<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207355] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207355">207355</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-10-14 15:16:34 -0700 (Fri, 14 Oct 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/207319">r207319</a>.

Regressed Dromaeo and may have caused crashes under
GuardMalloc (rdar://problem/28780835)

Reverted changeset:

&quot;[Web IDL] Add support for [SameObject] extended attribute&quot;
https://bugs.webkit.org/show_bug.cgi?id=163414
http://trac.webkit.org/changeset/207319</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsIDLAttributestxt">trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt</a></li>
<li><a href="#trunkSourceWebCoredomDataTransferidl">trunk/Source/WebCore/dom/DataTransfer.idl</a></li>
<li><a href="#trunkSourceWebCoredomDocumentidl">trunk/Source/WebCore/dom/Document.idl</a></li>
<li><a href="#trunkSourceWebCoredomElementidl">trunk/Source/WebCore/dom/Element.idl</a></li>
<li><a href="#trunkSourceWebCoredomMutationRecordidl">trunk/Source/WebCore/dom/MutationRecord.idl</a></li>
<li><a href="#trunkSourceWebCoredomNodeidl">trunk/Source/WebCore/dom/Node.idl</a></li>
<li><a href="#trunkSourceWebCoredomNodeIteratoridl">trunk/Source/WebCore/dom/NodeIterator.idl</a></li>
<li><a href="#trunkSourceWebCoredomParentNodeidl">trunk/Source/WebCore/dom/ParentNode.idl</a></li>
<li><a href="#trunkSourceWebCoredomTreeWalkeridl">trunk/Source/WebCore/dom/TreeWalker.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLAnchorElementidl">trunk/Source/WebCore/html/HTMLAnchorElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLAreaElementidl">trunk/Source/WebCore/html/HTMLAreaElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLButtonElementidl">trunk/Source/WebCore/html/HTMLButtonElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLDataListElementidl">trunk/Source/WebCore/html/HTMLDataListElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLDocumentidl">trunk/Source/WebCore/html/HTMLDocument.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLElementidl">trunk/Source/WebCore/html/HTMLElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLFieldSetElementidl">trunk/Source/WebCore/html/HTMLFieldSetElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLFormElementidl">trunk/Source/WebCore/html/HTMLFormElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLIFrameElementidl">trunk/Source/WebCore/html/HTMLIFrameElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLInputElementidl">trunk/Source/WebCore/html/HTMLInputElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLKeygenElementidl">trunk/Source/WebCore/html/HTMLKeygenElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLLinkElementidl">trunk/Source/WebCore/html/HTMLLinkElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMapElementidl">trunk/Source/WebCore/html/HTMLMapElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementidl">trunk/Source/WebCore/html/HTMLMediaElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLMeterElementidl">trunk/Source/WebCore/html/HTMLMeterElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLOutputElementidl">trunk/Source/WebCore/html/HTMLOutputElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLProgressElementidl">trunk/Source/WebCore/html/HTMLProgressElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLSelectElementidl">trunk/Source/WebCore/html/HTMLSelectElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableElementidl">trunk/Source/WebCore/html/HTMLTableElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableRowElementidl">trunk/Source/WebCore/html/HTMLTableRowElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTableSectionElementidl">trunk/Source/WebCore/html/HTMLTableSectionElement.idl</a></li>
<li><a href="#trunkSourceWebCorehtmlHTMLTextAreaElementidl">trunk/Source/WebCore/html/HTMLTextAreaElement.idl</a></li>
<li><a href="#trunkSourceWebCorepageLocationidl">trunk/Source/WebCore/page/Location.idl</a></li>
<li><a href="#trunkSourceWebCorepageNavigatoridl">trunk/Source/WebCore/page/Navigator.idl</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsdomSameObjectsupportexpectedtxt">trunk/LayoutTests/js/dom/SameObject-support-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomSameObjectsupporthtml">trunk/LayoutTests/js/dom/SameObject-support.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/LayoutTests/ChangeLog        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-10-14  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Unreviewed, rolling out r207319.
+
+        Regressed Dromaeo and may have caused crashes under
+        GuardMalloc (rdar://problem/28780835)
+
+        Reverted changeset:
+
+        &quot;[Web IDL] Add support for [SameObject] extended attribute&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=163414
+        http://trac.webkit.org/changeset/207319
+
</ins><span class="cx"> 2016-10-14  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [css-grid] Changing the argument on fit-content() doesn't cause the grid to be relayout
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomSameObjectsupportexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/dom/SameObject-support-expected.txt (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/SameObject-support-expected.txt        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/LayoutTests/js/dom/SameObject-support-expected.txt        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -1,146 +0,0 @@
</span><del>-Test support for [SameObject] extended attribute in Web IDL.
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS document.implementation === document.implementation is true
-PASS document.implementation.foo is 1
-
-PASS document.images === document.images is true
-PASS document.images.foo is 1
-
-PASS document.applets === document.applets is true
-PASS document.applets.foo is 1
-
-PASS document.links === document.links is true
-PASS document.links.foo is 1
-
-PASS document.forms === document.forms is true
-PASS document.forms.foo is 1
-
-PASS document.anchors === document.anchors is true
-PASS document.anchors.foo is 1
-
-PASS document.embeds === document.embeds is true
-PASS document.embeds.foo is 1
-
-PASS document.plugins === document.plugins is true
-PASS document.plugins.foo is 1
-
-PASS document.scripts === document.scripts is true
-PASS document.scripts.foo is 1
-
-PASS htmlElement.childNodes === htmlElement.childNodes is true
-PASS htmlElement.childNodes.foo is 1
-
-PASS htmlElement.attributes === htmlElement.attributes is true
-PASS htmlElement.attributes.foo is 1
-
-PASS htmlElement.classList === htmlElement.classList is true
-PASS htmlElement.classList.foo is 1
-
-PASS htmlElement.children === htmlElement.children is true
-PASS htmlElement.children.foo is 1
-
-PASS htmlElement.dataset === htmlElement.dataset is true
-PASS htmlElement.dataset.foo is 1
-
-PASS anchorElement.relList === anchorElement.relList is true
-PASS anchorElement.relList.foo is 1
-
-PASS areaElement.relList === areaElement.relList is true
-PASS areaElement.relList.foo is 1
-
-PASS buttonElement.labels === buttonElement.labels is true
-PASS buttonElement.labels.foo is 1
-
-PASS fieldsetElement.elements === fieldsetElement.elements is true
-PASS fieldsetElement.elements.foo is 1
-
-PASS fieldsetElement.validity === fieldsetElement.validity is true
-PASS fieldsetElement.validity.foo is 1
-
-PASS formElement.elements === formElement.elements is true
-PASS formElement.elements.foo is 1
-
-PASS iframeElement.sandbox === iframeElement.sandbox is true
-PASS iframeElement.sandbox.foo is 1
-
-PASS inputElement.labels === inputElement.labels is true
-PASS inputElement.labels.foo is 1
-
-PASS keygenElement.labels === keygenElement.labels is true
-PASS keygenElement.labels.foo is 1
-
-PASS linkElement.sizes === linkElement.sizes is true
-PASS linkElement.sizes.foo is 1
-
-PASS linkElement.relList === linkElement.relList is true
-PASS linkElement.relList.foo is 1
-
-PASS mapElement.areas === mapElement.areas is true
-PASS mapElement.areas.foo is 1
-
-PASS mediaElement.audioTracks === mediaElement.audioTracks is true
-PASS mediaElement.audioTracks.foo is 1
-
-PASS mediaElement.textTracks === mediaElement.textTracks is true
-PASS mediaElement.textTracks.foo is 1
-
-PASS mediaElement.videoTracks === mediaElement.videoTracks is true
-PASS mediaElement.videoTracks.foo is 1
-
-PASS meterElement.labels === meterElement.labels is true
-PASS meterElement.labels.foo is 1
-
-PASS outputElement.htmlFor === outputElement.htmlFor is true
-PASS outputElement.htmlFor.foo is 1
-
-PASS outputElement.labels === outputElement.labels is true
-PASS outputElement.labels.foo is 1
-
-PASS progressElement.labels === progressElement.labels is true
-PASS progressElement.labels.foo is 1
-
-PASS selectElement.options === selectElement.options is true
-PASS selectElement.options.foo is 1
-
-PASS selectElement.selectedOptions === selectElement.selectedOptions is true
-PASS selectElement.selectedOptions.foo is 1
-
-PASS selectElement.labels === selectElement.labels is true
-PASS selectElement.labels.foo is 1
-
-PASS tableElement.rows === tableElement.rows is true
-PASS tableElement.rows.foo is 1
-
-PASS tableElement.tBodies === tableElement.tBodies is true
-PASS tableElement.tBodies.foo is 1
-
-PASS trElement.cells === trElement.cells is true
-PASS trElement.cells.foo is 1
-
-PASS tbodyElement.rows === tbodyElement.rows is true
-PASS tbodyElement.rows.foo is 1
-
-PASS textareaElement.labels === textareaElement.labels is true
-PASS textareaElement.labels.foo is 1
-
-PASS location.ancestorOrigins === location.ancestorOrigins is true
-
-PASS navigator.plugins === navigator.plugins is true
-PASS navigator.plugins.foo is 1
-
-PASS navigator.mimeTypes === navigator.mimeTypes is true
-PASS navigator.mimeTypes.foo is 1
-
-PASS nodeIterator.root === nodeIterator.root is true
-PASS nodeIterator.root.foo is 1
-
-PASS treeWalker.root === treeWalker.root is true
-PASS treeWalker.root.foo is 1
-
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsdomSameObjectsupporthtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/dom/SameObject-support.html (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/SameObject-support.html        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/LayoutTests/js/dom/SameObject-support.html        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -1,119 +0,0 @@
</span><del>-&lt;!DOCTYPE html&gt;
-&lt;html&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script&gt;
-description(&quot;Test support for [SameObject] extended attribute in Web IDL.&quot;);
-
-var htmlElement = document.createElement(&quot;test&quot;);
-var anchorElement = document.createElement(&quot;a&quot;);
-var areaElement = document.createElement(&quot;area&quot;);
-var buttonElement = document.createElement(&quot;button&quot;);
-var formElement = document.createElement(&quot;form&quot;);
-var iframeElement = document.createElement(&quot;iframe&quot;);
-var inputElement = document.createElement(&quot;input&quot;);
-var keygenElement = document.createElement(&quot;keygen&quot;);
-var fieldsetElement = document.createElement(&quot;fieldset&quot;);
-var linkElement = document.createElement(&quot;link&quot;);
-var mapElement = document.createElement(&quot;map&quot;);
-var mediaElement = document.createElement(&quot;video&quot;);
-var meterElement = document.createElement(&quot;meter&quot;);
-var outputElement = document.createElement(&quot;output&quot;);
-var progressElement = document.createElement(&quot;progress&quot;);
-var selectElement = document.createElement(&quot;select&quot;);
-var tableElement = document.createElement(&quot;table&quot;);
-var trElement = document.createElement(&quot;tr&quot;);
-var tbodyElement = document.createElement(&quot;tbody&quot;);
-var textareaElement = document.createElement(&quot;textarea&quot;);
-var nodeIterator = document.createNodeIterator(document.body);
-var treeWalker = document.createTreeWalker(document.body);
-
-function testSameObjectAttribute(object, attributeName)
-{
-    try {
-        shouldBeTrue(object + &quot;.&quot; + attributeName + &quot; === &quot; + object + &quot;.&quot; + attributeName);
-
-        var attributeObject = eval(object + &quot;['&quot; + attributeName + &quot;']&quot;);
-        if (!Object.isFrozen(attributeObject)) {
-            Object.defineProperty(attributeObject, &quot;foo&quot;, { value: 1 });
-            document.body.appendChild(document.createElement('span')); // DOM tree mutation.
-            gc();
-            shouldBe(object + &quot;.&quot; + attributeName + &quot;.foo&quot;, &quot;1&quot;);
-        }
-    } catch(e) {
-        testFailed(&quot;&quot; + e);
-    }
-    debug(&quot;&quot;);
-}
-
-var documentAttributes = [&quot;implementation&quot;, &quot;images&quot;, &quot;applets&quot;, &quot;links&quot;, &quot;forms&quot;, &quot;anchors&quot;, &quot;embeds&quot;, &quot;plugins&quot;, &quot;scripts&quot;];
-for (var attribute of documentAttributes)
-    testSameObjectAttribute(&quot;document&quot;, attribute);
-
-var htmlElementAttributes = [&quot;childNodes&quot;, &quot;attributes&quot;, &quot;classList&quot;, &quot;children&quot;, &quot;dataset&quot;];
-for (var attribute of htmlElementAttributes)
-    testSameObjectAttribute(&quot;htmlElement&quot;, attribute);
-
-testSameObjectAttribute(&quot;anchorElement&quot;, &quot;relList&quot;);
-
-testSameObjectAttribute(&quot;areaElement&quot;, &quot;relList&quot;);
-
-testSameObjectAttribute(&quot;buttonElement&quot;, &quot;labels&quot;);
-
-var fiedsetElementAttributes = [&quot;elements&quot;, &quot;validity&quot;];
-for (var attribute of fiedsetElementAttributes)
-    testSameObjectAttribute(&quot;fieldsetElement&quot;, attribute);
-
-testSameObjectAttribute(&quot;formElement&quot;, &quot;elements&quot;);
-
-testSameObjectAttribute(&quot;iframeElement&quot;, &quot;sandbox&quot;);
-
-testSameObjectAttribute(&quot;inputElement&quot;, &quot;labels&quot;);
-
-testSameObjectAttribute(&quot;keygenElement&quot;, &quot;labels&quot;);
-
-var linkElementAttributes = [&quot;sizes&quot;, &quot;relList&quot;];
-for (var attribute of linkElementAttributes)
-    testSameObjectAttribute(&quot;linkElement&quot;, attribute);
-
-testSameObjectAttribute(&quot;mapElement&quot;, &quot;areas&quot;);
-
-var mediaElementAttributes = [&quot;audioTracks&quot;, &quot;textTracks&quot;, &quot;videoTracks&quot;];
-for (var attribute of mediaElementAttributes)
-    testSameObjectAttribute(&quot;mediaElement&quot;, attribute);
-
-testSameObjectAttribute(&quot;meterElement&quot;, &quot;labels&quot;);
-
-var outputElementAttributes = [&quot;htmlFor&quot;, &quot;labels&quot;];
-for (var attribute of outputElementAttributes)
-    testSameObjectAttribute(&quot;outputElement&quot;, attribute);
-
-testSameObjectAttribute(&quot;progressElement&quot;, &quot;labels&quot;);
-
-var selectElementAttributes = [&quot;options&quot;, &quot;selectedOptions&quot;, &quot;labels&quot;];
-for (var attribute of selectElementAttributes)
-    testSameObjectAttribute(&quot;selectElement&quot;, attribute);
-
-var tableElementAttributes = [&quot;rows&quot;, &quot;tBodies&quot;];
-for (var attribute of tableElementAttributes)
-    testSameObjectAttribute(&quot;tableElement&quot;, attribute);
-
-testSameObjectAttribute(&quot;trElement&quot;, &quot;cells&quot;);
-
-testSameObjectAttribute(&quot;tbodyElement&quot;, &quot;rows&quot;);
-
-testSameObjectAttribute(&quot;textareaElement&quot;, &quot;labels&quot;);
-
-testSameObjectAttribute(&quot;location&quot;, &quot;ancestorOrigins&quot;);
-
-var navigatorAttributes = [&quot;plugins&quot;, &quot;mimeTypes&quot;];
-for (var attribute of navigatorAttributes)
-    testSameObjectAttribute(&quot;navigator&quot;, attribute);
-
-testSameObjectAttribute(&quot;nodeIterator&quot;, &quot;root&quot;);
-
-testSameObjectAttribute(&quot;treeWalker&quot;, &quot;root&quot;);
-&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/ChangeLog        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2016-10-14  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Unreviewed, rolling out r207319.
+
+        Regressed Dromaeo and may have caused crashes under
+        GuardMalloc (rdar://problem/28780835)
+
+        Reverted changeset:
+
+        &quot;[Web IDL] Add support for [SameObject] extended attribute&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=163414
+        http://trac.webkit.org/changeset/207319
+
</ins><span class="cx"> 2016-10-14  Anders Carlsson  &lt;andersca@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Clean up BackForwardClient
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -352,15 +352,6 @@
</span><span class="cx">     return IsDOMGlobalObject($interface);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-sub ShouldCacheAttribute
-{
-    my $attribute = shift;
-
-    return 1 if $attribute-&gt;signature-&gt;extendedAttributes-&gt;{CachedAttribute};
-    return 1 if $attribute-&gt;signature-&gt;extendedAttributes-&gt;{SameObject};
-    return 0;
-}
-
</del><span class="cx"> sub GenerateGetOwnPropertySlotBody
</span><span class="cx"> {
</span><span class="cx">     my ($interface, $className, $inlined) = @_;
</span><span class="lines">@@ -1490,7 +1481,7 @@
</span><span class="cx">             my $attribute = $_;
</span><span class="cx">             $numCustomAttributes++ if HasCustomGetter($attribute-&gt;signature-&gt;extendedAttributes);
</span><span class="cx">             $numCustomAttributes++ if HasCustomSetter($attribute-&gt;signature-&gt;extendedAttributes);
</span><del>-            if (ShouldCacheAttribute($attribute)) {
</del><ins>+            if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{CachedAttribute}) {
</ins><span class="cx">                 my $conditionalString = $codeGenerator-&gt;GenerateConditionalString($attribute-&gt;signature);
</span><span class="cx">                 push(@headerContent, &quot;#if ${conditionalString}\n&quot;) if $conditionalString;
</span><span class="cx">                 push(@headerContent, &quot;    mutable JSC::WriteBarrier&lt;JSC::Unknown&gt; m_&quot; . $attribute-&gt;signature-&gt;name . &quot;;\n&quot;);
</span><span class="lines">@@ -3073,7 +3064,7 @@
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            $needsVisitChildren = 1 if ShouldCacheAttribute($attribute);
</del><ins>+            $needsVisitChildren = 1 if $attribute-&gt;signature-&gt;extendedAttributes-&gt;{CachedAttribute};
</ins><span class="cx"> 
</span><span class="cx">             if ($interface-&gt;extendedAttributes-&gt;{CheckSecurity} &amp;&amp;
</span><span class="cx">                 !$attribute-&gt;signature-&gt;extendedAttributes-&gt;{DoNotCheckSecurity} &amp;&amp;
</span><span class="lines">@@ -3148,7 +3139,7 @@
</span><span class="cx">                 }
</span><span class="cx">             } elsif (!$attribute-&gt;signature-&gt;extendedAttributes-&gt;{GetterMayThrowLegacyException}) {
</span><span class="cx">                 my $cacheIndex = 0;
</span><del>-                if (ShouldCacheAttribute($attribute)) {
</del><ins>+                if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{CachedAttribute}) {
</ins><span class="cx">                     $cacheIndex = $currentCachedAttribute;
</span><span class="cx">                     $currentCachedAttribute++;
</span><span class="cx">                     push(@implContent, &quot;    if (JSValue cachedValue = thisObject.m_&quot; . $attribute-&gt;signature-&gt;name . &quot;.get())\n&quot;);
</span><span class="lines">@@ -3191,7 +3182,7 @@
</span><span class="cx">                     }
</span><span class="cx">                 }
</span><span class="cx"> 
</span><del>-                push(@implContent, &quot;    thisObject.m_&quot; . $attribute-&gt;signature-&gt;name . &quot;.set(state.vm(), &amp;thisObject, result);\n&quot;) if ShouldCacheAttribute($attribute);
</del><ins>+                push(@implContent, &quot;    thisObject.m_&quot; . $attribute-&gt;signature-&gt;name . &quot;.set(state.vm(), &amp;thisObject, result);\n&quot;) if $attribute-&gt;signature-&gt;extendedAttributes-&gt;{CachedAttribute};
</ins><span class="cx">                 push(@implContent, &quot;    return result;\n&quot;);
</span><span class="cx"> 
</span><span class="cx">             } else {
</span><span class="lines">@@ -3777,7 +3768,7 @@
</span><span class="cx">         if ($numCachedAttributes &gt; 0) {
</span><span class="cx">             foreach (@{$interface-&gt;attributes}) {
</span><span class="cx">                 my $attribute = $_;
</span><del>-                if (ShouldCacheAttribute($attribute)) {
</del><ins>+                if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{CachedAttribute}) {
</ins><span class="cx">                     push(@implContent, &quot;    visitor.append(&amp;thisObject-&gt;m_&quot; . $attribute-&gt;signature-&gt;name . &quot;);\n&quot;);
</span><span class="cx">                 }
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsIDLAttributestxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/bindings/scripts/IDLAttributes.txt        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -114,7 +114,6 @@
</span><span class="cx"> ReportExtraMemoryCost
</span><span class="cx"> ReportExternalMemoryCost
</span><span class="cx"> RequiresExistingAtomicString
</span><del>-SameObject
</del><span class="cx"> SetterCallWith=ScriptExecutionContext|ScriptState|ScriptArguments|CallStack|ActiveWindow|FirstWindow
</span><span class="cx"> SetterMayThrowException
</span><span class="cx"> SetterMayThrowLegacyException
</span></span></pre></div>
<a id="trunkSourceWebCoredomDataTransferidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DataTransfer.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DataTransfer.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/DataTransfer.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx">     attribute DOMString effectAllowed;
</span><span class="cx"> 
</span><span class="cx">     [CustomGetter] readonly attribute Array types;
</span><del>-    [SameObject] readonly attribute FileList files;
</del><ins>+    readonly attribute FileList files;
</ins><span class="cx"> 
</span><span class="cx">     void clearData(optional DOMString type);
</span><span class="cx">     DOMString getData(DOMString type);
</span><span class="lines">@@ -40,6 +40,5 @@
</span><span class="cx">     void setData(DOMString type, DOMString data);
</span><span class="cx">     void setDragImage(Element? image, long x, long y); // FIXME: Element argument is not nullable in the HTML standard.
</span><span class="cx"> 
</span><del>-    // FIXME: Should be [SameObject].
</del><span class="cx">     [Conditional=DATA_TRANSFER_ITEMS] readonly attribute DataTransferItemList items;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/Document.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -28,7 +28,7 @@
</span><span class="cx">     JSGenerateToNativeObject,
</span><span class="cx"> ] interface Document : Node {
</span><span class="cx">     readonly attribute DocumentType? doctype;
</span><del>-    [SameObject] readonly attribute DOMImplementation implementation;
</del><ins>+    readonly attribute DOMImplementation implementation;
</ins><span class="cx">     readonly attribute Element? documentElement;
</span><span class="cx"> 
</span><span class="cx">     [NewObject, MayThrowLegacyException, ImplementedAs=createElementForBindings] Element createElement(DOMString tagName);
</span><span class="lines">@@ -105,14 +105,14 @@
</span><span class="cx">     [SetterMayThrowLegacyException, ImplementedAs=bodyOrFrameset] attribute HTMLElement? body;
</span><span class="cx"> 
</span><span class="cx">     readonly attribute HTMLHeadElement? head;
</span><del>-    [SameObject] readonly attribute HTMLCollection images;
-    [SameObject] readonly attribute HTMLCollection applets;
-    [SameObject] readonly attribute HTMLCollection links;
-    [SameObject] readonly attribute HTMLCollection forms;
-    [SameObject] readonly attribute HTMLCollection anchors;
-    [SameObject] readonly attribute HTMLCollection embeds;
-    [SameObject] readonly attribute HTMLCollection plugins;
-    [SameObject] readonly attribute HTMLCollection scripts;
</del><ins>+    readonly attribute HTMLCollection images;
+    readonly attribute HTMLCollection applets;
+    readonly attribute HTMLCollection links;
+    readonly attribute HTMLCollection forms;
+    readonly attribute HTMLCollection anchors;
+    readonly attribute HTMLCollection embeds;
+    readonly attribute HTMLCollection plugins;
+    readonly attribute HTMLCollection scripts;
</ins><span class="cx">     readonly attribute DOMString lastModified;
</span><span class="cx"> 
</span><span class="cx">     NodeList getElementsByName([AtomicString] DOMString elementName);
</span></span></pre></div>
<a id="trunkSourceWebCoredomElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Element.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Element.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/Element.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx"> 
</span><span class="cx">     HTMLCollection getElementsByTagName(DOMString name);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NamedNodeMap attributes;
</del><ins>+    readonly attribute NamedNodeMap attributes;
</ins><span class="cx">     boolean hasAttributes();
</span><span class="cx"> 
</span><span class="cx">     DOMString? getAttributeNS(DOMString? namespaceURI, DOMString localName);
</span><span class="lines">@@ -101,7 +101,7 @@
</span><span class="cx">     [TreatNullAs=EmptyString, SetterMayThrowLegacyException] attribute DOMString outerHTML;
</span><span class="cx"> 
</span><span class="cx">     [CEReactions, Reflect=class] attribute DOMString className;
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList classList;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList classList;
</ins><span class="cx"> 
</span><span class="cx">     [MayThrowLegacyException] boolean matches(DOMString selectors);
</span><span class="cx">     [MayThrowLegacyException] Element closest(DOMString selectors);    
</span></span></pre></div>
<a id="trunkSourceWebCoredomMutationRecordidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/MutationRecord.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/MutationRecord.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/MutationRecord.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -32,10 +32,10 @@
</span><span class="cx">     SkipVTableValidation
</span><span class="cx"> ] interface MutationRecord {
</span><span class="cx">     readonly attribute DOMString type;
</span><del>-    [SameObject] readonly attribute Node target;
</del><ins>+    readonly attribute Node target;
</ins><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList addedNodes;
-    [SameObject] readonly attribute NodeList removedNodes;
</del><ins>+    readonly attribute NodeList addedNodes;
+    readonly attribute NodeList removedNodes;
</ins><span class="cx">     readonly attribute Node previousSibling;
</span><span class="cx">     readonly attribute Node nextSibling;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoredomNodeidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Node.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Node.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/Node.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx"> 
</span><span class="cx">     [DOMJIT, CustomGetter] readonly attribute unsigned short nodeType;
</span><span class="cx">     [DOMJIT] readonly attribute Node? parentNode;
</span><del>-    [SameObject] readonly attribute NodeList childNodes;
</del><ins>+    readonly attribute NodeList childNodes;
</ins><span class="cx">     [DOMJIT] readonly attribute Node? firstChild;
</span><span class="cx">     [DOMJIT] readonly attribute Node? lastChild;
</span><span class="cx">     [DOMJIT] readonly attribute Node? previousSibling;
</span></span></pre></div>
<a id="trunkSourceWebCoredomNodeIteratoridl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/NodeIterator.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/NodeIterator.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/NodeIterator.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -23,7 +23,7 @@
</span><span class="cx">     ImplementationLacksVTable,
</span><span class="cx">     JSCustomMarkFunction,
</span><span class="cx"> ] interface NodeIterator {
</span><del>-    [SameObject] readonly attribute Node root;
</del><ins>+    readonly attribute Node root;
</ins><span class="cx">     readonly attribute unsigned long whatToShow;
</span><span class="cx">     readonly attribute NodeFilter filter;
</span><span class="cx">     readonly attribute Node referenceNode;
</span></span></pre></div>
<a id="trunkSourceWebCoredomParentNodeidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/ParentNode.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/ParentNode.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/ParentNode.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -28,7 +28,7 @@
</span><span class="cx"> [
</span><span class="cx">     NoInterfaceObject,
</span><span class="cx"> ] interface ParentNode {
</span><del>-    [SameObject] readonly attribute HTMLCollection children;
</del><ins>+    readonly attribute HTMLCollection children;
</ins><span class="cx">     readonly attribute Element firstElementChild;
</span><span class="cx">     readonly attribute Element lastElementChild;
</span><span class="cx">     readonly attribute unsigned long childElementCount;
</span></span></pre></div>
<a id="trunkSourceWebCoredomTreeWalkeridl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/TreeWalker.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/TreeWalker.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/dom/TreeWalker.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -23,7 +23,7 @@
</span><span class="cx">     ImplementationLacksVTable,
</span><span class="cx">     JSCustomMarkFunction,
</span><span class="cx"> ] interface TreeWalker {
</span><del>-    [SameObject] readonly attribute Node root;
</del><ins>+    readonly attribute Node root;
</ins><span class="cx">     readonly attribute unsigned long whatToShow;
</span><span class="cx">     readonly attribute NodeFilter filter;
</span><span class="cx">     attribute Node currentNode;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLAnchorElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLAnchorElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLAnchorElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLAnchorElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> 
</span><span class="cx">     attribute DOMString text;
</span><span class="cx"> 
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList relList;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList relList;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> HTMLAnchorElement implements HTMLHyperlinkElementUtils;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLAreaElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLAreaElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLAreaElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLAreaElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -29,7 +29,7 @@
</span><span class="cx"> 
</span><span class="cx">     [Conditional=DOWNLOAD_ATTRIBUTE, EnabledAtRuntime=DownloadAttribute, Reflect] attribute DOMString download;
</span><span class="cx"> 
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList relList;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList relList;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> HTMLAreaElement implements HTMLHyperlinkElementUtils;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLButtonElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLButtonElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLButtonElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLButtonElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -39,5 +39,5 @@
</span><span class="cx">     boolean checkValidity();
</span><span class="cx">     void setCustomValidity(DOMString? error);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLDataListElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLDataListElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLDataListElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLDataListElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -31,5 +31,5 @@
</span><span class="cx"> [
</span><span class="cx">     Conditional=DATALIST_ELEMENT,
</span><span class="cx"> ] interface HTMLDataListElement : HTMLElement {
</span><del>-    [SameObject] readonly attribute HTMLCollection options;
</del><ins>+    readonly attribute HTMLCollection options;
</ins><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLDocumentidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLDocument.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLDocument.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLDocument.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -30,7 +30,6 @@
</span><span class="cx">     [Custom] void write(optional DOMString text);
</span><span class="cx">     [Custom] void writeln(optional DOMString text);
</span><span class="cx"> 
</span><del>-    // FIXME: Should be [SameObject].
</del><span class="cx">     [Custom, Replaceable, Deletable] readonly attribute HTMLAllCollection all;
</span><span class="cx"> 
</span><span class="cx">     void clear();
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx">     [Reflect] attribute DOMString webkitdropzone;
</span><span class="cx">     // FIXME: Support the standard HTML equivalent.
</span><del>-    // [SameObject, PutForwards=value] readonly attribute DOMTokenList dropzone;
</del><ins>+    // [PutForwards=value] readonly attribute DOMTokenList dropzone;
</ins><span class="cx"> 
</span><span class="cx">     [Reflect] attribute boolean hidden;
</span><span class="cx">     [Reflect] attribute DOMString accessKey;
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx">     void focus();
</span><span class="cx">     void blur();
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute DOMStringMap dataset;
</del><ins>+    readonly attribute DOMStringMap dataset;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> HTMLElement implements GlobalEventHandlers;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLFieldSetElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLFieldSetElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLFieldSetElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLFieldSetElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -24,10 +24,10 @@
</span><span class="cx"> 
</span><span class="cx">     readonly attribute DOMString type;
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute HTMLFormControlsCollection elements;
</del><ins>+    readonly attribute HTMLFormControlsCollection elements;
</ins><span class="cx"> 
</span><span class="cx">     readonly attribute boolean         willValidate;
</span><del>-    [SameObject] readonly attribute ValidityState validity;
</del><ins>+    readonly attribute ValidityState   validity;
</ins><span class="cx">     readonly attribute DOMString       validationMessage;
</span><span class="cx">     boolean  checkValidity();
</span><span class="cx">     void     setCustomValidity(DOMString? error);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLFormElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLFormElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLFormElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLFormElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx">     [Reflect] attribute boolean noValidate;
</span><span class="cx">     [Reflect] attribute DOMString target;
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute HTMLFormControlsCollection elements;
</del><ins>+    readonly attribute HTMLFormControlsCollection elements;
</ins><span class="cx">     readonly attribute long length;
</span><span class="cx"> 
</span><span class="cx">     getter Element (unsigned long index);
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLIFrameElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLIFrameElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLIFrameElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLIFrameElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -27,7 +27,7 @@
</span><span class="cx">     [Reflect, TreatNullAs=EmptyString] attribute DOMString marginWidth;
</span><span class="cx">     [Reflect] attribute DOMString name;
</span><span class="cx"> 
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList sandbox;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList sandbox;
</ins><span class="cx">     [Reflect] attribute boolean allowFullscreen;
</span><span class="cx"> 
</span><span class="cx">     [Reflect] attribute DOMString scrolling;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLInputElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLInputElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLInputElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLInputElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">     boolean checkValidity();
</span><span class="cx">     void setCustomValidity(DOMString? error);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> 
</span><span class="cx">     void select();
</span><span class="cx">     [Custom] attribute long selectionStart;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLKeygenElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLKeygenElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLKeygenElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLKeygenElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -44,6 +44,6 @@
</span><span class="cx">     boolean checkValidity();
</span><span class="cx">     void setCustomValidity(DOMString? error);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLLinkElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLLinkElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLLinkElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLLinkElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -30,7 +30,7 @@
</span><span class="cx">     [Reflect] attribute DOMString media;
</span><span class="cx">     [Reflect] attribute DOMString rel;
</span><span class="cx">     [Reflect] attribute DOMString rev;
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList sizes;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList sizes;
</ins><span class="cx">     [Reflect] attribute DOMString target;
</span><span class="cx">     [Reflect] attribute DOMString type;
</span><span class="cx">     [Reflect] attribute DOMString as;
</span><span class="lines">@@ -39,6 +39,6 @@
</span><span class="cx">     // DOM Level 2 Style
</span><span class="cx">     readonly attribute StyleSheet sheet;
</span><span class="cx"> 
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList relList;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList relList;
</ins><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMapElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMapElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMapElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLMapElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -19,7 +19,7 @@
</span><span class="cx">  */
</span><span class="cx"> 
</span><span class="cx"> interface HTMLMapElement : HTMLElement {
</span><del>-    [SameObject] readonly attribute HTMLCollection areas;
</del><ins>+    readonly attribute HTMLCollection areas;
</ins><span class="cx">     [Reflect] attribute DOMString name;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMediaElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLMediaElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -95,9 +95,9 @@
</span><span class="cx">     [Conditional=LEGACY_ENCRYPTED_MEDIA] void webkitSetMediaKeys(WebKitMediaKeys? mediaKeys);
</span><span class="cx"> 
</span><span class="cx">     [Conditional=VIDEO_TRACK, MayThrowLegacyException] TextTrack addTextTrack(DOMString kind, optional DOMString label = &quot;&quot;, optional DOMString language = &quot;&quot;);
</span><del>-    [Conditional=VIDEO_TRACK, SameObject] readonly attribute AudioTrackList audioTracks;
-    [Conditional=VIDEO_TRACK, SameObject] readonly attribute TextTrackList textTracks;
-    [Conditional=VIDEO_TRACK, SameObject] readonly attribute VideoTrackList videoTracks;
</del><ins>+    [Conditional=VIDEO_TRACK] readonly attribute AudioTrackList audioTracks;
+    [Conditional=VIDEO_TRACK] readonly attribute TextTrackList textTracks;
+    [Conditional=VIDEO_TRACK] readonly attribute VideoTrackList videoTracks;
</ins><span class="cx"> 
</span><span class="cx">     [Reflect] attribute DOMString mediaGroup;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLMeterElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMeterElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLMeterElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLMeterElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -26,5 +26,5 @@
</span><span class="cx">     attribute double low;
</span><span class="cx">     attribute double high;
</span><span class="cx">     attribute double optimum;
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLOutputElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLOutputElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLOutputElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLOutputElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -23,7 +23,7 @@
</span><span class="cx">  */
</span><span class="cx"> 
</span><span class="cx"> interface HTMLOutputElement : HTMLElement {
</span><del>-    [SameObject, PutForwards=value] readonly attribute DOMTokenList htmlFor;
</del><ins>+    [PutForwards=value] readonly attribute DOMTokenList htmlFor;
</ins><span class="cx"> 
</span><span class="cx">     readonly attribute HTMLFormElement form;
</span><span class="cx">     [Reflect] attribute DOMString name;
</span><span class="lines">@@ -38,5 +38,5 @@
</span><span class="cx">     boolean checkValidity();
</span><span class="cx">     void setCustomValidity(DOMString? error);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLProgressElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLProgressElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLProgressElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLProgressElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -18,9 +18,9 @@
</span><span class="cx">  */
</span><span class="cx"> 
</span><span class="cx"> interface HTMLProgressElement : HTMLElement {
</span><del>-    [SetterMayThrowLegacyException] attribute unrestricted double value;
-    [SetterMayThrowLegacyException] attribute unrestricted double max;
-    readonly attribute  unrestricted double position;
-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    [SetterMayThrowLegacyException] attribute  unrestricted double value;
+    [SetterMayThrowLegacyException] attribute  unrestricted double max;
+    readonly attribute  unrestricted double                position;
+    readonly attribute  NodeList              labels;
</ins><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLSelectElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLSelectElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLSelectElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLSelectElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> 
</span><span class="cx">     readonly attribute DOMString type;
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute HTMLOptionsCollection options;
</del><ins>+    readonly attribute HTMLOptionsCollection options;
</ins><span class="cx">     [SetterMayThrowLegacyException] attribute unsigned long length;
</span><span class="cx"> 
</span><span class="cx">     getter HTMLOptionElement? item(unsigned long index);
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx">     void remove(HTMLOptionElement option);
</span><span class="cx">     [ImplementedAs=removeByIndex] void remove(long index);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute HTMLCollection selectedOptions;
</del><ins>+    readonly attribute HTMLCollection selectedOptions;
</ins><span class="cx">     attribute long selectedIndex;
</span><span class="cx"> 
</span><span class="cx">     attribute DOMString value;
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx">     boolean checkValidity();
</span><span class="cx">     void setCustomValidity(DOMString? error); // FIXME: Argument should not be nullable.
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> 
</span><span class="cx">     attribute DOMString autocomplete;
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLTableElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -23,8 +23,8 @@
</span><span class="cx">     [SetterMayThrowLegacyException] attribute HTMLTableSectionElement? tHead;
</span><span class="cx">     [SetterMayThrowLegacyException] attribute HTMLTableSectionElement? tFoot;
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute HTMLCollection rows;
-    [SameObject] readonly attribute HTMLCollection tBodies;
</del><ins>+    readonly attribute HTMLCollection rows;
+    readonly attribute HTMLCollection tBodies;
</ins><span class="cx">     [Reflect] attribute DOMString align;
</span><span class="cx">     [Reflect, TreatNullAs=EmptyString] attribute DOMString bgColor;
</span><span class="cx">     [Reflect] attribute DOMString border;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableRowElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableRowElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableRowElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLTableRowElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -21,7 +21,7 @@
</span><span class="cx"> interface HTMLTableRowElement : HTMLElement {
</span><span class="cx">     readonly attribute long rowIndex;
</span><span class="cx">     readonly attribute long sectionRowIndex;
</span><del>-    [SameObject] readonly attribute HTMLCollection cells;
</del><ins>+    readonly attribute HTMLCollection cells;
</ins><span class="cx">     [Reflect] attribute DOMString align;
</span><span class="cx">     [Reflect, TreatNullAs=EmptyString] attribute DOMString bgColor;
</span><span class="cx">     [Reflect=char] attribute DOMString ch;
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTableSectionElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTableSectionElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTableSectionElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLTableSectionElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -25,7 +25,7 @@
</span><span class="cx">     [Reflect=char] attribute DOMString ch;
</span><span class="cx">     [Reflect=charoff] attribute DOMString chOff;
</span><span class="cx">     [Reflect] attribute DOMString vAlign;
</span><del>-    [SameObject] readonly attribute HTMLCollection rows;
</del><ins>+    readonly attribute HTMLCollection rows;
</ins><span class="cx">     [MayThrowLegacyException] HTMLElement insertRow(optional long index = -1);
</span><span class="cx">     [MayThrowLegacyException] void deleteRow(long index);
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlHTMLTextAreaElementidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLTextAreaElement.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/HTMLTextAreaElement.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/html/HTMLTextAreaElement.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx">     boolean checkValidity();
</span><span class="cx">     void setCustomValidity(DOMString? error);
</span><span class="cx"> 
</span><del>-    [SameObject] readonly attribute NodeList labels;
</del><ins>+    readonly attribute NodeList labels;
</ins><span class="cx"> 
</span><span class="cx">     void select();
</span><span class="cx">     attribute long selectionStart;
</span></span></pre></div>
<a id="trunkSourceWebCorepageLocationidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/Location.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/Location.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/page/Location.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -58,5 +58,6 @@
</span><span class="cx"> 
</span><span class="cx">     readonly attribute USVString origin;
</span><span class="cx"> 
</span><del>-    [Unforgeable, SameObject] readonly attribute FrozenArray&lt;USVString&gt; ancestorOrigins;
</del><ins>+    // FIXME: Add support for SameObject
+    [Unforgeable, CachedAttribute] readonly attribute FrozenArray&lt;USVString&gt; ancestorOrigins;
</ins><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceWebCorepageNavigatoridl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/Navigator.idl (207354 => 207355)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/Navigator.idl        2016-10-14 22:10:54 UTC (rev 207354)
+++ trunk/Source/WebCore/page/Navigator.idl        2016-10-14 22:16:34 UTC (rev 207355)
</span><span class="lines">@@ -20,8 +20,8 @@
</span><span class="cx"> [
</span><span class="cx">     GenerateIsReachable=ImplFrame,
</span><span class="cx"> ] interface Navigator {
</span><del>-    [SameObject] readonly attribute DOMPluginArray plugins;
-    [SameObject] readonly attribute DOMMimeTypeArray mimeTypes;
</del><ins>+    readonly attribute DOMPluginArray plugins;
+    readonly attribute DOMMimeTypeArray mimeTypes;
</ins><span class="cx">     [Nondeterministic] readonly attribute boolean cookieEnabled;
</span><span class="cx">     [Nondeterministic] boolean javaEnabled();
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>