[JSC] REGRESSION(r135093): A form control with name=length overrides length property...
authorRyosuke Niwa <rniwa@webkit.org>
Tue, 12 Feb 2013 09:26:19 +0000 (10:26 +0100)
committerThe Qt Project <gerrit-noreply@qt-project.org>
Tue, 12 Feb 2013 11:34:00 +0000 (12:34 +0100)
commit11a7cbc1a9dc5df9a63e0102c589a6f05d4a39fa
treeffda9c89b6b1e86e56ef82ee8cfec1591f67cc5a
parent4bebf46b5ae9868a5925f09a3e259adc77041ae1
[JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements

https://bugs.webkit.org/show_bug.cgi?id=105775

Reviewed by Sam Weinig.

Source/WebCore:

Fixed the bug by respecting properties on ancestor classes.

Test: fast/dom/collection-length-should-not-be-overridden.html

* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching): Added.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
hierarchy.

Change-Id: Ib7520fc576d355978f56371e38b616633b2d1143
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Source/WebCore/ChangeLog
Source/WebCore/bindings/js/JSDOMBinding.h
Source/WebCore/bindings/scripts/CodeGeneratorJS.pm