Attachment #261281 for bug #149147

View Details Raw Unified Return to Bug 149147

| Differences between



2015-09-15  Chris Dumez  <cdumez@apple.com>

        Add initial support for [Unforgeable] IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=149147

        Reviewed by NOBODY (OOPS!).

        Add initial support for [Unforgeable] IDL extended attribute:
        https://heycam.github.io/webidl/#Unforgeable

        In particular, attributes marked as unforgeable are now:
        - on the instance rather than the prototype
        - non-configurable. WebKit does not match the Web IDL specification
          and most properties are currently non-configurable already. However,
          I added an extra check for [Unforgeable] so that unforgeable
          attributes stay unconfigurable if we later decide to match the spec
          and mark properties as configurable.

        Operation marked as unforgeable are now non-configurable. However, this
        patch does not move them from the prototype to the instance yet. This
        needs to be addressed in a follow-up patch as this is a larger change.

        This patch also drops support for the undocumented
        [OperationsNotDeletable] IDL extended attribute. It is no longer needed
        now that we support [Unforgeable] and still support [NotDeletable] for
        operations.

        Test: fast/dom/unforgeable-attributes.html

        * Modules/plugins/QuickTimePluginReplacement.idl:
        Drop [OperationsNotDeletable] on the interface and mark the only
        operation on this interface as [NotDeletable]. There is no behavior
        change but this allows us to drop support for a non-standard and
        undocumented IDL extended attribute.

        * bindings/scripts/CodeGeneratorJS.pm:
        (AttributeShouldBeOnInstance):
        (GenerateAttributesHashTable):
        (GenerateImplementation):
        Add initial support for [Unforgeable] IDL extended attribute.

        * bindings/scripts/IDLAttributes.txt:
        Add [Unforgeable]. Drop [OperationsNotDeletable].

        * crypto/CryptoKeyPair.idl:
        Drop [OperationsNotDeletable] on the interface as this interface has
        no operations.

        * dom/Document.idl:
        * page/DOMWindow.idl:
        * page/Location.idl:
        Mark attributes / interfaces as [Unforgeable] as per the latest HTML
        specification:
        https://html.spec.whatwg.org/multipage/dom.html#document
        https://html.spec.whatwg.org/multipage/browsers.html#window
        https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface

2015-09-15  Benjamin Poulain  <bpoulain@apple.com>

        Style invalidation affecting siblings does not work with inline-style changes




[
    NoInterfaceObject,
    OperationsNotDeletable,
    JSGenerateToJSObject,
] interface QuickTimePluginReplacement {
    readonly attribute unsigned long long movieSize;
    [CustomGetter] readonly attribute any timedMetaData;
    [CustomGetter] readonly attribute any accessLog;
    [CustomGetter] readonly attribute any errorLog;
    [NotDeletable] void postEvent(DOMString eventName);
};

Lines 673-678 sub AttributeShouldBeOnInstance a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm_sec1
- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm -5 / +15 lines
673	return 1 if HasCustomGetter($attribute->signature->extendedAttributes);	673	return 1 if HasCustomGetter($attribute->signature->extendedAttributes);
674	return 1 if HasCustomSetter($attribute->signature->extendedAttributes);	674	return 1 if HasCustomSetter($attribute->signature->extendedAttributes);
675		675
		676	# [Unforgeable] attributes should be on the instance.
		677	# https://heycam.github.io/webidl/#Unforgeable
		678	return 1 if $attribute->signature->extendedAttributes->{"Unforgeable"} \|\| $interface->extendedAttributes->{"Unforgeable"};
		679
676	# FIXME: Length is a tricky attribute to handle correctly as it is frequently tied to	680	# FIXME: Length is a tricky attribute to handle correctly as it is frequently tied to
677	# objects which also have magic named attributes that can end up being named "length"	681	# objects which also have magic named attributes that can end up being named "length"
678	# and so interfere with lookup ordering. I'm not sure what the correct solution is	682	# and so interfere with lookup ordering. I'm not sure what the correct solution is
Lines 1335-1341 sub GenerateAttributesHashTable a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm_sec2
1335	# As per Web IDL specification, constructor properties on the ECMAScript global object should be	1339	# As per Web IDL specification, constructor properties on the ECMAScript global object should be
1336	# configurable and should not be enumerable.	1340	# configurable and should not be enumerable.
1337	my $is_global_constructor = $attribute->signature->type =~ /Constructor$/;	1341	my $is_global_constructor = $attribute->signature->type =~ /Constructor$/;
1338	push(@specials, "DontDelete") unless ($attribute->signature->extendedAttributes->{"Deletable"} \|\| $is_global_constructor);	1342
		1343	# FIXME: Attributes should be configurable unless [Unforgeable] is specified.
		1344	# https://heycam.github.io/webidl/#es-attributes
		1345	push(@specials, "DontDelete") if (!$attribute->signature->extendedAttributes->{"Deletable"} && !$is_global_constructor)
		1346	\|\| $attribute->signature->extendedAttributes->{"Unforgeable"}
		1347	\|\| $interface->extendedAttributes->{"Unforgeable"};
		1348
1339	push(@specials, "DontEnum") if ($attribute->signature->extendedAttributes->{"NotEnumerable"} \|\| $is_global_constructor);	1349	push(@specials, "DontEnum") if ($attribute->signature->extendedAttributes->{"NotEnumerable"} \|\| $is_global_constructor);
1340	push(@specials, "ReadOnly") if IsReadonly($attribute);	1350	push(@specials, "ReadOnly") if IsReadonly($attribute);
1341	push(@specials, "CustomAccessor") unless $is_global_constructor;	1351	push(@specials, "CustomAccessor") unless $is_global_constructor;
Lines 1911-1918 sub GenerateImplementation a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm_sec3
1911	push(@hashValue2, $functionLength);	1921	push(@hashValue2, $functionLength);
1912		1922
1913	my @specials = ();	1923	my @specials = ();
1914	push(@specials, "DontDelete") if $interface->extendedAttributes->{"OperationsNotDeletable"}	1924	push(@specials, "DontDelete") if $function->signature->extendedAttributes->{"NotDeletable"};
1915	\|\| $function->signature->extendedAttributes->{"NotDeletable"};
1916	push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"NotEnumerable"};	1925	push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"NotEnumerable"};
1917	push(@specials, "JSC::Function");	1926	push(@specials, "JSC::Function");
1918	my $special = (@specials > 0) ? join(" \| ", @specials) : "0";	1927	my $special = (@specials > 0) ? join(" \| ", @specials) : "0";
Lines 1988-1995 sub GenerateImplementation a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm_sec4
1988	push(@hashValue2, $functionLength);	1997	push(@hashValue2, $functionLength);
1989		1998
1990	my @specials = ();	1999	my @specials = ();
1991	push(@specials, "DontDelete") if $interface->extendedAttributes->{"OperationsNotDeletable"}	2000	push(@specials, "DontDelete") if $function->signature->extendedAttributes->{"NotDeletable"}
1992	\|\| $function->signature->extendedAttributes->{"NotDeletable"};	2001	\|\| $function->signature->extendedAttributes->{"Unforgeable"}
		2002	\|\| $interface->extendedAttributes->{"Unforgeable"};
1993	push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"NotEnumerable"};	2003	push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"NotEnumerable"};
1994	push(@specials, "JSC::Function");	2004	push(@specials, "JSC::Function");
1995	my $special = (@specials > 0) ? join(" \| ", @specials) : "0";	2005	my $special = (@specials > 0) ? join(" \| ", @specials) : "0";



ObjCPolymorphic
ObjCProtocol
ObjCUseDefaultView
OperationsNotDeletable
OverrideBuiltins
PassContext
RaisesException

TreatUndefinedAs=NullString
TypedArray=*
URL
Unforgeable
WindowEventHandler

# PLATFORM(IOS)



    ImplementationLacksVTable,
    InterfaceName=KeyPair,
    JSCustomMarkFunction,
    NoInterfaceObject
    OperationsNotDeletable
] interface CryptoKeyPair {
    readonly attribute CryptoKey publicKey;
    readonly attribute CryptoKey privateKey;

Lines 170-176 a/Source/WebCore/dom/Document.idl_sec1
- a/Source/WebCore/dom/Document.idl -1 / +1 lines
170	NodeList getElementsByName([Default=Undefined,AtomicString] optional DOMString elementName);	170	NodeList getElementsByName([Default=Undefined,AtomicString] optional DOMString elementName);
171		171
172	#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT	172	#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
173	[Custom] attribute Location location;	173	[Custom, Unforgeable] attribute Location location;
174	#endif	174	#endif
175		175
176	// IE extensions	176	// IE extensions



    [Replaceable] readonly attribute Navigator navigator;
    [Replaceable] readonly attribute Navigator clientInformation;
    readonly attribute Crypto crypto;
    [DoNotCheckSecurity, CustomSetter, Unforgeable] attribute Location location;
    [Replaceable, CustomGetter] readonly attribute Event event;

    DOMSelection getSelection();


    // Self referential attributes
    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow self;
    [DoNotCheckSecurity, Unforgeable] readonly attribute DOMWindow window;
    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute  DOMWindow frames;

    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow opener;
    [Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow parent;
    [DoNotCheckSecurityOnGetter, Unforgeable] readonly attribute DOMWindow top;

    // DOM Level 2 AbstractView Interface
    [Unforgeable] readonly attribute Document document;

    // CSSOM View Module
    MediaQueryList matchMedia(DOMString query);

Lines 35-41 a/Source/WebCore/page/Location.idl_sec1
- a/Source/WebCore/page/Location.idl -1 / +1 lines
35	JSCustomDefineOwnProperty,	35	JSCustomDefineOwnProperty,
36	JSCustomNamedGetterOnPrototype,	36	JSCustomNamedGetterOnPrototype,
37	JSCustomDefineOwnPropertyOnPrototype,	37	JSCustomDefineOwnPropertyOnPrototype,
38	OperationsNotDeletable	38	Unforgeable
39	] interface Location {	39	] interface Location {
40	[DoNotCheckSecurityOnSetter, CustomSetter] attribute DOMString href;	40	[DoNotCheckSecurityOnSetter, CustomSetter] attribute DOMString href;
41		41



2015-09-15  Chris Dumez  <cdumez@apple.com>

        Add initial support for [Unforgeable] IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=149147

        Reviewed by NOBODY (OOPS!).

        New test that verifies that well-known [Unforgeable] attributes
        are on the instance rather than the prototype and that they are
        non-configurable.

        * fast/dom/unforgeable-attributes-expected.txt: Added.
        * fast/dom/unforgeable-attributes.html: Added.

2015-09-15  Jinyoung Hur  <hur.ims@navercorp.com>

        [WebGL] Only require that the stencil value and write masks have as many bits set as the stencil buffer is deep



Checks that [Unforgeable] attributes are non-configurable and on the instance rather than the prototype.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


Event.isTrusted
FAIL Unsupported property.

Document.location
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Window.window
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change value of a readonly property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Window.document
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change value of a readonly property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Window.location
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Window.top
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.ancestorOrigins
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.href
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.origin
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.protocol
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.username
FAIL Unsupported property.

Location.password
FAIL Unsupported property.

Location.host
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.hostname
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.port
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.pathname
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.search
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false

Location.hash
PASS testObject.hasOwnProperty(testPropertyName) is true
PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
PASS successfullyParsed is true

TEST COMPLETE




<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test-pre.js"></script>
<script>
description("Checks that [Unforgeable] attributes are non-configurable and on the instance rather than the prototype.");

function testProperty(object, propertyName)
{
    testObject = object;
    testPropertyName = propertyName;

    if (testObject[propertyName] === undefined) {
        testFailed("Unsupported property.");
        return;
    }

    shouldBeTrue("testObject.hasOwnProperty(testPropertyName)");
    shouldBeFalse("testObject.__proto__.hasOwnProperty(testPropertyName)");
    shouldThrow("Object.defineProperty(testObject, testPropertyName, { value: 'test' })");
    shouldBeFalse("Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable");
}

// DOM specification.
debug("Event.isTrusted");
var event = new Event("test");
testProperty(event, "isTrusted");

// HTML specification.
debug("");
debug("Document.location");
testProperty(document, "location");

for (var property of ["window", "document", "location", "top"]) {
    debug("");
    debug("Window." + property);
    testProperty(window, property);
}

for (var property of ["ancestorOrigins", "href", "origin", "protocol", "username", "password", "host", "hostname", "port", "pathname", "search", "hash"]) {
    debug("");
    debug("Location." + property);
    testProperty(window.location, property);
}

</script>
<script src="../../resources/js-test-post.js"></script>
</body>
</html>



CONSOLE MESSAGE: line 75: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
CONSOLE MESSAGE: line 82: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
CONSOLE MESSAGE: line 102: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
CONSOLE MESSAGE: line 109: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
This tests that variable names can't be enumerated cross domain (see http://bugs.webkit.org/show_bug.cgi?id=16387)

Return to Bug 149147

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +57 lines
		1	2015-09-15 Chris Dumez <cdumez@apple.com>
		2
		3	Add initial support for [Unforgeable] IDL extended attribute
		4	https://bugs.webkit.org/show_bug.cgi?id=149147
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	Add initial support for [Unforgeable] IDL extended attribute:
		9	https://heycam.github.io/webidl/#Unforgeable
		10
		11	In particular, attributes marked as unforgeable are now:
		12	- on the instance rather than the prototype
		13	- non-configurable. WebKit does not match the Web IDL specification
		14	and most properties are currently non-configurable already. However,
		15	I added an extra check for [Unforgeable] so that unforgeable
		16	attributes stay unconfigurable if we later decide to match the spec
		17	and mark properties as configurable.
		18
		19	Operation marked as unforgeable are now non-configurable. However, this
		20	patch does not move them from the prototype to the instance yet. This
		21	needs to be addressed in a follow-up patch as this is a larger change.
		22
		23	This patch also drops support for the undocumented
		24	[OperationsNotDeletable] IDL extended attribute. It is no longer needed
		25	now that we support [Unforgeable] and still support [NotDeletable] for
		26	operations.
		27
		28	Test: fast/dom/unforgeable-attributes.html
		29
		30	* Modules/plugins/QuickTimePluginReplacement.idl:
		31	Drop [OperationsNotDeletable] on the interface and mark the only
		32	operation on this interface as [NotDeletable]. There is no behavior
		33	change but this allows us to drop support for a non-standard and
		34	undocumented IDL extended attribute.
		35
		36	* bindings/scripts/CodeGeneratorJS.pm:
		37	(AttributeShouldBeOnInstance):
		38	(GenerateAttributesHashTable):
		39	(GenerateImplementation):
		40	Add initial support for [Unforgeable] IDL extended attribute.
		41
		42	* bindings/scripts/IDLAttributes.txt:
		43	Add [Unforgeable]. Drop [OperationsNotDeletable].
		44
		45	* crypto/CryptoKeyPair.idl:
		46	Drop [OperationsNotDeletable] on the interface as this interface has
		47	no operations.
		48
		49	* dom/Document.idl:
		50	* page/DOMWindow.idl:
		51	* page/Location.idl:
		52	Mark attributes / interfaces as [Unforgeable] as per the latest HTML
		53	specification:
		54	https://html.spec.whatwg.org/multipage/dom.html#document
		55	https://html.spec.whatwg.org/multipage/browsers.html#window
		56	https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface
		57
1	2015-09-15 Benjamin Poulain <bpoulain@apple.com>	58	2015-09-15 Benjamin Poulain <bpoulain@apple.com>
2		59
3	Style invalidation affecting siblings does not work with inline-style changes	60	Style invalidation affecting siblings does not work with inline-style changes

Lines 25-36 a/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.idl_sec1
- a/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.idl -2 / +1 lines
25		25
26	[	26	[
27	NoInterfaceObject,	27	NoInterfaceObject,
28	OperationsNotDeletable,
29	JSGenerateToJSObject,	28	JSGenerateToJSObject,
30	] interface QuickTimePluginReplacement {	29	] interface QuickTimePluginReplacement {
31	readonly attribute unsigned long long movieSize;	30	readonly attribute unsigned long long movieSize;
32	[CustomGetter] readonly attribute any timedMetaData;	31	[CustomGetter] readonly attribute any timedMetaData;
33	[CustomGetter] readonly attribute any accessLog;	32	[CustomGetter] readonly attribute any accessLog;
34	[CustomGetter] readonly attribute any errorLog;	33	[CustomGetter] readonly attribute any errorLog;
35	void postEvent(DOMString eventName);	34	[NotDeletable] void postEvent(DOMString eventName);
36	};	35	};

Lines 99-105 ObjCLegacyUnnamedParameters a/Source/WebCore/bindings/scripts/IDLAttributes.txt_sec1
- a/Source/WebCore/bindings/scripts/IDLAttributes.txt -1 / +1 lines
99	ObjCPolymorphic	99	ObjCPolymorphic
100	ObjCProtocol	100	ObjCProtocol
101	ObjCUseDefaultView	101	ObjCUseDefaultView
102	OperationsNotDeletable
103	OverrideBuiltins	102	OverrideBuiltins
104	PassContext	103	PassContext
105	RaisesException	104	RaisesException
Lines 119-124 TreatReturnedNullStringAs=Null\|Undefined a/Source/WebCore/bindings/scripts/IDLAttributes.txt_sec2
119	TreatUndefinedAs=NullString	118	TreatUndefinedAs=NullString
120	TypedArray=*	119	TypedArray=*
121	URL	120	URL
		121	Unforgeable
122	WindowEventHandler	122	WindowEventHandler
123		123
124	# PLATFORM(IOS)	124	# PLATFORM(IOS)

Lines 28-35 a/Source/WebCore/crypto/CryptoKeyPair.idl_sec1
- a/Source/WebCore/crypto/CryptoKeyPair.idl -2 / +1 lines
28	ImplementationLacksVTable,	28	ImplementationLacksVTable,
29	InterfaceName=KeyPair,	29	InterfaceName=KeyPair,
30	JSCustomMarkFunction,	30	JSCustomMarkFunction,
31	NoInterfaceObject,	31	NoInterfaceObject
32	OperationsNotDeletable
33	] interface CryptoKeyPair {	32	] interface CryptoKeyPair {
34	readonly attribute CryptoKey publicKey;	33	readonly attribute CryptoKey publicKey;
35	readonly attribute CryptoKey privateKey;	34	readonly attribute CryptoKey privateKey;

Lines 52-58 a/Source/WebCore/page/DOMWindow.idl_sec1
- a/Source/WebCore/page/DOMWindow.idl -4 / +4 lines
52	[Replaceable] readonly attribute Navigator navigator;	52	[Replaceable] readonly attribute Navigator navigator;
53	[Replaceable] readonly attribute Navigator clientInformation;	53	[Replaceable] readonly attribute Navigator clientInformation;
54	readonly attribute Crypto crypto;	54	readonly attribute Crypto crypto;
55	[DoNotCheckSecurity, CustomSetter] attribute Location location;	55	[DoNotCheckSecurity, CustomSetter, Unforgeable] attribute Location location;
56	[Replaceable, CustomGetter] readonly attribute Event event;	56	[Replaceable, CustomGetter] readonly attribute Event event;
57		57
58	DOMSelection getSelection();	58	DOMSelection getSelection();
Lines 125-139 a/Source/WebCore/page/DOMWindow.idl_sec2
125		125
126	// Self referential attributes	126	// Self referential attributes
127	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow self;	127	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow self;
128	[DoNotCheckSecurity] readonly attribute DOMWindow window;	128	[DoNotCheckSecurity, Unforgeable] readonly attribute DOMWindow window;
129	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow frames;	129	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow frames;
130		130
131	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow opener;	131	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow opener;
132	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow parent;	132	[Replaceable, DoNotCheckSecurityOnGetter] readonly attribute DOMWindow parent;
133	[DoNotCheckSecurityOnGetter] readonly attribute DOMWindow top;	133	[DoNotCheckSecurityOnGetter, Unforgeable] readonly attribute DOMWindow top;
134		134
135	// DOM Level 2 AbstractView Interface	135	// DOM Level 2 AbstractView Interface
136	readonly attribute Document document;	136	[Unforgeable] readonly attribute Document document;
137		137
138	// CSSOM View Module	138	// CSSOM View Module
139	MediaQueryList matchMedia(DOMString query);	139	MediaQueryList matchMedia(DOMString query);

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +14 lines
		1	2015-09-15 Chris Dumez <cdumez@apple.com>
		2
		3	Add initial support for [Unforgeable] IDL extended attribute
		4	https://bugs.webkit.org/show_bug.cgi?id=149147
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	New test that verifies that well-known [Unforgeable] attributes
		9	are on the instance rather than the prototype and that they are
		10	non-configurable.
		11
		12	* fast/dom/unforgeable-attributes-expected.txt: Added.
		13	* fast/dom/unforgeable-attributes.html: Added.
		14
1	2015-09-15 Jinyoung Hur <hur.ims@navercorp.com>	15	2015-09-15 Jinyoung Hur <hur.ims@navercorp.com>
2		16
3	[WebGL] Only require that the stencil value and write masks have as many bits set as the stencil buffer is deep	17	[WebGL] Only require that the stencil value and write masks have as many bits set as the stencil buffer is deep

Line 0 a/LayoutTests/fast/dom/unforgeable-attributes-expected.txt_sec1
- a/LayoutTests/fast/dom/unforgeable-attributes-expected.txt +107 lines
		1	Checks that [Unforgeable] attributes are non-configurable and on the instance rather than the prototype.
		2
		3	On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
		4
		5
		6	Event.isTrusted
		7	FAIL Unsupported property.
		8
		9	Document.location
		10	PASS testObject.hasOwnProperty(testPropertyName) is true
		11	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		12	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		13	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		14
		15	Window.window
		16	PASS testObject.hasOwnProperty(testPropertyName) is true
		17	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		18	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change value of a readonly property..
		19	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		20
		21	Window.document
		22	PASS testObject.hasOwnProperty(testPropertyName) is true
		23	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		24	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change value of a readonly property..
		25	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		26
		27	Window.location
		28	PASS testObject.hasOwnProperty(testPropertyName) is true
		29	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		30	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		31	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		32
		33	Window.top
		34	PASS testObject.hasOwnProperty(testPropertyName) is true
		35	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		36	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		37	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		38
		39	Location.ancestorOrigins
		40	PASS testObject.hasOwnProperty(testPropertyName) is true
		41	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		42	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		43	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		44
		45	Location.href
		46	PASS testObject.hasOwnProperty(testPropertyName) is true
		47	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		48	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		49	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		50
		51	Location.origin
		52	PASS testObject.hasOwnProperty(testPropertyName) is true
		53	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		54	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		55	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		56
		57	Location.protocol
		58	PASS testObject.hasOwnProperty(testPropertyName) is true
		59	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
		60	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
		61	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
		62
		63	Location.username
		64	FAIL Unsupported property.
65
66	Location.password
67	FAIL Unsupported property.
68
69	Location.host
70	PASS testObject.hasOwnProperty(testPropertyName) is true
71	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
72	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
73	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
74
75	Location.hostname
76	PASS testObject.hasOwnProperty(testPropertyName) is true
77	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
78	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
79	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
80
81	Location.port
82	PASS testObject.hasOwnProperty(testPropertyName) is true
83	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
84	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
85	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
86
87	Location.pathname
88	PASS testObject.hasOwnProperty(testPropertyName) is true
89	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
90	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
91	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
92
93	Location.search
94	PASS testObject.hasOwnProperty(testPropertyName) is true
95	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
96	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
97	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
98
99	Location.hash
100	PASS testObject.hasOwnProperty(testPropertyName) is true
101	PASS testObject.__proto__.hasOwnProperty(testPropertyName) is false
102	PASS Object.defineProperty(testObject, testPropertyName, { value: 'test' }) threw exception TypeError: Attempting to change access mechanism for an unconfigurable property..
103	PASS Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable is false
104	PASS successfullyParsed is true
105
106	TEST COMPLETE
107

Line 0 a/LayoutTests/fast/dom/unforgeable-attributes.html_sec1
- a/LayoutTests/fast/dom/unforgeable-attributes.html +49 lines
	1	<!DOCTYPE html>
	2	<html>
	3	<body>
	4	<script src="../../resources/js-test-pre.js"></script>
	5	<script>
	6	description("Checks that [Unforgeable] attributes are non-configurable and on the instance rather than the prototype.");
	7
	8	function testProperty(object, propertyName)
	9	{
	10	testObject = object;
	11	testPropertyName = propertyName;
	12
	13	if (testObject[propertyName] === undefined) {
	14	testFailed("Unsupported property.");
	15	return;
	16	}
	17
	18	shouldBeTrue("testObject.hasOwnProperty(testPropertyName)");
	19	shouldBeFalse("testObject.__proto__.hasOwnProperty(testPropertyName)");
	20	shouldThrow("Object.defineProperty(testObject, testPropertyName, { value: 'test' })");
	21	shouldBeFalse("Object.getOwnPropertyDescriptor(testObject, testPropertyName).configurable");
	22	}
	23
	24	// DOM specification.
	25	debug("Event.isTrusted");
	26	var event = new Event("test");
	27	testProperty(event, "isTrusted");
	28
	29	// HTML specification.
	30	debug("");
	31	debug("Document.location");
	32	testProperty(document, "location");
	33
	34	for (var property of ["window", "document", "location", "top"]) {
	35	debug("");
	36	debug("Window." + property);
	37	testProperty(window, property);
	38	}
	39
	40	for (var property of ["ancestorOrigins", "href", "origin", "protocol", "username", "password", "host", "hostname", "port", "pathname", "search", "hash"]) {
	41	debug("");
	42	debug("Location." + property);
	43	testProperty(window.location, property);
	44	}
	45
	46	</script>
	47	<script src="../../resources/js-test-post.js"></script>
	48	</body>
	49	</html>

Lines 8-15 CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" fr a/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt_sec1
- a/LayoutTests/http/tests/security/cross-frame-access-enumeration-expected.txt -2 lines
8	CONSOLE MESSAGE: line 75: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.	8	CONSOLE MESSAGE: line 75: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
9	CONSOLE MESSAGE: line 82: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.	9	CONSOLE MESSAGE: line 82: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
10	CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.	10	CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
11	CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
12	CONSOLE MESSAGE: line 29: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
13	CONSOLE MESSAGE: line 102: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.	11	CONSOLE MESSAGE: line 102: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
14	CONSOLE MESSAGE: line 109: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.	12	CONSOLE MESSAGE: line 109: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
15	This tests that variable names can't be enumerated cross domain (see http://bugs.webkit.org/show_bug.cgi?id=16387)	13	This tests that variable names can't be enumerated cross domain (see http://bugs.webkit.org/show_bug.cgi?id=16387)