Changeset 100247 in webkit

Timestamp:

Nov 15, 2011, 12:36:56 AM (15 years ago)

Author:

tkent@chromium.org

Message:

[V8] Fix incorrect handling of JavaScript properties in DOMStringMap
​https://bugs.webkit.org/show_bug.cgi?id=53578

Reviewed by Adam Barth.

Source/WebCore:

Follows a JSC behavior change by r96893.

• bindings/v8/custom/V8DOMStringMapCustom.cpp:

(WebCore::V8DOMStringMap::namedPropertyGetter):
Propagate to the JavaScript object if the DOMStringMap object
doesn't have the requested item.
(WebCore::V8DOMStringMap::namedPropertyDeleter): ditto.
(WebCore::V8DOMStringMap::namedPropertySetter):
Try to set a property to only a DOMStringMap object.

LayoutTests:

• platform/chromium/test_expectations.txt:

Remove failure expectations of fast/dom/dataset.html and
fast/dom/dataset-xhtml.xhtml.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/chromium/test_expectations.txt (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-11-15  Kent Tamura  <tkent@chromium.org>
+
+        [V8] Fix incorrect handling of JavaScript properties in DOMStringMap
+        https://bugs.webkit.org/show_bug.cgi?id=53578
+
+        Reviewed by Adam Barth.
+
+        * platform/chromium/test_expectations.txt:
+        Remove failure expectations of fast/dom/dataset.html and
+        fast/dom/dataset-xhtml.xhtml.
+
 2011-11-14  Pavel Feldman  <pfeldman@google.com>
 

trunk/LayoutTests/platform/chromium/test_expectations.txt

@@ -3674 +3674 @@
 BUGWK68982 : svg/custom/transformed-pattern-clamp-svg-root.svg = IMAGE PASS
 
-// Need to follow a JSC binding change. See webkit.org/b/53752.
-BUGWK53578 : fast/dom/dataset.html = TEXT
-BUGWK53578 : fast/dom/dataset-xhtml.xhtml = TEXT
-
 BUGWK69060 WIN LINUX : fast/repaint/selection-clear.html = IMAGE+TEXT
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-11-15  Kent Tamura  <tkent@chromium.org>
+
+        [V8] Fix incorrect handling of JavaScript properties in DOMStringMap
+        https://bugs.webkit.org/show_bug.cgi?id=53578
+
+        Reviewed by Adam Barth.
+
+        Follows a JSC behavior change by r96893.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertyGetter):
+        Propagate to the JavaScript object if the DOMStringMap object
+        doesn't have the requested item.
+        (WebCore::V8DOMStringMap::namedPropertyDeleter): ditto.
+        (WebCore::V8DOMStringMap::namedPropertySetter):
+        Try to set a property to only a DOMStringMap object.
+
 2011-11-14  Pavel Feldman  <pfeldman@google.com>
 

trunk/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp

@@ -50 +50 @@
 {
     INC_STATS("DOM.DOMStringMap.NamedPropertyGetter");
-    return v8StringOrUndefined(V8DOMStringMap::toNative(info.Holder())->item(toWebCoreString(name)));
+    String value = V8DOMStringMap::toNative(info.Holder())->item(toWebCoreString(name));
+    if (value.isNull())
+        return notHandledByInterceptor();
+    return v8StringOrUndefined(value);
 }
 
@@ -67 +70 @@
 {
     INC_STATS("DOM.DOMStringMap.NamedPropertyDeleter");
-
-    if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return v8::False();
-    if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return v8::False();
-
     ExceptionCode ec = 0;
     V8DOMStringMap::toNative(info.Holder())->deleteItem(toWebCoreString(name), ec);
-    if (ec)
-        throwError(ec);
-    return v8::True();
+    return ec ? v8::False() : v8::True();
 }
 
@@ -83 +78 @@
 {
     INC_STATS("DOM.DOMStringMap.NamedPropertySetter");
-
-    if (!info.Holder()->GetRealNamedPropertyInPrototypeChain(name).IsEmpty())
-        return value;
-    if (info.Holder()->HasRealNamedCallbackProperty(name))
-        return value;
-
     ExceptionCode ec = 0;
     V8DOMStringMap::toNative(info.Holder())->setItem(toWebCoreString(name), toWebCoreString(value), ec);