is an instance of Function
+PASS descriptor.set is an instance of Function
+PASS descriptor.enumerable is true
+PASS descriptor.configurable is true
+PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.self getter can only be used on instances of DOMWindow.
+PASS descriptor.get.call(window) === window.self is true
+PASS descriptor.get.call() === window.self is true
+
</ins><span class="cx"> * Window.frameElement
</span><span class="cx"> PASS descriptor.get is an instance of Function
</span><span class="cx"> PASS descriptor.set is undefined.
</span><span class="cx"> PASS descriptor.enumerable is true
</span><del>-FAIL descriptor.configurable should be true. Was false.
</del><ins>+PASS descriptor.configurable is true
</ins><span class="cx"> PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.frameElement getter can only be used on instances of DOMWindow.
</span><span class="cx"> PASS descriptor.get.call(window) === window.frameElement is true
</span><span class="cx"> PASS descriptor.get.call() === window.frameElement is true
</span><span class="lines">@@ -34,10 +43,23 @@
</span><span class="cx"> PASS descriptor.get is an instance of Function
</span><span class="cx"> PASS descriptor.set is an instance of Function
</span><span class="cx"> PASS descriptor.enumerable is true
</span><del>-FAIL descriptor.configurable should be true. Was false.
</del><ins>+PASS descriptor.configurable is true
</ins><span class="cx"> PASS descriptor.get.call(nonWindowObject) threw exception TypeError: The DOMWindow.name getter can only be used on instances of DOMWindow.
</span><span class="cx"> PASS descriptor.get.call(window) === window.name is true
</span><span class="cx"> PASS descriptor.get.call() === window.name is true
</span><ins>+
+* window.Node
+PASS descriptor.enumerable is false
+PASS descriptor.writable is true
+PASS descriptor.configurable is true
+PASS descriptor.value is window.Node
+
+* window.constructor
+PASS descriptor.enumerable is false
+PASS descriptor.writable is true
+PASS descriptor.configurable is true
+PASS descriptor.value is window.Window
+
</ins><span class="cx"> PASS successfullyParsed is true
</span><span class="cx">
</span><span class="cx"> TEST COMPLETE
</span></span></pre></div>
<a id="trunkLayoutTestsjsgetOwnPropertyDescriptorwindowattributeshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/LayoutTests/js/getOwnPropertyDescriptor-window-attributes.html 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -33,6 +33,13 @@
</span><span class="cx"> shouldBeTrue("descriptor.get.call() === window.navigator");
</span><span class="cx">
</span><span class="cx"> debug("");
</span><ins>+debug("* Window.self");
+descriptor = Object.getOwnPropertyDescriptor(window, "self");
+checkWindowPropertyDescriptor(descriptor);
+shouldBeTrue("descriptor.get.call(window) === window.self");
+shouldBeTrue("descriptor.get.call() === window.self");
+
+debug("");
</ins><span class="cx"> debug("* Window.frameElement");
</span><span class="cx"> descriptor = Object.getOwnPropertyDescriptor(window, "frameElement");
</span><span class="cx"> checkWindowPropertyDescriptor(descriptor, true);
</span><span class="lines">@@ -46,5 +53,23 @@
</span><span class="cx"> shouldBeTrue("descriptor.get.call(window) === window.name");
</span><span class="cx"> shouldBeTrue("descriptor.get.call() === window.name");
</span><span class="cx">
</span><ins>+debug("");
+debug("* window.Node");
+descriptor = Object.getOwnPropertyDescriptor(window, "Node");
+shouldBeFalse("descriptor.enumerable");
+shouldBeTrue("descriptor.writable");
+shouldBeTrue("descriptor.configurable");
+shouldBe("descriptor.value", "window.Node");
+
+debug("");
+// FIXME: 'constructor' should be on the prototype.
+debug("* window.constructor");
+descriptor = Object.getOwnPropertyDescriptor(window, "constructor");
+shouldBeFalse("descriptor.enumerable");
+shouldBeTrue("descriptor.writable");
+shouldBeTrue("descriptor.configurable");
+shouldBe("descriptor.value", "window.Window");
+
+debug("");
</ins><span class="cx"> </script>
</span><span class="cx"> <script src="../resources/js-test-post.js"></script>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -1,3 +1,58 @@
</span><ins>+2016-02-10 Chris Dumez <cdumez@apple.com>
+
+ Attributes on the Window instance should be configurable unless [Unforgeable]
+ https://bugs.webkit.org/show_bug.cgi?id=153920
+ <rdar://problem/24563211>
+
+ Reviewed by Darin Adler.
+
+ Marking the Window instance attributes as configurable but cause
+ getOwnPropertyDescriptor() to report them as configurable, as
+ expected. However, trying to delete them would actually lead to
+ unexpected behavior because:
+ - We did not reify custom accessor properties (most of the Window
+ properties are custom accessors) upon deletion.
+ - For non-reified static properties marked as configurable,
+ JSObject::deleteProperty() would attempt to call the property
+ setter with undefined. As a result, calling delete window.name
+ would cause window.name to become the string "undefined" instead
+ of the undefined value.
+
+ * runtime/JSObject.cpp:
+ (JSC::getClassPropertyNames):
+ Now that we reify ALL properties, we only need to check the property table
+ if we have not reified. As a result, I dropped the 'didReify' parameter for
+ this function and instead only call this function if we have not yet reified.
+
+ (JSC::JSObject::putInlineSlow):
+ Only call putEntry() if we have not reified: Drop the
+ '|| !(entry->attributes() & BuiltinOrFunctionOrAccessor)'
+ check as such properties now get reified as well.
+
+ (JSC::JSObject::deleteProperty):
+ - Call reifyAllStaticProperties() instead of reifyStaticFunctionsForDelete()
+ so that we now reify all properties upon deletion, including the custom
+ accessors. reifyStaticFunctionsForDelete() is now removed and the same
+ reification function is now used by: deletion, getOwnPropertyDescriptor()
+ and eager reification of the prototype objects in the bindings.
+ - Drop code that falls back to calling the static property setter with
+ undefined if we cannot find the property in the property storage. As
+ we now reify ALL properties, the code removing the property from the
+ property storage should succeed, provided that the property actually
+ exists.
+
+ (JSC::JSObject::getOwnNonIndexPropertyNames):
+ Only call getClassPropertyNames() if we have not reified. We should no longer
+ check the static property table after reifying now that we reify all
+ properties.
+
+ (JSC::JSObject::reifyAllStaticProperties):
+ Merge with reifyStaticFunctionsForDelete(). The only behavior change is the
+ flattening to an uncacheable dictionary, like reifyStaticFunctionsForDelete()
+ used to do.
+
+ * runtime/JSObject.h:
+
</ins><span class="cx"> 2016-02-10 Commit Queue <commit-queue@webkit.org>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r196251.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx">
</span><span class="cx"> const ClassInfo JSFinalObject::s_info = { "Object", &Base::s_info, 0, CREATE_METHOD_TABLE(JSFinalObject) };
</span><span class="cx">
</span><del>-static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode, bool didReify)
</del><ins>+static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx">
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx"> continue;
</span><span class="cx">
</span><span class="cx"> for (auto iter = table->begin(); iter != table->end(); ++iter) {
</span><del>- if ((!(iter->attributes() & DontEnum) || mode.includeDontEnumProperties()) && !((iter->attributes() & BuiltinOrFunctionOrAccessor) && didReify))
</del><ins>+ if (!(iter->attributes() & DontEnum) || mode.includeDontEnumProperties())
</ins><span class="cx"> propertyNames.add(Identifier::fromString(&vm, iter.key()));
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -413,10 +413,9 @@
</span><span class="cx"> // prototypes it should be replaced, so break here.
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- const ClassInfo* info = obj->classInfo();
- if (info->hasStaticSetterOrReadonlyProperties()) {
- if (const HashTableValue* entry = obj->findPropertyHashEntry(propertyName)) {
- if (!obj->staticFunctionsReified() || !(entry->attributes() & BuiltinOrFunctionOrAccessor)) {
</del><ins>+ if (!obj->staticFunctionsReified()) {
+ if (obj->classInfo()->hasStaticSetterOrReadonlyProperties()) {
+ if (auto* entry = obj->findPropertyHashEntry(propertyName)) {
</ins><span class="cx"> putEntry(exec, entry, obj, propertyName, value, slot);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="lines">@@ -1287,35 +1286,21 @@
</span><span class="cx"> bool JSObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
</span><span class="cx"> {
</span><span class="cx"> JSObject* thisObject = jsCast<JSObject*>(cell);
</span><ins>+ VM& vm = exec->vm();
</ins><span class="cx">
</span><span class="cx"> if (Optional<uint32_t> index = parseIndex(propertyName))
</span><del>- return thisObject->methodTable(exec->vm())->deletePropertyByIndex(thisObject, exec, index.value());
</del><ins>+ return thisObject->methodTable(vm)->deletePropertyByIndex(thisObject, exec, index.value());
</ins><span class="cx">
</span><span class="cx"> if (!thisObject->staticFunctionsReified())
</span><del>- thisObject->reifyStaticFunctionsForDelete(exec);
</del><ins>+ thisObject->reifyAllStaticProperties(exec);
</ins><span class="cx">
</span><span class="cx"> unsigned attributes;
</span><del>- VM& vm = exec->vm();
</del><span class="cx"> if (isValidOffset(thisObject->structure(vm)->get(vm, propertyName, attributes))) {
</span><span class="cx"> if (attributes & DontDelete && !vm.isInDefineOwnProperty())
</span><span class="cx"> return false;
</span><span class="cx"> thisObject->removeDirect(vm, propertyName);
</span><del>- return true;
</del><span class="cx"> }
</span><span class="cx">
</span><del>- // Look in the static hashtable of properties
- const HashTableValue* entry = thisObject->findPropertyHashEntry(propertyName);
- if (entry) {
- if (entry->attributes() & DontDelete && !vm.isInDefineOwnProperty())
- return false; // this builtin property can't be deleted
-
- PutPropertySlot slot(thisObject);
- if (!(entry->attributes() & BuiltinOrFunctionOrAccessor)) {
- ASSERT(thisObject->staticFunctionsReified());
- putEntry(exec, entry, thisObject, propertyName, jsUndefined(), slot);
- }
- }
-
</del><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1616,7 +1601,8 @@
</span><span class="cx">
</span><span class="cx"> void JSObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
</span><span class="cx"> {
</span><del>- getClassPropertyNames(exec, object->classInfo(), propertyNames, mode, object->staticFunctionsReified());
</del><ins>+ if (!object->staticFunctionsReified())
+ getClassPropertyNames(exec, object->classInfo(), propertyNames, mode);
</ins><span class="cx">
</span><span class="cx"> if (!mode.includeJSObjectProperties())
</span><span class="cx"> return;
</span><span class="lines">@@ -1670,9 +1656,7 @@
</span><span class="cx"> setStructure(vm, Structure::preventExtensionsTransition(vm, structure(vm)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-// This presently will flatten to an uncachable dictionary; this is suitable
-// for use in delete, we may want to do something different elsewhere.
-void JSObject::reifyStaticFunctionsForDelete(ExecState* exec)
</del><ins>+void JSObject::reifyAllStaticProperties(ExecState* exec)
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(!staticFunctionsReified());
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="lines">@@ -1691,30 +1675,12 @@
</span><span class="cx"> const HashTable* hashTable = info->staticPropHashTable;
</span><span class="cx"> if (!hashTable)
</span><span class="cx"> continue;
</span><del>- PropertySlot slot(this);
- for (auto iter = hashTable->begin(); iter != hashTable->end(); ++iter) {
- if (iter->attributes() & BuiltinOrFunctionOrAccessor)
- setUpStaticFunctionSlot(globalObject()->globalExec(), iter.value(), this, Identifier::fromString(&vm, iter.key()), slot);
- }
- }
</del><span class="cx">
</span><del>- structure(vm)->setStaticFunctionsReified(true);
-}
-
-void JSObject::reifyAllStaticProperties(ExecState* exec)
-{
- VM& vm = exec->vm();
-
- for (const ClassInfo* info = classInfo(); info; info = info->parentClass) {
- const HashTable* hashTable = info->staticPropHashTable;
- if (!hashTable)
- continue;
-
- for (auto iter = hashTable->begin(); iter != hashTable->end(); ++iter) {
</del><ins>+ for (auto& value : *hashTable) {
</ins><span class="cx"> unsigned attributes;
</span><del>- PropertyOffset offset = getDirectOffset(vm, Identifier::fromString(&vm, iter.key()), attributes);
</del><ins>+ PropertyOffset offset = getDirectOffset(vm, Identifier::fromString(&vm, value.m_key), attributes);
</ins><span class="cx"> if (!isValidOffset(offset))
</span><del>- reifyStaticProperty(vm, *iter.value(), *this);
</del><ins>+ reifyStaticProperty(vm, value, *this);
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -623,7 +623,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool staticFunctionsReified() { return structure()->staticFunctionsReified(); }
</span><del>- void reifyStaticFunctionsForDelete(ExecState*);
</del><span class="cx"> void reifyAllStaticProperties(ExecState*);
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE Butterfly* growOutOfLineStorage(VM&, size_t oldSize, size_t newSize);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeLookuph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.h (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.h 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/JavaScriptCore/runtime/Lookup.h 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -130,22 +130,24 @@
</span><span class="cx"> skipInvalidKeys();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const HashTableValue* value()
</del><ins>+ const HashTableValue* value() const
</ins><span class="cx"> {
</span><span class="cx"> return &m_table->values[m_position];
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const char* key()
</del><ins>+ const HashTableValue& operator*() const { return *value(); }
+
+ const char* key() const
</ins><span class="cx"> {
</span><span class="cx"> return m_table->values[m_position].m_key;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const HashTableValue* operator->()
</del><ins>+ const HashTableValue* operator->() const
</ins><span class="cx"> {
</span><span class="cx"> return value();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool operator!=(const ConstIterator& other)
</del><ins>+ bool operator!=(const ConstIterator& other) const
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(m_table == other.m_table);
</span><span class="cx"> return m_position != other.m_position;
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/WebCore/ChangeLog 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -1,3 +1,63 @@
</span><ins>+2016-02-10 Chris Dumez <cdumez@apple.com>
+
+ Attributes on the Window instance should be configurable unless [Unforgeable]
+ https://bugs.webkit.org/show_bug.cgi?id=153920
+ <rdar://problem/24563211>
+
+ Reviewed by Darin Adler.
+
+ Attributes on the Window instance should be configurable unless [Unforgeable]:
+ 1. 'constructor' property:
+ - http://www.w3.org/TR/WebIDL/#interface-prototype-object
+ 2. Constructor properties (e.g. window.Node):
+ - http://www.w3.org/TR/WebIDL/#es-interfaces
+ 3. IDL attributes:
+ - http://heycam.github.io/webidl/#es-attributes (configurable unless
+ [Unforgeable], e.g. window.location)
+
+ Firefox complies with the WebIDL specification but WebKit does not for 1. and 3.
+
+ Test: fast/dom/Window/window-properties-configurable.html
+
+ * bindings/js/JSDOMWindowCustom.cpp:
+ (WebCore::JSDOMWindow::getOwnPropertySlot):
+ For known Window properties (i.e. properties in the static property table),
+ if we have reified and this is same-origin access, then call
+ Base::getOwnPropertySlot() to get the property from the local property
+ storage. If we have not reified yet, or this is cross-origin access, query
+ the static property table. This is to match the behavior of Firefox and
+ Chrome which seem to keep returning the original properties upon cross
+ origin access, even if those were deleted or redefined.
+
+ (WebCore::JSDOMWindow::put):
+ The previous code used to call the static property setter for properties in
+ the static table. However, this does not do the right thing if properties
+ were reified. For example, deleting window.name and then trying to set it
+ again would not work. Therefore, update this code to only do this if the
+ properties have not been reified, similarly to what is done in
+ JSObject::putInlineSlow().
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (ConstructorShouldBeOnInstance):
+ Add a FIXME comment indicating that window.constructor should be on
+ the prototype as per the Web IDL specification.
+
+ (GenerateAttributesHashTable):
+ - Mark 'constructor' property as configurable for Window, as per the
+ specification and consistently with other 'constructor' properties:
+ http://www.w3.org/TR/WebIDL/#interface-prototype-object
+ - Mark properties as configurable even though they are on the instance.
+ Window has its properties on the instance as per the specification:
+ 1. http://heycam.github.io/webidl/#es-attributes
+ 2. http://heycam.github.io/webidl/#PrimaryGlobal (window is [PrimaryGlobal]
+ However, these properties should be configurable as long as they are
+ not marked as [Unforgeable], as per 1.
+
+ * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+ * bindings/scripts/test/JS/JSTestException.cpp:
+ * bindings/scripts/test/JS/JSTestObj.cpp:
+ Rebaseline bindings tests.
+
</ins><span class="cx"> 2016-02-10 Brady Eidson <beidson@apple.com>
</span><span class="cx">
</span><span class="cx"> Modern IDB: Ref cycle between IDBObjectStore and IDBTransaction.
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007-2010, 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2011 Google Inc. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -199,10 +199,14 @@
</span><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx">
</span><del>- const HashTableValue* entry = JSDOMWindow::info()->staticPropHashTable->entry(propertyName);
- if (entry) {
- slot.setCacheableCustom(thisObject, allowsAccess ? entry->attributes() : ReadOnly | DontDelete | DontEnum, entry->propertyGetter());
- return true;
</del><ins>+ // When accessing cross-origin known Window properties, we always use the original property getter,
+ // even if the property was removed / redefined. As of early 2016, this matches Firefox and Chrome's
+ // behavior.
+ if (!thisObject->staticFunctionsReified() || !allowsAccess) {
+ if (auto* entry = JSDOMWindow::info()->staticPropHashTable->entry(propertyName)) {
+ slot.setCacheableCustom(thisObject, allowsAccess ? entry->attributes() : ReadOnly | DontDelete | DontEnum, entry->propertyGetter());
+ return true;
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ENABLE(USER_MESSAGE_HANDLERS)
</span><span class="lines">@@ -363,8 +367,10 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (lookupPut(exec, propertyName, thisObject, value, *s_info.staticPropHashTable, slot))
- return;
</del><ins>+ if (!thisObject->staticFunctionsReified()) {
+ if (lookupPut(exec, propertyName, thisObject, value, *s_info.staticPropHashTable, slot))
+ return;
+ }
</ins><span class="cx">
</span><span class="cx"> if (BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped()))
</span><span class="cx"> Base::put(thisObject, exec, propertyName, value, slot);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -685,6 +685,8 @@
</span><span class="cx"> {
</span><span class="cx"> my $interface = shift;
</span><span class="cx">
</span><ins>+ # FIXME: constructor should always be on the prototype:
+ # http://www.w3.org/TR/WebIDL/#interface-prototype-object
</ins><span class="cx"> return 1 if $interface->extendedAttributes->{"CheckSecurity"};
</span><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="lines">@@ -1357,13 +1359,7 @@
</span><span class="cx">
</span><span class="cx"> my $setter = "setJS" . $interfaceName . "Constructor";
</span><span class="cx"> push(@$hashValue2, $setter);
</span><del>-
- # FIXME: Do we really need to special-case DOMWindow?
- if ($interfaceName eq "DOMWindow") {
- push(@$hashSpecials, "DontEnum | DontDelete");
- } else {
- push(@$hashSpecials, "DontEnum");
- }
</del><ins>+ push(@$hashSpecials, "DontEnum");
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1376,13 +1372,11 @@
</span><span class="cx"> push(@$hashKeys, $name);
</span><span class="cx">
</span><span class="cx"> my @specials = ();
</span><del>- # As per Web IDL specification, constructor properties on the ECMAScript global object should be
- # configurable and should not be enumerable.
- my $is_global_constructor = $attribute->signature->type =~ /Constructor$/;
-
- push(@specials, "DontDelete") if ($isInstance && !$is_global_constructor) || $attribute->signature->extendedAttributes->{"Unforgeable"}
</del><ins>+ push(@specials, "DontDelete") if $attribute->signature->extendedAttributes->{"Unforgeable"}
</ins><span class="cx"> || $interface->extendedAttributes->{"Unforgeable"};
</span><span class="cx">
</span><ins>+ # As per Web IDL specification, constructor properties on the ECMAScript global object should not be enumerable.
+ my $is_global_constructor = $attribute->signature->type =~ /Constructor$/;
</ins><span class="cx"> push(@specials, "DontEnum") if ($attribute->signature->extendedAttributes->{"NotEnumerable"} || $is_global_constructor);
</span><span class="cx"> push(@specials, "ReadOnly") if IsReadonly($attribute);
</span><span class="cx"> push(@specials, "CustomAccessor") unless $is_global_constructor or IsJSBuiltin($interface, $attribute);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -83,7 +83,7 @@
</span><span class="cx"> static const HashTableValue JSTestActiveDOMObjectTableValues[] =
</span><span class="cx"> {
</span><span class="cx"> { "constructor", DontEnum, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestActiveDOMObjectConstructor), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(setJSTestActiveDOMObjectConstructor) } },
</span><del>- { "excitingAttr", DontDelete | ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestActiveDOMObjectExcitingAttr), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</del><ins>+ { "excitingAttr", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestActiveDOMObjectExcitingAttr), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> static const HashTable JSTestActiveDOMObjectTable = { 2, 3, true, JSTestActiveDOMObjectTableValues, JSTestActiveDOMObjectTableIndex };
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx">
</span><span class="cx"> static const HashTableValue JSTestExceptionTableValues[] =
</span><span class="cx"> {
</span><del>- { "name", DontDelete | ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestExceptionName), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</del><ins>+ { "name", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestExceptionName), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> static const HashTable JSTestExceptionTable = { 1, 1, true, JSTestExceptionTableValues, JSTestExceptionTableIndex };
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (196373 => 196374)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp 2016-02-10 19:27:58 UTC (rev 196373)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp 2016-02-10 19:47:10 UTC (rev 196374)
</span><span class="lines">@@ -402,7 +402,7 @@
</span><span class="cx"> #else
</span><span class="cx"> { 0, 0, NoIntrinsic, { 0, 0 } },
</span><span class="cx"> #endif
</span><del>- { "contentDocument", DontDelete | ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjContentDocument), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</del><ins>+ { "contentDocument", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjContentDocument), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> static const HashTable JSTestObjTable = { 5, 15, true, JSTestObjTableValues, JSTestObjTableIndex };
</span></span></pre>
</div>
</div>
</body>
</html>