[JSC] REGRESSION(r135093): A form control with name=length overrides length property...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 10 Jan 2013 03:55:33 +0000 (03:55 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 10 Jan 2013 03:55:33 +0000 (03:55 +0000)
commit1b790b7775c4fcba91a9ae0d52c5e8f929b8a598
tree4fe8309b0f643601c235e58744ac598ff903aa13
parente73b6d8538c025a29ab4ca380992da4b8398cef0
[JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
https://bugs.webkit.org/show_bug.cgi?id=105775

Reviewed by Sam Weinig.

Source/WebCore:

Fixed the bug by respecting properties on ancestor classes.

Test: fast/dom/collection-length-should-not-be-overridden.html

* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching): Added.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
hierarchy.

LayoutTests:

Added a regression tests for all known HTMLCollection sublcasses except HTMLNameCollection,
which is used only to implement named getters on window and document objects and HTMLPropertiesCollection
since it's not enabled on all ports yet.

* fast/dom/collection-length-should-not-be-overridden-expected.txt: Added.
* fast/dom/collection-length-should-not-be-overridden.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@139278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/collection-length-should-not-be-overridden-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/collection-length-should-not-be-overridden.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/bindings/js/JSDOMBinding.h
Source/WebCore/bindings/scripts/CodeGeneratorJS.pm