<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[204179] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/204179">204179</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-08-05 11:36:21 -0700 (Fri, 05 Aug 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Window's named properties should be exposed on a WindowProperties object in its prototype
https://bugs.webkit.org/show_bug.cgi?id=160354

Reviewed by Gavin Barraclough.

LayoutTests/imported/w3c:

Rebaseline W3C test now that one more check is passing.

* web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Window's named properties should be exposed on a WindowProperties object
in its prototype:
- http://heycam.github.io/webidl/#named-properties-object

Firefox and Chrome both comply with the specification. However, WebKit
had no &quot;WindowProperties&quot; object in the Window prototype chain and the
named properties are exposed on the Window object itself.

No new tests, rebaselined existing tests.

* CMakeLists.txt:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSBindingsAllInOne.cpp:
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::JSDOMWindow::getOwnPropertySlot):
(WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess): Deleted.
(WebCore::JSDOMWindow::put): Deleted.
(WebCore::JSDOMWindow::putByIndex): Deleted.
(WebCore::JSDOMWindow::getEnumerableLength): Deleted.
* bindings/js/JSDOMWindowProperties.cpp: Added.
(WebCore::jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter):
(WebCore::JSDOMWindowProperties::getOwnPropertySlot):
(WebCore::JSDOMWindowProperties::getOwnPropertySlotByIndex):
* bindings/js/JSDOMWindowProperties.h: Added.
(WebCore::JSDOMWindowProperties::create):
(WebCore::JSDOMWindowProperties::createStructure):
(WebCore::JSDOMWindowProperties::JSDOMWindowProperties):
* bindings/js/JSDOMWindowShell.cpp:
(WebCore::JSDOMWindowShell::setWindow):

LayoutTests:

* fast/dom/Window/es52-globals-expected.txt:
Update / Rebaseline test now that named properties are no longer reported as &quot;own&quot;
properties on the Window object. I have verified that the test gives the
same result in Firefox and Chrome.

* fast/loader/window-clearing-expected.txt:
Rebaseline test that prints one more line because there is one more
object in Window's prototype chain.

* http/tests/security/window-named-proto-expected.txt:
* http/tests/security/window-named-valueOf-expected.txt:
Rebaseline 2 security tests that give slightly different output. The new
output is identical to the one in Firefox and Chrome. The tests are not
failing since they are not alert'ing content from the other frame.
The reason those tests were logging a security error is because we would
previously prevent named property access if the frame name conflicts with
a property name in the Window prototype, and we now no longer
differentiate this case.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowes52globalsexpectedtxt">trunk/LayoutTests/fast/dom/Window/es52-globals-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastdomWindowes52globalshtml">trunk/LayoutTests/fast/dom/Window/es52-globals.html</a></li>
<li><a href="#trunkLayoutTestsfastloaderwindowclearingexpectedtxt">trunk/LayoutTests/fast/loader/window-clearing-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritywindownamedprotoexpectedtxt">trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritywindownamedvalueOfexpectedtxt">trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt</a></li>
<li><a href="#trunkLayoutTestshttptestssecuritywindownamedvalueOfhtml">trunk/LayoutTests/http/tests/security/window-named-valueOf.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt</a></li>
<li><a href="#trunkSourceWebCoreCMakeListstxt">trunk/Source/WebCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreWebCorexcodeprojprojectpbxproj">trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSBindingsAllInOnecpp">trunk/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowShellcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowPropertiescpp">trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowPropertiesh">trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/ChangeLog        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1,3 +1,29 @@
</span><ins>+2016-08-05  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Window's named properties should be exposed on a WindowProperties object in its prototype
+        https://bugs.webkit.org/show_bug.cgi?id=160354
+
+        Reviewed by Gavin Barraclough.
+
+        * fast/dom/Window/es52-globals-expected.txt:
+        Update / Rebaseline test now that named properties are no longer reported as &quot;own&quot;
+        properties on the Window object. I have verified that the test gives the
+        same result in Firefox and Chrome.
+
+        * fast/loader/window-clearing-expected.txt:
+        Rebaseline test that prints one more line because there is one more
+        object in Window's prototype chain.
+
+        * http/tests/security/window-named-proto-expected.txt:
+        * http/tests/security/window-named-valueOf-expected.txt:
+        Rebaseline 2 security tests that give slightly different output. The new
+        output is identical to the one in Firefox and Chrome. The tests are not
+        failing since they are not alert'ing content from the other frame.
+        The reason those tests were logging a security error is because we would
+        previously prevent named property access if the frame name conflicts with
+        a property name in the Window prototype, and we now no longer
+        differentiate this case.
+
</ins><span class="cx"> 2016-08-05  John Wilander  &lt;wilander@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Popups opened from a sandboxed iframe should themselves be sandboxed
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowes52globalsexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Window/es52-globals-expected.txt (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/es52-globals-expected.txt        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/fast/dom/Window/es52-globals-expected.txt        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1,9 +1,11 @@
</span><span class="cx"> PASS window.hasOwnProperty(&quot;Element&quot;) is true
</span><span class="cx"> PASS window.hasOwnProperty(&quot;x&quot;) is true
</span><span class="cx"> PASS window.hasOwnProperty(&quot;y&quot;) is false
</span><del>-PASS window.hasOwnProperty(&quot;f&quot;) is true
-PASS window.hasOwnProperty(&quot;div&quot;) is true
-FAIL window.hasOwnProperty(&quot;a&quot;) should be true. Was false.
</del><ins>+PASS window.hasOwnProperty(&quot;f&quot;) is false
+PASS window.__proto__.__proto__.hasOwnProperty(&quot;f&quot;) is true
+PASS window.hasOwnProperty(&quot;div&quot;) is false
+PASS window.__proto__.__proto__.hasOwnProperty(&quot;div&quot;) is true
+PASS window.hasOwnProperty(&quot;a&quot;) is false
</ins><span class="cx"> PASS Element is not undefined
</span><span class="cx"> PASS x is 1
</span><span class="cx"> FAIL y should be undefined. Was 2
</span></span></pre></div>
<a id="trunkLayoutTestsfastdomWindowes52globalshtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/dom/Window/es52-globals.html (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/dom/Window/es52-globals.html        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/fast/dom/Window/es52-globals.html        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -14,9 +14,11 @@
</span><span class="cx"> shouldBeTrue('window.hasOwnProperty(&quot;Element&quot;)');
</span><span class="cx"> shouldBeTrue('window.hasOwnProperty(&quot;x&quot;)');
</span><span class="cx"> shouldBeFalse('window.hasOwnProperty(&quot;y&quot;)');
</span><del>-shouldBeTrue('window.hasOwnProperty(&quot;f&quot;)');
-shouldBeTrue('window.hasOwnProperty(&quot;div&quot;)');
-shouldBeTrue('window.hasOwnProperty(&quot;a&quot;)');
</del><ins>+shouldBeFalse('window.hasOwnProperty(&quot;f&quot;)');
+shouldBeTrue('window.__proto__.__proto__.hasOwnProperty(&quot;f&quot;)');
+shouldBeFalse('window.hasOwnProperty(&quot;div&quot;)');
+shouldBeTrue('window.__proto__.__proto__.hasOwnProperty(&quot;div&quot;)');
+shouldBeFalse('window.hasOwnProperty(&quot;a&quot;)');
</ins><span class="cx"> 
</span><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;script&gt;
</span><span class="lines">@@ -40,4 +42,4 @@
</span><span class="cx"> shouldBeUndefined('a');
</span><span class="cx"> 
</span><span class="cx"> &lt;/script&gt;
</span><del>-&lt;script src=&quot;../../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</del><span class="cx">\ No newline at end of file
</span><ins>+&lt;script src=&quot;../../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastloaderwindowclearingexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/loader/window-clearing-expected.txt (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/loader/window-clearing-expected.txt        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/fast/loader/window-clearing-expected.txt        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -9,3 +9,5 @@
</span><span class="cx"> PASS: element 2 in the window's prototype chain was cleared
</span><span class="cx"> 
</span><span class="cx"> PASS: element 3 in the window's prototype chain was cleared
</span><ins>+
+PASS: element 4 in the window's prototype chain was cleared
</ins></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritywindownamedprotoexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1,4 +1,2 @@
</span><del>-CONSOLE MESSAGE: line 1: Blocked a frame with origin &quot;null&quot; from accessing a frame with origin &quot;http://localhost:8080&quot;.  The frame requesting access has a protocol of &quot;data&quot;, the frame being accessed has a protocol of &quot;http&quot;. Protocols must match.
</del><ins>+CONSOLE MESSAGE: line 2: TypeError: null is not an object (evaluating 'document.body.innerHTML')
</ins><span class="cx"> 
</span><del>-CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'parent.__proto__.alert')
-
</del></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritywindownamedvalueOfexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1,5 +1,2 @@
</span><del>-CONSOLE MESSAGE: line 1: Blocked a frame with origin &quot;null&quot; from accessing a frame with origin &quot;http://localhost:8080&quot;.  The frame requesting access has a protocol of &quot;data&quot;, the frame being accessed has a protocol of &quot;http&quot;. Protocols must match.
-
-CONSOLE MESSAGE: line 1: Blocked a frame with origin &quot;null&quot; from accessing a frame with origin &quot;http://localhost:8080&quot;.  The frame requesting access has a protocol of &quot;data&quot;, the frame being accessed has a protocol of &quot;http&quot;. Protocols must match.
-
</del><ins>+CONSOLE MESSAGE: line 1: Threw exception: TypeError: Illegal constructor
</ins><span class="cx"> This passes if it doesn't alert the contents of innocent-victim.  
</span></span></pre></div>
<a id="trunkLayoutTestshttptestssecuritywindownamedvalueOfhtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/window-named-valueOf.html (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/http/tests/security/window-named-valueOf.html        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/http/tests/security/window-named-valueOf.html        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -23,6 +23,7 @@
</span><span class="cx">                 obj.__proto__.__proto__ = parent;
</span><span class="cx">                 alert(obj.valueOf.constructor(&quot;return document.body.innerHTML&quot;)());
</span><span class="cx">             } catch(ex) {
</span><ins>+               console.log(&quot;Threw exception: &quot; + ex)
</ins><span class="cx">             }
</span><span class="cx">             if (window.testRunner)
</span><span class="cx">                 testRunner.notifyDone();
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/ChangeLog (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/ChangeLog        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/imported/w3c/ChangeLog        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2016-08-05  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Window's named properties should be exposed on a WindowProperties object in its prototype
+        https://bugs.webkit.org/show_bug.cgi?id=160354
+
+        Reviewed by Gavin Barraclough.
+
+        Rebaseline W3C test now that one more check is passing.
+
+        * web-platform-tests/html/dom/interfaces-expected.txt:
+
</ins><span class="cx"> 2016-08-05  Youenn Fablet  &lt;youenn@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [Fetch API] SubresourceLoader::checkRedirectionCrossOriginAccessControl should not always assert in SameOrigin mode
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestshtmldominterfacesexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -5159,7 +5159,7 @@
</span><span class="cx"> PASS Window interface: existence and properties of interface object 
</span><span class="cx"> PASS Window interface object length 
</span><span class="cx"> PASS Window interface object name 
</span><del>-FAIL Window interface: existence and properties of interface prototype object assert_equals: Class name for prototype of Window.prototype is not &quot;WindowProperties&quot; expected &quot;[object WindowProperties]&quot; but got &quot;[object EventTargetPrototype]&quot;
</del><ins>+PASS Window interface: existence and properties of interface prototype object 
</ins><span class="cx"> PASS Window interface: existence and properties of interface prototype object's &quot;constructor&quot; property 
</span><span class="cx"> PASS Window interface: attribute self 
</span><span class="cx"> PASS Window interface: attribute name 
</span></span></pre></div>
<a id="trunkSourceWebCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/CMakeLists.txt (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/CMakeLists.txt        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/Source/WebCore/CMakeLists.txt        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1136,6 +1136,7 @@
</span><span class="cx">     bindings/js/JSDOMStringMapCustom.cpp
</span><span class="cx">     bindings/js/JSDOMWindowBase.cpp
</span><span class="cx">     bindings/js/JSDOMWindowCustom.cpp
</span><ins>+    bindings/js/JSDOMWindowProperties.cpp
</ins><span class="cx">     bindings/js/JSDOMWindowShell.cpp
</span><span class="cx">     bindings/js/JSDOMWrapper.cpp
</span><span class="cx">     bindings/js/JSDataCueCustom.cpp
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/Source/WebCore/ChangeLog        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1,3 +1,41 @@
</span><ins>+2016-08-05  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Window's named properties should be exposed on a WindowProperties object in its prototype
+        https://bugs.webkit.org/show_bug.cgi?id=160354
+
+        Reviewed by Gavin Barraclough.
+
+        Window's named properties should be exposed on a WindowProperties object
+        in its prototype:
+        - http://heycam.github.io/webidl/#named-properties-object
+
+        Firefox and Chrome both comply with the specification. However, WebKit
+        had no &quot;WindowProperties&quot; object in the Window prototype chain and the
+        named properties are exposed on the Window object itself.
+
+        No new tests, rebaselined existing tests.
+
+        * CMakeLists.txt:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
+        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess): Deleted.
+        (WebCore::JSDOMWindow::put): Deleted.
+        (WebCore::JSDOMWindow::putByIndex): Deleted.
+        (WebCore::JSDOMWindow::getEnumerableLength): Deleted.
+        * bindings/js/JSDOMWindowProperties.cpp: Added.
+        (WebCore::jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter):
+        (WebCore::JSDOMWindowProperties::getOwnPropertySlot):
+        (WebCore::JSDOMWindowProperties::getOwnPropertySlotByIndex):
+        * bindings/js/JSDOMWindowProperties.h: Added.
+        (WebCore::JSDOMWindowProperties::create):
+        (WebCore::JSDOMWindowProperties::createStructure):
+        (WebCore::JSDOMWindowProperties::JSDOMWindowProperties):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+
</ins><span class="cx"> 2016-08-05  Brady Eidson  &lt;beidson@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Create platform/gamepad directory, and make GamepadProvider pure virtual (with a default empty implementation).
</span></span></pre></div>
<a id="trunkSourceWebCoreWebCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -1785,6 +1785,8 @@
</span><span class="cx">                 45FEA5D0156DDE8C00654101 /* Decimal.h in Headers */ = {isa = PBXBuildFile; fileRef = 45FEA5CE156DDE8C00654101 /* Decimal.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 460BB6151D0A1BF000221812 /* Base64Utilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 460BB6131D0A1BEC00221812 /* Base64Utilities.cpp */; };
</span><span class="cx">                 460BB6161D0A1BF000221812 /* Base64Utilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 460BB6141D0A1BEC00221812 /* Base64Utilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                460CBF351D4BCD0E0092E88E /* JSDOMWindowProperties.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 460CBF331D4BCCFE0092E88E /* JSDOMWindowProperties.cpp */; };
+                460CBF361D4BCD0E0092E88E /* JSDOMWindowProperties.h in Headers */ = {isa = PBXBuildFile; fileRef = 460CBF341D4BCCFE0092E88E /* JSDOMWindowProperties.h */; };
</ins><span class="cx">                 4634592C1AC2271000ECB71C /* PowerObserverMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4634592B1AC2271000ECB71C /* PowerObserverMac.cpp */; };
</span><span class="cx">                 463EB6221B8789E00096ED51 /* TagCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 463EB6201B8789CB0096ED51 /* TagCollection.cpp */; };
</span><span class="cx">                 463EB6231B8789E00096ED51 /* TagCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 463EB6211B8789CB0096ED51 /* TagCollection.h */; };
</span><span class="lines">@@ -9086,6 +9088,8 @@
</span><span class="cx">                 45FEA5CE156DDE8C00654101 /* Decimal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Decimal.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 460BB6131D0A1BEC00221812 /* Base64Utilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Base64Utilities.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 460BB6141D0A1BEC00221812 /* Base64Utilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Base64Utilities.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                460CBF331D4BCCFE0092E88E /* JSDOMWindowProperties.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMWindowProperties.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                460CBF341D4BCCFE0092E88E /* JSDOMWindowProperties.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMWindowProperties.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 4634592B1AC2271000ECB71C /* PowerObserverMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PowerObserverMac.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 463EB6201B8789CB0096ED51 /* TagCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TagCollection.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 463EB6211B8789CB0096ED51 /* TagCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TagCollection.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -17783,7 +17787,6 @@
</span><span class="cx">                                 973DC63E145A9409002842C2 /* ExceptionCodeDescription.h */,
</span><span class="cx">                                 9767CE09145ABC12005E64DB /* ExceptionHeaders.h */,
</span><span class="cx">                                 9767CE0A145ABC13005E64DB /* ExceptionInterfaces.h */,
</span><del>-                                9908B0FD1BCAD07D00ED0F45 /* FetchInternalsBuiltins.cpp */,
</del><span class="cx">                                 9B03D8061BB3110D00B764B9 /* FetchInternalsBuiltins.h */,
</span><span class="cx">                                 A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */,
</span><span class="cx">                                 A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */,
</span><span class="lines">@@ -21957,6 +21960,8 @@
</span><span class="cx">                                 E172AF8E1811BC3700FBADB9 /* JSDOMPromise.h */,
</span><span class="cx">                                 BC6932710D7E293900AE44D1 /* JSDOMWindowBase.cpp */,
</span><span class="cx">                                 BC6932720D7E293900AE44D1 /* JSDOMWindowBase.h */,
</span><ins>+                                460CBF331D4BCCFE0092E88E /* JSDOMWindowProperties.cpp */,
+                                460CBF341D4BCCFE0092E88E /* JSDOMWindowProperties.h */,
</ins><span class="cx">                                 BCBFB53A0DCD29CF0019B3E5 /* JSDOMWindowShell.cpp */,
</span><span class="cx">                                 BCBFB53B0DCD29CF0019B3E5 /* JSDOMWindowShell.h */,
</span><span class="cx">                                 65E0E9431133C89F00B4CB10 /* JSDOMWrapper.h */,
</span><span class="lines">@@ -26267,6 +26272,7 @@
</span><span class="cx">                                 E44614170CD6826900FADA75 /* JSHTMLVideoElement.h in Headers */,
</span><span class="cx">                                 81BE20D311F4BC3200915DFA /* JSIDBCursor.h in Headers */,
</span><span class="cx">                                 C585A68311D4FB08004C3E4B /* JSIDBDatabase.h in Headers */,
</span><ins>+                                460CBF361D4BCD0E0092E88E /* JSDOMWindowProperties.h in Headers */,
</ins><span class="cx">                                 C585A69711D4FB13004C3E4B /* JSIDBFactory.h in Headers */,
</span><span class="cx">                                 C572EE1F1201C9BC007D8F82 /* JSIDBIndex.h in Headers */,
</span><span class="cx">                                 C585A68D11D4FB08004C3E4B /* JSIDBKeyRange.h in Headers */,
</span><span class="lines">@@ -29114,6 +29120,7 @@
</span><span class="cx">                                 14947FFD12F80CD200A0F631 /* DocumentOrderedMap.cpp in Sources */,
</span><span class="cx">                                 A8C2280E11D4A59700D5A7D3 /* DocumentParser.cpp in Sources */,
</span><span class="cx">                                 4A4F48A916B0DFC000EDBB29 /* DocumentRuleSets.cpp in Sources */,
</span><ins>+                                460CBF351D4BCD0E0092E88E /* JSDOMWindowProperties.cpp in Sources */,
</ins><span class="cx">                                 AD6E71AC1668899D00320C13 /* DocumentSharedObjectPool.cpp in Sources */,
</span><span class="cx">                                 0B9056190F2578BE0095FF6A /* DocumentThreadableLoader.cpp in Sources */,
</span><span class="cx">                                 1221E04A1BFC3D2C006A1A00 /* DocumentTimeline.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSBindingsAllInOnecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -62,6 +62,7 @@
</span><span class="cx"> #include &quot;JSDOMStringMapCustom.cpp&quot;
</span><span class="cx"> #include &quot;JSDOMWindowBase.cpp&quot;
</span><span class="cx"> #include &quot;JSDOMWindowCustom.cpp&quot;
</span><ins>+#include &quot;JSDOMWindowProperties.cpp&quot;
</ins><span class="cx"> #include &quot;JSDOMWindowShell.cpp&quot;
</span><span class="cx"> #include &quot;JSDOMWrapper.cpp&quot;
</span><span class="cx"> #include &quot;JSDataCueCustom.cpp&quot;
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -146,18 +146,6 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    // Do prototype lookup early so that functions and attributes in the prototype can have
-    // precedence over the index and name getters.
-    // FIXME: This seems like a silly idea. It only serves to suppress named property access
-    // to frames that happen to have names corresponding to properties on the prototype.
-    // This seems to only serve to leak some information cross-origin.
-    JSValue proto = thisObject-&gt;getPrototypeDirect();
-    if (proto.isObject() &amp;&amp; asObject(proto)-&gt;getPropertySlot(exec, propertyName, slot)) {
-        thisObject-&gt;printErrorMessage(errorMessage);
-        slot.setUndefined();
-        return true;
-    }
-
</del><span class="cx">     // Check for child frames by name before built-in properties to match Mozilla. This does
</span><span class="cx">     // not match IE, but some sites end up naming frames things that conflict with window
</span><span class="cx">     // properties that are in Moz but not IE. Since we have some of these, we have to do it
</span><span class="lines">@@ -172,45 +160,6 @@
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static bool jsDOMWindowGetOwnPropertySlotNamedItemGetter(JSDOMWindow* thisObject, Frame&amp; frame, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    JSValue proto = thisObject-&gt;getPrototypeDirect();
-    if (proto.isObject() &amp;&amp; asObject(proto)-&gt;hasProperty(exec, propertyName))
-        return false;
-
-    // Check for child frames by name before built-in properties to match Mozilla. This does
-    // not match IE, but some sites end up naming frames things that conflict with window
-    // properties that are in Moz but not IE. Since we have some of these, we have to do it
-    // the Moz way.
-    if (auto* scopedChild = frame.tree().scopedChild(propertyNameToAtomicString(propertyName))) {
-        slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, toJS(exec, scopedChild-&gt;document()-&gt;domWindow()));
-        return true;
-    }
-
-    // FIXME: Search the whole frame hierarchy somewhere around here.
-    // We need to test the correct priority order.
-
-    // Allow shortcuts like 'Image1' instead of document.images.Image1
-    Document* document = frame.document();
-    if (is&lt;HTMLDocument&gt;(*document)) {
-        auto&amp; htmlDocument = downcast&lt;HTMLDocument&gt;(*document);
-        auto* atomicPropertyName = propertyName.publicName();
-        if (atomicPropertyName &amp;&amp; htmlDocument.hasWindowNamedItem(*atomicPropertyName)) {
-            JSValue namedItem;
-            if (UNLIKELY(htmlDocument.windowNamedItemContainsMultipleElements(*atomicPropertyName))) {
-                Ref&lt;HTMLCollection&gt; collection = document-&gt;windowNamedItems(atomicPropertyName);
-                ASSERT(collection-&gt;length() &gt; 1);
-                namedItem = toJS(exec, thisObject-&gt;globalObject(), collection);
-            } else
-                namedItem = toJS(exec, thisObject-&gt;globalObject(), htmlDocument.windowNamedItem(*atomicPropertyName));
-            slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, namedItem);
-            return true;
-        }
-    }
-
-    return false;
-}
-
</del><span class="cx"> // Property access sequence is:
</span><span class="cx"> // (1) indexed properties,
</span><span class="cx"> // (2) regular own properties,
</span><span class="lines">@@ -254,9 +203,7 @@
</span><span class="cx">     }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    // (3) Finally, named properties.
-    // Really, this should just be 'return false;' - these should all be on the NPO.
-    return jsDOMWindowGetOwnPropertySlotNamedItemGetter(thisObject, *frame, exec, propertyName, slot);
</del><ins>+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // Property access sequence is:
</span><span class="lines">@@ -284,12 +231,7 @@
</span><span class="cx">         return jsDOMWindowGetOwnPropertySlotRestrictedAccess(thisObject, frame, exec, Identifier::from(exec, index), slot, errorMessage);
</span><span class="cx"> 
</span><span class="cx">     // (2) Regular own properties.
</span><del>-    if (Base::getOwnPropertySlotByIndex(thisObject, exec, index, slot))
-        return true;
-
-    // (3) Finally, named properties.
-    // Really, this should just be 'return false;' - these should all be on the NPO.
-    return jsDOMWindowGetOwnPropertySlotNamedItemGetter(thisObject, *frame, exec, Identifier::from(exec, index), slot);
</del><ins>+    return Base::getOwnPropertySlotByIndex(thisObject, exec, index, slot);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSDOMWindow::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowPropertiescpp"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.cpp (0 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.cpp                                (rev 0)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.cpp        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -0,0 +1,99 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;JSDOMWindowProperties.h&quot;
+
+#include &quot;Frame.h&quot;
+#include &quot;HTMLDocument.h&quot;
+#include &quot;JSDOMBinding.h&quot;
+#include &quot;JSDOMWindowBase.h&quot;
+#include &quot;JSElement.h&quot;
+#include &quot;JSHTMLCollection.h&quot;
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSDOMWindowProperties::s_info = { &quot;WindowProperties&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSDOMWindowProperties) };
+
+static bool jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter(JSDOMWindowProperties* thisObject, Frame&amp; frame, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
+{
+    // Check for child frames by name before built-in properties to match Mozilla. This does
+    // not match IE, but some sites end up naming frames things that conflict with window
+    // properties that are in Moz but not IE. Since we have some of these, we have to do it
+    // the Moz way.
+    if (auto* scopedChild = frame.tree().scopedChild(propertyNameToAtomicString(propertyName))) {
+        slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, toJS(exec, scopedChild-&gt;document()-&gt;domWindow()));
+        return true;
+    }
+
+    // FIXME: Search the whole frame hierarchy somewhere around here.
+    // We need to test the correct priority order.
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = frame.document();
+    if (is&lt;HTMLDocument&gt;(*document)) {
+        auto&amp; htmlDocument = downcast&lt;HTMLDocument&gt;(*document);
+        auto* atomicPropertyName = propertyName.publicName();
+        if (atomicPropertyName &amp;&amp; htmlDocument.hasWindowNamedItem(*atomicPropertyName)) {
+            JSValue namedItem;
+            if (UNLIKELY(htmlDocument.windowNamedItemContainsMultipleElements(*atomicPropertyName))) {
+                Ref&lt;HTMLCollection&gt; collection = document-&gt;windowNamedItems(atomicPropertyName);
+                ASSERT(collection-&gt;length() &gt; 1);
+                namedItem = toJS(exec, thisObject-&gt;globalObject(), collection);
+            } else
+                namedItem = toJS(exec, thisObject-&gt;globalObject(), htmlDocument.windowNamedItem(*atomicPropertyName));
+            slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, namedItem);
+            return true;
+        }
+    }
+
+    return false;
+}
+
+bool JSDOMWindowProperties::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
+{
+    auto* thisObject = jsCast&lt;JSDOMWindowProperties*&gt;(object);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    if (Base::getOwnPropertySlot(thisObject, state, propertyName, slot))
+        return true;
+    JSValue proto = thisObject-&gt;getPrototypeDirect();
+    if (proto.isObject() &amp;&amp; jsCast&lt;JSObject*&gt;(proto)-&gt;hasProperty(state, propertyName))
+        return false;
+
+    auto&amp; window = jsCast&lt;JSDOMWindowBase*&gt;(thisObject-&gt;globalObject())-&gt;wrapped();
+    if (auto* frame = window.frame())
+        return jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter(thisObject, *frame, state, propertyName, slot);
+
+    return false;
+}
+
+bool JSDOMWindowProperties::getOwnPropertySlotByIndex(JSObject* object, ExecState* state, unsigned index, PropertySlot&amp; slot)
+{
+    return getOwnPropertySlot(object, state, Identifier::from(state, index), slot);
+}
+
+} // namespace WebCore
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowPropertiesh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h (0 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h                                (rev 0)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowProperties.h        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -0,0 +1,61 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include &quot;DOMWindow.h&quot;
+#include &quot;JSDOMWindow.h&quot;
+#include &quot;JSDOMWrapper.h&quot;
+
+namespace WebCore {
+
+class JSDOMWindowProperties : public JSDOMObject {
+public:
+    static JSDOMWindowProperties* create(JSC::Structure* structure, JSC::JSGlobalObject&amp; globalObject)
+    {
+        JSDOMWindowProperties* ptr = new (NotNull, JSC::allocateCell&lt;JSDOMWindowProperties&gt;(globalObject.vm().heap)) JSDOMWindowProperties(structure, globalObject);
+        ptr-&gt;finishCreation(globalObject.vm());
+        return ptr;
+    }
+
+    DECLARE_INFO;
+
+    static JSC::Structure* createStructure(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+    static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
+    static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);
+
+    static const unsigned StructureFlags = JSC::GetOwnPropertySlotIsImpureForPropertyAbsence | JSC::InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
+
+protected:
+    JSDOMWindowProperties(JSC::Structure* structure, JSC::JSGlobalObject&amp; globalObject)
+        : JSDOMObject(structure, globalObject)
+    { }
+};
+
+} // namespace WebCore
</ins></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowShellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp (204178 => 204179)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp        2016-08-05 18:27:49 UTC (rev 204178)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp        2016-08-05 18:36:21 UTC (rev 204179)
</span><span class="lines">@@ -32,6 +32,7 @@
</span><span class="cx"> #include &quot;Frame.h&quot;
</span><span class="cx"> #include &quot;GCController.h&quot;
</span><span class="cx"> #include &quot;JSDOMWindow.h&quot;
</span><ins>+#include &quot;JSDOMWindowProperties.h&quot;
</ins><span class="cx"> #include &quot;JSEventTarget.h&quot;
</span><span class="cx"> #include &quot;ScriptController.h&quot;
</span><span class="cx"> #include &lt;heap/StrongInlines.h&gt;
</span><span class="lines">@@ -85,7 +86,11 @@
</span><span class="cx">     Structure* structure = JSDOMWindow::createStructure(vm, 0, prototype.get());
</span><span class="cx">     JSDOMWindow* jsDOMWindow = JSDOMWindow::create(vm, structure, *domWindow, this);
</span><span class="cx">     prototype-&gt;structure()-&gt;setGlobalObject(vm, jsDOMWindow);
</span><del>-    prototype-&gt;structure()-&gt;setPrototypeWithoutTransition(vm, JSEventTarget::prototype(vm, jsDOMWindow));
</del><ins>+
+    Structure* windowPropertiesStructure = JSDOMWindowProperties::createStructure(vm, jsDOMWindow, JSEventTarget::prototype(vm, jsDOMWindow));
+    JSDOMWindowProperties* windowProperties = JSDOMWindowProperties::create(windowPropertiesStructure, *jsDOMWindow);
+
+    prototype-&gt;structure()-&gt;setPrototypeWithoutTransition(vm, windowProperties);
</ins><span class="cx">     setWindow(vm, jsDOMWindow);
</span><span class="cx">     ASSERT(jsDOMWindow-&gt;globalObject() == jsDOMWindow);
</span><span class="cx">     ASSERT(prototype-&gt;globalObject() == jsDOMWindow);
</span></span></pre>
</div>
</div>

</body>
</html>