<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197091] releases/WebKitGTK/webkit-2.12</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197091">197091</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-02-25 02:51:03 -0800 (Thu, 25 Feb 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/196889">r196889</a> - iframe/frame/object.contentDocument should be on the prototype
https://bugs.webkit.org/show_bug.cgi?id=154409
Reviewed by Sam Weinig.
LayoutTests/imported/w3c:
Rebaseline now that more checks are passing.
* web-platform-tests/html/dom/interfaces-expected.txt:
Source/WebCore:
Move iframe/frame/object.contentDocument to the prototype. They used
to be on the instance due to the [CheckSecurityForNode] IDL extended
attribute. This patch updates the bindings generator so that such
attributes are now on the prototype. While they are now on the
prototype, the security checks are still generated in the
corresponding getters and setters so cross origin access is still
prevented.
Test: http/tests/security/cross-origin-iframe-contentDocument.html
* bindings/scripts/CodeGeneratorJS.pm:
(AttributeShouldBeOnInstance): Deleted.
LayoutTests:
Add test coverage for trying to access iframe.contentDocument cross origin
to make sure it still fails and logs a security error.
* http/tests/security/cross-origin-iframe-contentDocument-expected.txt: Added.
* http/tests/security/cross-origin-iframe-contentDocument.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsimportedw3cChangeLog">releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCorebindingsscriptsCodeGeneratorJSpm">releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#releasesWebKitGTKwebkit212SourceWebCorebindingsscriptstestJSJSTestObjcpp">releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecuritycrossoriginiframecontentDocumentexpectedtxt">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit212LayoutTestshttptestssecuritycrossoriginiframecontentDocumenthtml">releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit212LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog (197090 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-02-25 10:35:50 UTC (rev 197090)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/ChangeLog 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-02-21 Chris Dumez <cdumez@apple.com>
+
+ iframe/frame/object.contentDocument should be on the prototype
+ https://bugs.webkit.org/show_bug.cgi?id=154409
+
+ Reviewed by Sam Weinig.
+
+ Add test coverage for trying to access iframe.contentDocument cross origin
+ to make sure it still fails and logs a security error.
+
+ * http/tests/security/cross-origin-iframe-contentDocument-expected.txt: Added.
+ * http/tests/security/cross-origin-iframe-contentDocument.html: Added.
+
</ins><span class="cx"> 2016-02-24 Daniel Bates <dabates@apple.com>
</span><span class="cx">
</span><span class="cx"> CSP: Enable plugin-types directive by default
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecuritycrossoriginiframecontentDocumentexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument-expected.txt (0 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument-expected.txt 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+CONSOLE MESSAGE: line 16: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+Tests that iframe.contentDocument is not accessible cross-origin.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS crossOriginFrame.contentDocument returned null.
+PASS Object.getOwnPropertyDescriptor(sameOriginFrame.__proto__, "contentDocument").get.call(crossOriginFrame) returned null.
+PASS Object.getOwnPropertyDescriptor(crossOriginFrame.__proto__, "contentDocument").get.call(crossOriginFrame) returned null.
+PASS Object.getOwnPropertyDescriptor(crossOriginFrame, "contentDocument") returned undefined.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestshttptestssecuritycrossoriginiframecontentDocumenthtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument.html (0 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument.html (rev 0)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/http/tests/security/cross-origin-iframe-contentDocument.html 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body onload="runTest()">
+<iframe id="crossOriginFrame" src="http://localhost:8000/security/resources/blank.html"></iframe>
+<iframe id="sameOriginFrame" src="about:blank"></iframe>
+<script>
+description("Tests that iframe.contentDocument is not accessible cross-origin.");
+jsTestIsAsync = true;
+
+function shouldThrowOrReturnUndefinedOrNull(expression)
+{
+ try {
+ result = eval(expression);
+ } catch (e) {
+ testPassed(expression + " threw exception " + e + ".");
+ return;
+ }
+ if (result === undefined)
+ testPassed(expression + " returned undefined.");
+ else if (result === null)
+ testPassed(expression + " returned null.");
+ else
+ testFailed(expression + " returned " + result);
+}
+
+function runTest()
+{
+ crossOriginFrame = document.getElementById("crossOriginFrame");
+ sameOriginFrame = document.getElementById("sameOriginFrame");
+
+ shouldThrowOrReturnUndefinedOrNull('crossOriginFrame.contentDocument');
+ shouldThrowOrReturnUndefinedOrNull('Object.getOwnPropertyDescriptor(sameOriginFrame.__proto__, "contentDocument").get.call(crossOriginFrame)');
+ shouldThrowOrReturnUndefinedOrNull('Object.getOwnPropertyDescriptor(crossOriginFrame.__proto__, "contentDocument").get.call(crossOriginFrame)');
+ shouldThrowOrReturnUndefinedOrNull('Object.getOwnPropertyDescriptor(crossOriginFrame, "contentDocument")');
+ finishJSTest();
+}
+</script>
+</body>
+<script src="../../resources/js-test-post.js"></script>
+</html>
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/ChangeLog (197090 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/ChangeLog 2016-02-25 10:35:50 UTC (rev 197090)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/ChangeLog 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2016-02-21 Chris Dumez <cdumez@apple.com>
+
+ iframe/frame/object.contentDocument should be on the prototype
+ https://bugs.webkit.org/show_bug.cgi?id=154409
+
+ Reviewed by Sam Weinig.
+
+ Rebaseline now that more checks are passing.
+
+ * web-platform-tests/html/dom/interfaces-expected.txt:
+
</ins><span class="cx"> 2016-02-18 Chris Dumez <cdumez@apple.com>
</span><span class="cx">
</span><span class="cx"> window.history / window.navigator should not be replaceable
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212LayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt (197090 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt 2016-02-25 10:35:50 UTC (rev 197090)
+++ releases/WebKitGTK/webkit-2.12/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -1786,7 +1786,7 @@
</span><span class="cx"> FAIL HTMLIFrameElement interface: attribute allowFullscreen assert_true: The prototype object must have a property "allowFullscreen" expected true got false
</span><span class="cx"> PASS HTMLIFrameElement interface: attribute width
</span><span class="cx"> PASS HTMLIFrameElement interface: attribute height
</span><del>-FAIL HTMLIFrameElement interface: attribute contentDocument assert_true: The prototype object must have a property "contentDocument" expected true got false
</del><ins>+PASS HTMLIFrameElement interface: attribute contentDocument
</ins><span class="cx"> PASS HTMLIFrameElement interface: attribute contentWindow
</span><span class="cx"> PASS HTMLIFrameElement interface: attribute align
</span><span class="cx"> PASS HTMLIFrameElement interface: attribute scrolling
</span><span class="lines">@@ -1828,7 +1828,7 @@
</span><span class="cx"> PASS HTMLObjectElement interface: attribute form
</span><span class="cx"> PASS HTMLObjectElement interface: attribute width
</span><span class="cx"> PASS HTMLObjectElement interface: attribute height
</span><del>-FAIL HTMLObjectElement interface: attribute contentDocument assert_true: The prototype object must have a property "contentDocument" expected true got false
</del><ins>+PASS HTMLObjectElement interface: attribute contentDocument
</ins><span class="cx"> FAIL HTMLObjectElement interface: attribute contentWindow assert_true: The prototype object must have a property "contentWindow" expected true got false
</span><span class="cx"> PASS HTMLObjectElement interface: attribute willValidate
</span><span class="cx"> PASS HTMLObjectElement interface: attribute validity
</span><span class="lines">@@ -4759,7 +4759,7 @@
</span><span class="cx"> PASS HTMLFrameElement interface: attribute frameBorder
</span><span class="cx"> PASS HTMLFrameElement interface: attribute longDesc
</span><span class="cx"> PASS HTMLFrameElement interface: attribute noResize
</span><del>-FAIL HTMLFrameElement interface: attribute contentDocument assert_true: The prototype object must have a property "contentDocument" expected true got false
</del><ins>+PASS HTMLFrameElement interface: attribute contentDocument
</ins><span class="cx"> PASS HTMLFrameElement interface: attribute contentWindow
</span><span class="cx"> PASS HTMLFrameElement interface: attribute marginHeight
</span><span class="cx"> PASS HTMLFrameElement interface: attribute marginWidth
</span><span class="lines">@@ -4771,7 +4771,7 @@
</span><span class="cx"> PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "frameBorder" with the proper type (3)
</span><span class="cx"> PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "longDesc" with the proper type (4)
</span><span class="cx"> PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "noResize" with the proper type (5)
</span><del>-FAIL HTMLFrameElement interface: document.createElement("frame") must inherit property "contentDocument" with the proper type (6) assert_inherits: property "contentDocument" found on object expected in prototype chain
</del><ins>+PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "contentDocument" with the proper type (6)
</ins><span class="cx"> PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "contentWindow" with the proper type (7)
</span><span class="cx"> PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "marginHeight" with the proper type (8)
</span><span class="cx"> PASS HTMLFrameElement interface: document.createElement("frame") must inherit property "marginWidth" with the proper type (9)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog (197090 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-02-25 10:35:50 UTC (rev 197090)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/ChangeLog 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2016-02-21 Chris Dumez <cdumez@apple.com>
+
+ iframe/frame/object.contentDocument should be on the prototype
+ https://bugs.webkit.org/show_bug.cgi?id=154409
+
+ Reviewed by Sam Weinig.
+
+ Move iframe/frame/object.contentDocument to the prototype. They used
+ to be on the instance due to the [CheckSecurityForNode] IDL extended
+ attribute. This patch updates the bindings generator so that such
+ attributes are now on the prototype. While they are now on the
+ prototype, the security checks are still generated in the
+ corresponding getters and setters so cross origin access is still
+ prevented.
+
+ Test: http/tests/security/cross-origin-iframe-contentDocument.html
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (AttributeShouldBeOnInstance): Deleted.
+
</ins><span class="cx"> 2016-02-24 Daniel Bates <dabates@apple.com>
</span><span class="cx">
</span><span class="cx"> CSP: Enable plugin-types directive by default
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (197090 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-02-25 10:35:50 UTC (rev 197090)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -701,11 +701,6 @@
</span><span class="cx"> # https://heycam.github.io/webidl/#Unforgeable
</span><span class="cx"> return 1 if IsUnforgeable($interface, $attribute);
</span><span class="cx">
</span><del>- # It becomes hard to reason about attributes that require security checks if we push
- # them down the prototype chain, so before we do these we'll need to carefully consider
- # the possible pitfalls.
- return 1 if $attribute->signature->extendedAttributes->{"CheckSecurityForNode"};
-
</del><span class="cx"> return 1 if AttributeShouldBeOnInstanceForCompatibility($interface, $attribute);
</span><span class="cx">
</span><span class="cx"> if ($interface->extendedAttributes->{"CheckSecurity"}) {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit212SourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (197090 => 197091)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp 2016-02-25 10:35:50 UTC (rev 197090)
+++ releases/WebKitGTK/webkit-2.12/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp 2016-02-25 10:51:03 UTC (rev 197091)
</span><span class="lines">@@ -367,12 +367,12 @@
</span><span class="cx"> /* Hash table */
</span><span class="cx">
</span><span class="cx"> static const struct CompactHashIndex JSTestObjTableIndex[17] = {
</span><ins>+ { -1, -1 },
+ { -1, -1 },
</ins><span class="cx"> { 5, -1 },
</span><span class="cx"> { -1, -1 },
</span><del>- { 6, -1 },
</del><span class="cx"> { -1, -1 },
</span><span class="cx"> { -1, -1 },
</span><del>- { -1, -1 },
</del><span class="cx"> { 4, -1 },
</span><span class="cx"> { -1, -1 },
</span><span class="cx"> { 1, -1 },
</span><span class="lines">@@ -406,11 +406,10 @@
</span><span class="cx"> #else
</span><span class="cx"> { 0, 0, NoIntrinsic, { 0, 0 } },
</span><span class="cx"> #endif
</span><del>- { "contentDocument", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjContentDocument), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</del><span class="cx"> { "unforgeableMethod", DontDelete | ReadOnly | JSC::Function, NoIntrinsic, { (intptr_t)static_cast<NativeFunction>(jsTestObjInstanceFunctionUnforgeableMethod), (intptr_t) (0) } },
</span><span class="cx"> };
</span><span class="cx">
</span><del>-static const HashTable JSTestObjTable = { 7, 15, true, JSTestObjTableValues, JSTestObjTableIndex };
</del><ins>+static const HashTable JSTestObjTable = { 6, 15, true, JSTestObjTableValues, JSTestObjTableIndex };
</ins><span class="cx"> /* Hash table for constructor */
</span><span class="cx">
</span><span class="cx"> static const HashTableValue JSTestObjConstructorTableValues[] =
</span><span class="lines">@@ -574,6 +573,7 @@
</span><span class="cx"> { "cachedAttribute1", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCachedAttribute1), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</span><span class="cx"> { "cachedAttribute2", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCachedAttribute2), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</span><span class="cx"> { "anyAttribute", CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjAnyAttribute), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(setJSTestObjAnyAttribute) } },
</span><ins>+ { "contentDocument", ReadOnly | CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjContentDocument), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(0) } },
</ins><span class="cx"> { "mutablePoint", CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjMutablePoint), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(setJSTestObjMutablePoint) } },
</span><span class="cx"> { "immutablePoint", CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjImmutablePoint), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(setJSTestObjImmutablePoint) } },
</span><span class="cx"> { "strawberry", CustomAccessor, NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjStrawberry), (intptr_t) static_cast<PutPropertySlot::PutValueFunc>(setJSTestObjStrawberry) } },
</span></span></pre>
</div>
</div>
</body>
</html>