[JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements

https://bugs.webkit.org/show_bug.cgi?id=105775

Reviewed by Sam Weinig.

Source/WebCore:

Fixed the bug by respecting properties on ancestor classes.

Test: fast/dom/collection-length-should-not-be-overridden.html

* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching): Added.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
hierarchy.

Change-Id: Ib7520fc576d355978f56371e38b616633b2d1143
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

3 files changed, 39 insertions, 1 deletions

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 3f5a0a762..b30aba2ab 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -238,6 +238,23 @@
         * page/FrameView.cpp:
         (WebCore::FrameView::parentFrameView): Checks if the FrameView has been removed from the parent.
 
+2013-01-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        [JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
+        https://bugs.webkit.org/show_bug.cgi?id=105775
+
+        Reviewed by Sam Weinig.
+
+        Fixed the bug by respecting properties on ancestor classes.
+
+        Test: fast/dom/collection-length-should-not-be-overridden.html
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getStaticValueSlotEntryWithoutCaching): Added.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
+        hierarchy.
+
 2012-12-12  Allan Sandfeld Jensen  <allan.jensen@digia.com>
 
         [Qt] Animation fails on large layers
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index a21959bcb..b83691ce8 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -46,6 +46,12 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
+namespace JSC {
+
+class HashEntry;
+
+}
+
 namespace WebCore {
 
 class DOMStringList;
@@ -491,6 +497,21 @@ enum ParameterDefaultPolicy {
         return AtomicString(propertyName.publicName());
     }
 
+    template <class ThisImp>
+    inline const JSC::HashEntry* getStaticValueSlotEntryWithoutCaching(JSC::ExecState* exec, JSC::PropertyName propertyName)
+    {
+        const JSC::HashEntry* entry = ThisImp::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (!entry) // not found, forward to parent
+            return getStaticValueSlotEntryWithoutCaching<typename ThisImp::Base>(exec, propertyName);
+        return entry;
+    }
+
+    template <>
+    inline const JSC::HashEntry* getStaticValueSlotEntryWithoutCaching<JSDOMWrapper>(JSC::ExecState*, JSC::PropertyName)
+    {
+        return 0;
+    }
+
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 5b4d7acca..0578f46b4 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -401,7 +401,7 @@ sub GenerateGetOwnPropertySlotBody
     my $manualLookupGetterGeneration = sub {
         my $requiresManualLookup = $interface->extendedAttributes->{"IndexedGetter"} || $interface->extendedAttributes->{"NamedGetter"};
         if ($requiresManualLookup) {
-            push(@getOwnPropertySlotImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+            push(@getOwnPropertySlotImpl, "    const ${namespaceMaybe}HashEntry* entry = getStaticValueSlotEntryWithoutCaching<$className>(exec, propertyName);\n");
             push(@getOwnPropertySlotImpl, "    if (entry) {\n");
             push(@getOwnPropertySlotImpl, "        slot.setCustom(thisObject, entry->propertyGetter());\n");
             push(@getOwnPropertySlotImpl, "        return true;\n");