diff options
| author | Ryosuke Niwa <rniwa@webkit.org> | 2013-02-12 10:26:19 +0100 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-02-12 12:34:00 +0100 |
| commit | 11a7cbc1a9dc5df9a63e0102c589a6f05d4a39fa (patch) | |
| tree | ffda9c89b6b1e86e56ef82ee8cfec1591f67cc5a /Source/JavaScriptCore/runtime/StringRecursionChecker.cpp | |
| parent | 4bebf46b5ae9868a5925f09a3e259adc77041ae1 (diff) | |
| download | qtwebkit-11a7cbc1a9dc5df9a63e0102c589a6f05d4a39fa.tar.gz | |
[JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
https://bugs.webkit.org/show_bug.cgi?id=105775
Reviewed by Sam Weinig.
Source/WebCore:
Fixed the bug by respecting properties on ancestor classes.
Test: fast/dom/collection-length-should-not-be-overridden.html
* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching): Added.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
hierarchy.
Change-Id: Ib7520fc576d355978f56371e38b616633b2d1143
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139278 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/runtime/StringRecursionChecker.cpp')
0 files changed, 0 insertions, 0 deletions