Attachment 255432 Details for Bug 140575 – [Patch] Responded to last review

[patch] [Patch] Responded to last review

0001-Completes-native-binding-descriptors-with-native-get.patch (text/plain), 38.73 KB, created by Matthew Mirman on 2015-06-23 14:31:33 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Matthew Mirman

Created: 2015-06-23 14:31:33 PDT

Size: 38.73 KB

patch

obsolete

>From 9e241822e11495923e757b19fe97a0c10d56c973 Mon Sep 17 00:00:00 2001
>From: Matthew Mirman <mmirman@apple.com>
>Date: Tue, 23 Jun 2015 14:28:17 -0700
>Subject: [PATCH] Completes native binding descriptors with native getters and
> potentially setters. https://bugs.webkit.org/show_bug.cgi?id=140575
> rdar://problem/19506502
>
>Reviewed by NOBODY (OOPS!).
>
>Source/JavaScriptCore:
>
>* CMakeLists.txt:  Added JSBoundSlotBaseFunction.cpp
>* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
>* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
>* JavaScriptCore.xcodeproj/project.pbxproj:
>* inspector/InjectedScriptSource.js: Added case for descriptor having a native getter.
>* inspector/JSInjectedScriptHost.cpp:
>* runtime/JSBoundSlotBaseFunction.cpp: Added.
>(JSC::boundSlotBaseFunctionCall):
>(JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):
>Necessary wrapper for custom getters and setters as objects.
>(JSC::JSBoundSlotBaseFunction::create):
>(JSC::JSBoundSlotBaseFunction::visitChildren):
>(JSC::JSBoundSlotBaseFunction::finishCreation):
>* runtime/JSBoundSlotBaseFunction.h: Added.
>(JSC::JSBoundSlotBaseFunction::createStructure):
>(JSC::JSBoundSlotBaseFunction::boundSlotBase):
>(JSC::JSBoundSlotBaseFunction::customGetterSetter):
>(JSC::JSBoundSlotBaseFunction::isGetter):
>* runtime/JSGlobalObject.cpp:
>(JSC::JSGlobalObject::init): Added a globally initialized structure for JSBoundSlotBaseFunction
>(JSC::JSGlobalObject::visitChildren): visits that structure
>* runtime/JSGlobalObject.h:
>(JSC::JSGlobalObject::boundSlotBaseFunctionStructure): added a getter for that structure
>* runtime/JSObject.cpp:
>(JSC::JSObject::getOwnPropertyDescriptor): extends the case for CustomGetterSetter to
>actually include GetterSetter as a JSBoundSlotBaseFunction
>* runtime/VM.cpp: Added initializer for customGetterSetterFunctionMap
>* runtime/VM.h: Added cache for JSBoundSlotBaseFunction
>
>LayoutTests:
>
>* inspector-protocol/runtime/getProperties-expected.txt: updated.
>* js/dom/native-bindings-descriptors-expected.txt: Added.
>* js/dom/native-bindings-descriptors.html: Added.
>* js/dom/script-tests/native-bindings-descriptors.js: Added.
>
>diff --git LayoutTests/ChangeLog LayoutTests/ChangeLog
>index cef1222..75d6373 100644
>--- LayoutTests/ChangeLog
>+++ LayoutTests/ChangeLog
>@@ -1,15 +1,15 @@
>-2015-06-23  Myles C. Maxfield  <mmaxfield@apple.com>
>+2015-06-23  Matthew Mirman  <mmirman@apple.com>
> 
>-        Unreviewed test gardening after r185842
>-        https://bugs.webkit.org/show_bug.cgi?id=145681
>-        <rdar://problem/21169844>
>+        Completes native binding descriptors with native getters and potentially setters.
>+        https://bugs.webkit.org/show_bug.cgi?id=140575
>+        rdar://problem/19506502
>+
>+        Reviewed by NOBODY (OOPS!).
> 
>-        * platform/mac-yosemite/fast/text/arabic-times-new-roman-expected.png: Copied from LayoutTests/platform/mac/fast/text/arabic-times-new-roman-expected.png.
>-        * platform/mac-yosemite/fast/text/arabic-times-new-roman-expected.txt: Copied from LayoutTests/platform/mac/fast/text/arabic-times-new-roman-expected.txt.
>-        * platform/mac/fast/text/arabic-times-new-roman-expected.png:
>-        * platform/mac/fast/text/arabic-times-new-roman-expected.txt:
>-        * platform/win/fast/text/arabic-times-new-roman-expected.png: Added.
>-        * platform/win/fast/text/arabic-times-new-roman-expected.txt: Added.
>+        * inspector-protocol/runtime/getProperties-expected.txt: updated.
>+        * js/dom/native-bindings-descriptors-expected.txt: Added.
>+        * js/dom/native-bindings-descriptors.html: Added.
>+        * js/dom/script-tests/native-bindings-descriptors.js: Added.
> 
> 2015-06-23  Daniel Bates  <dabates@apple.com>
> 
>diff --git LayoutTests/inspector-protocol/runtime/getProperties-expected.txt LayoutTests/inspector-protocol/runtime/getProperties-expected.txt
>index 078d0da..b89fc14 100644
>--- LayoutTests/inspector-protocol/runtime/getProperties-expected.txt
>+++ LayoutTests/inspector-protocol/runtime/getProperties-expected.txt
>@@ -11,8 +11,8 @@ Properties of Bound function
>   __proto__ function function () {
>     [native code]
> }
>-  arguments
>-  caller
>+  arguments object TypeError: Type error
>+  caller object TypeError: Type error
>   length number 0
>   name string Number
> Internal properties
>diff --git LayoutTests/js/dom/native-bindings-descriptors-expected.txt LayoutTests/js/dom/native-bindings-descriptors-expected.txt
>new file mode 100644
>index 0000000..5b18da7
>--- /dev/null
>+++ LayoutTests/js/dom/native-bindings-descriptors-expected.txt
>@@ -0,0 +1,48 @@
>+CONSOLE MESSAGE: line 1: Deprecated attempt to access property 'title' on a non-Document object.
>+CONSOLE MESSAGE: line 1: Deprecated attempt to access property 'title' on a non-Document object.
>+CONSOLE MESSAGE: line 1: Deprecated attempt to access property 'title' on a non-Document object.
>+CONSOLE MESSAGE: line 1: [object Object]
>+CONSOLE MESSAGE: line 1: function nodeType() {
>+    [native code]
>+}
>+document.title
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title') is not Object.getOwnPropertyDescriptor(Document.prototype, 'title')
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get is Object.getOwnPropertyDescriptor(Document.prototype, 'title').get
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set is Object.getOwnPropertyDescriptor(Document.prototype, 'title').set
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.toString() is "function title() {\n    [native code]\n}"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.length is 0
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.toString() is "function title() {\n    [native code]\n}"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.length is 1
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document) is document.title
>+PASS document.title is "old title"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document) is "old title"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call() is undefined.
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(null) is undefined.
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document.documentElement) is undefined.
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document, 'new title') is undefined.
>+PASS document.title is "new title"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document) is "new title"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call() threw exception TypeError: The Document.title setter can only be used on instances of Document.
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(null) threw exception TypeError: The Document.title setter can only be used on instances of Document.
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document.documentElement) threw exception TypeError: The Document.title setter can only be used on instances of Document.
>+
>+document.readyState
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState') is not Object.getOwnPropertyDescriptor(Document.prototype, 'readyState')
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get is Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set is Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.toString() is "function readyState() {\n    [native code]\n}"
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.length is 0
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.call(document) is document.readyState
>+PASS Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set is undefined.
>+
>+Node.nodeType
>+PASS console.log(node_type) did not throw exception.
>+PASS console.log(getter) did not throw exception.
>+PASS node_type.get is defined.
>+PASS node_type.get.call(document.body) is 1
>+PASS node_type.enumerable is true
>+PASS getter === otherGetter is true
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git LayoutTests/js/dom/native-bindings-descriptors.html LayoutTests/js/dom/native-bindings-descriptors.html
>new file mode 100644
>index 0000000..256202a
>--- /dev/null
>+++ LayoutTests/js/dom/native-bindings-descriptors.html
>@@ -0,0 +1,11 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<title>old title</title>
>+<script src="../../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script src="script-tests/native-bindings-descriptors.js"></script>
>+<script src="../../resources/js-test-post.js"></script>
>+</body>
>+</html>
>diff --git LayoutTests/js/dom/script-tests/native-bindings-descriptors.js LayoutTests/js/dom/script-tests/native-bindings-descriptors.js
>new file mode 100644
>index 0000000..79a537a
>--- /dev/null
>+++ LayoutTests/js/dom/script-tests/native-bindings-descriptors.js
>@@ -0,0 +1,54 @@
>+debug("document.title");
>+shouldNotBe("Object.getOwnPropertyDescriptor(Document.prototype, 'title')", "Object.getOwnPropertyDescriptor(Document.prototype, 'title')");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get", "Object.getOwnPropertyDescriptor(Document.prototype, 'title').get");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set", "Object.getOwnPropertyDescriptor(Document.prototype, 'title').set");
>+shouldBeEqualToString("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.toString()", "function title() {\n    [native code]\n}");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.length", "0");
>+shouldBeEqualToString("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.toString()", "function title() {\n    [native code]\n}");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.length", "1");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document)", "document.title");
>+shouldBeEqualToString('document.title', 'old title');
>+shouldBeEqualToString("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document)", 'old title');
>+shouldBeUndefined("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call()");
>+shouldBeUndefined("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(null)");
>+shouldBeUndefined("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document.documentElement)");
>+shouldBeUndefined("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document, 'new title')");
>+shouldBeEqualToString('document.title', 'new title');
>+shouldBeEqualToString("Object.getOwnPropertyDescriptor(Document.prototype, 'title').get.call(document)", 'new title');
>+shouldThrow("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call()");
>+shouldThrow("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(null)");
>+shouldThrow("Object.getOwnPropertyDescriptor(Document.prototype, 'title').set.call(document.documentElement)");
>+
>+// document.readyState CustomAccessor: getter
>+// readonly attribute DOMString readyState;
>+debug("");
>+debug("document.readyState");
>+shouldNotBe("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState')", "Object.getOwnPropertyDescriptor(Document.prototype, 'readyState')");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get", "Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set", "Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set");
>+shouldBeEqualToString("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.toString()", "function readyState() {\n    [native code]\n}");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.length", "0");
>+shouldBe("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').get.call(document)", "document.readyState");
>+shouldBeUndefined("Object.getOwnPropertyDescriptor(Document.prototype, 'readyState').set");
>+
>+
>+debug("");
>+debug("Node.nodeType");
>+
>+var node_type = Object.getOwnPropertyDescriptor(Node.prototype, 'nodeType');
>+
>+// tests that logging one of these to the console does not cause a crash or throw an exception.
>+shouldNotThrow("console.log(node_type)");
>+
>+var getter = node_type.get;
>+shouldNotThrow("console.log(getter)");
>+
>+shouldBeDefined("node_type.get");
>+shouldBe("node_type.get.call(document.body)", "1");
>+shouldBeTrue("node_type.enumerable");
>+
>+
>+
>+// tests that the getter on native descriptors is always the same under strict equality. 
>+var otherGetter = Object.getOwnPropertyDescriptor(Node.prototype, 'nodeType').get;
>+shouldBeTrue("getter === otherGetter");
>diff --git Source/JavaScriptCore/CMakeLists.txt Source/JavaScriptCore/CMakeLists.txt
>index f8bc7ad..7a18009 100644
>--- Source/JavaScriptCore/CMakeLists.txt
>+++ Source/JavaScriptCore/CMakeLists.txt
>@@ -476,6 +476,7 @@ set(JavaScriptCore_RUNTIME_SOURCES
>     runtime/IteratorOperations.cpp
>     runtime/IteratorPrototype.cpp
>     runtime/JSAPIValueWrapper.cpp
>+    runtime/JSBoundSlotBaseFunction.cpp
>     runtime/JSArray.cpp
>     runtime/JSArrayBuffer.cpp
>     runtime/JSArrayBufferConstructor.cpp
>diff --git Source/JavaScriptCore/ChangeLog Source/JavaScriptCore/ChangeLog
>index 7d96e88..efdae90 100644
>--- Source/JavaScriptCore/ChangeLog
>+++ Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,40 @@
>+2015-06-23  Matthew Mirman  <mmirman@apple.com>
>+
>+        Completes native binding descriptors with native getters and potentially setters.
>+        https://bugs.webkit.org/show_bug.cgi?id=140575
>+        rdar://problem/19506502
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * CMakeLists.txt:  Added JSBoundSlotBaseFunction.cpp
>+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
>+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * inspector/InjectedScriptSource.js: Added case for descriptor having a native getter.
>+        * inspector/JSInjectedScriptHost.cpp: 
>+        * runtime/JSBoundSlotBaseFunction.cpp: Added.
>+        (JSC::boundSlotBaseFunctionCall):
>+        (JSC::JSBoundSlotBaseFunction::JSBoundSlotBaseFunction):  
>+        Necessary wrapper for custom getters and setters as objects.
>+        (JSC::JSBoundSlotBaseFunction::create):
>+        (JSC::JSBoundSlotBaseFunction::visitChildren):
>+        (JSC::JSBoundSlotBaseFunction::finishCreation):
>+        * runtime/JSBoundSlotBaseFunction.h: Added.
>+        (JSC::JSBoundSlotBaseFunction::createStructure):
>+        (JSC::JSBoundSlotBaseFunction::boundSlotBase):
>+        (JSC::JSBoundSlotBaseFunction::customGetterSetter):
>+        (JSC::JSBoundSlotBaseFunction::isGetter):
>+        * runtime/JSGlobalObject.cpp:
>+        (JSC::JSGlobalObject::init): Added a globally initialized structure for JSBoundSlotBaseFunction
>+        (JSC::JSGlobalObject::visitChildren): visits that structure
>+        * runtime/JSGlobalObject.h:
>+        (JSC::JSGlobalObject::boundSlotBaseFunctionStructure): added a getter for that structure
>+        * runtime/JSObject.cpp:
>+        (JSC::JSObject::getOwnPropertyDescriptor): extends the case for CustomGetterSetter to 
>+        actually include GetterSetter as a JSBoundSlotBaseFunction
>+        * runtime/VM.cpp: Added initializer for customGetterSetterFunctionMap
>+        * runtime/VM.h: Added cache for JSBoundSlotBaseFunction
>+
> 2015-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
> 
>         [ES6] Allow trailing comma in ArrayBindingPattern and ObjectBindingPattern
>diff --git Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
>index 4971d4f..b142a6a 100644
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
>@@ -740,6 +740,7 @@
>     <ClCompile Include="..\runtime\JSArrayBufferPrototype.cpp" />
>     <ClCompile Include="..\runtime\JSArrayBufferView.cpp" />
>     <ClCompile Include="..\runtime\JSBoundFunction.cpp" />
>+    <ClCompile Include="..\runtime\JSBoundSlotBaseFunction.cpp" />
>     <ClCompile Include="..\runtime\JSCJSValue.cpp" />
>     <ClCompile Include="..\runtime\JSCallee.cpp" />
>     <ClCompile Include="..\runtime\JSCatchScope.cpp" />
>@@ -1545,6 +1546,7 @@
>     <ClInclude Include="..\runtime\JSArrayBufferViewInlines.h" />
>     <ClInclude Include="..\runtime\JSArrayIterator.h" />
>     <ClInclude Include="..\runtime\JSBoundFunction.h" />
>+    <ClInclude Include="..\runtime\JSBoundSlotBaseFunction.h" />
>     <ClInclude Include="..\runtime\JSCInlines.h" />
>     <ClInclude Include="..\runtime\JSCJSValue.h" />
>     <ClInclude Include="..\runtime\JSCJSValueInlines.h" />
>diff --git Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters
>index 817b2d8..d3e02e3 100644
>--- Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters
>+++ Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters
>@@ -642,6 +642,9 @@
>     <ClCompile Include="..\runtime\JSBoundFunction.cpp">
>       <Filter>runtime</Filter>
>     </ClCompile>
>+    <ClCompile Include="..\runtime\JSBoundSlotBaseFunction.cpp">
>+      <Filter>runtime</Filter>
>+    </ClCompile>
>     <ClCompile Include="..\runtime\JSCallee.cpp">
>       <Filter>runtime</Filter>
>     </ClCompile>
>@@ -2697,6 +2700,9 @@
>     <ClInclude Include="..\runtime\JSBoundFunction.h">
>       <Filter>runtime</Filter>
>     </ClInclude>
>+    <ClInclude Include="..\runtime\JSBoundSlotBaseFunction.h">
>+      <Filter>runtime</Filter>
>+    </ClInclude>
>     <ClInclude Include="..\runtime\JSCallee.h">
>       <Filter>runtime</Filter>
>     </ClInclude>
>diff --git Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>index 0fcb092..5361033 100644
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>@@ -1310,6 +1310,8 @@
> 		A5FD0082189B191A00633231 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		A5FD0085189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */; };
> 		A5FD0086189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */; };
>+		A6738B041B2BB37D00027B28 /* JSBoundSlotBaseFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = A6738B031B2BB36C00027B28 /* JSBoundSlotBaseFunction.h */; };
>+		A6738B051B2BB39600027B28 /* JSBoundSlotBaseFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A6738B021B2BB36C00027B28 /* JSBoundSlotBaseFunction.cpp */; };
> 		A700873917CBE85300C3E643 /* MapConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873717CBE85300C3E643 /* MapConstructor.cpp */; };
> 		A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = A700873817CBE85300C3E643 /* MapConstructor.h */; };
> 		A700873D17CBE8D300C3E643 /* MapPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A700873B17CBE8D300C3E643 /* MapPrototype.cpp */; };
>@@ -3076,6 +3078,8 @@
> 		A5FD0080189B191A00633231 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = "<group>"; };
> 		A5FD0083189B1B7E00633231 /* JSGlobalObjectConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectConsoleAgent.cpp; sourceTree = "<group>"; };
> 		A5FD0084189B1B7E00633231 /* JSGlobalObjectConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectConsoleAgent.h; sourceTree = "<group>"; };
>+		A6738B021B2BB36C00027B28 /* JSBoundSlotBaseFunction.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSBoundSlotBaseFunction.cpp; sourceTree = "<group>"; };
>+		A6738B031B2BB36C00027B28 /* JSBoundSlotBaseFunction.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSBoundSlotBaseFunction.h; sourceTree = "<group>"; };
> 		A700873717CBE85300C3E643 /* MapConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapConstructor.cpp; sourceTree = "<group>"; };
> 		A700873817CBE85300C3E643 /* MapConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapConstructor.h; sourceTree = "<group>"; };
> 		A700873B17CBE8D300C3E643 /* MapPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MapPrototype.cpp; sourceTree = "<group>"; };
>@@ -4329,6 +4333,8 @@
> 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
> 			isa = PBXGroup;
> 			children = (
>+				A6738B021B2BB36C00027B28 /* JSBoundSlotBaseFunction.cpp */,
>+				A6738B031B2BB36C00027B28 /* JSBoundSlotBaseFunction.h */,
> 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
> 				BCF605120E203EF800B9A64D /* ArgList.h */,
> 				0FE0500C1AA9091100D33B33 /* ArgumentsMode.h */,
>@@ -6430,6 +6436,7 @@
> 				A503FA22188EFF6800110F14 /* ScriptDebugListener.h in Headers */,
> 				A503FA26188EFFFD00110F14 /* ScriptDebugServer.h in Headers */,
> 				A55D93A6185012A800400DED /* ScriptFunctionCall.h in Headers */,
>+				A6738B041B2BB37D00027B28 /* JSBoundSlotBaseFunction.h in Headers */,
> 				A54CF2FA184EAEDA00237F19 /* ScriptObject.h in Headers */,
> 				A54CF2F6184EAB2400237F19 /* ScriptValue.h in Headers */,
> 				A7299DA617D12858005F5FF9 /* SetConstructor.h in Headers */,
>@@ -7019,6 +7026,7 @@
> 			isa = PBXSourcesBuildPhase;
> 			buildActionMask = 2147483647;
> 			files = (
>+				A6738B051B2BB39600027B28 /* JSBoundSlotBaseFunction.cpp in Sources */,
> 				9EA5C7A2190F088700508EBE /* InitializeLLVMMac.cpp in Sources */,
> 				9EA5C7A1190F084200508EBE /* BundlePath.mm in Sources */,
> 				52B310FF1975B4240080857C /* TypeLocationCache.cpp in Sources */,
>diff --git Source/JavaScriptCore/inspector/InjectedScriptSource.js Source/JavaScriptCore/inspector/InjectedScriptSource.js
>index e576139..2b30f9d 100644
>--- Source/JavaScriptCore/inspector/InjectedScriptSource.js
>+++ Source/JavaScriptCore/inspector/InjectedScriptSource.js
>@@ -54,6 +54,14 @@ function isUInt32(obj)
>     return "" + (obj >>> 0) === obj;
> }
> 
>+function endsWith(str, suffix)
>+{
>+    var position = str.length - suffix.length;
>+    if (position < 0)
>+        return false;
>+    return str.indexOf(suffix, position) === position;
>+}
>+
> function isSymbol(obj)
> {
>     return typeof obj === "symbol";
>@@ -680,8 +688,10 @@ InjectedScript.prototype = {
>                     continue;
>                 }
> 
>-                if (descriptor.hasOwnProperty("get") && descriptor.hasOwnProperty("set") && !descriptor.get && !descriptor.set) {
>-                    // FIXME: <https://webkit.org/b/140575> Web Inspector: Native Bindings Descriptors are Incomplete
>+                if (endsWith(String(descriptor.get), "[native code]\n}") || 
>+                     (!descriptor.get && descriptor.hasOwnProperty("get") && !descriptor.set && descriptor.hasOwnProperty("set"))) {
>+                    // FIXME: Some Native Bindings Descriptors are Incomplete
>+                    // <https://webkit.org/b/141585> Some IDL attributes appear on the instances instead of on prototypes
>                     // Developers may create such a descriptors, so we should be resilient:
>                     // var x = {}; Object.defineProperty(x, "p", {get:undefined}); Object.getOwnPropertyDescriptor(x, "p")
>                     var fakeDescriptor = createFakeValueDescriptor(name, symbol, descriptor, isOwnProperty, true);
>diff --git Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
>index bc9b8df..8f2620f 100644
>--- Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
>+++ Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
>@@ -31,6 +31,7 @@
> #include "Error.h"
> #include "InjectedScriptHost.h"
> #include "IteratorOperations.h"
>+#include "JSAnchoredFunction.h"
> #include "JSArray.h"
> #include "JSArrayIterator.h"
> #include "JSBoundFunction.h"
>diff --git Source/JavaScriptCore/runtime/JSAnchoredFunction.cpp Source/JavaScriptCore/runtime/JSAnchoredFunction.cpp
>new file mode 100644
>index 0000000..4b4c1c8
>--- /dev/null
>+++ Source/JavaScriptCore/runtime/JSAnchoredFunction.cpp
>@@ -0,0 +1,92 @@
>+/*
>+ * Copyright (C) 2015 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "JSAnchoredFunction.h"
>+
>+#include "CustomGetterSetter.h"
>+#include "GetterSetter.h"
>+#include "JSCInlines.h"
>+#include "JSGlobalObject.h"
>+
>+namespace JSC {
>+
>+const ClassInfo JSAnchoredFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(JSAnchoredFunction) };
>+
>+EncodedJSValue JSC_HOST_CALL anchoredFunctionCall(ExecState* exec)
>+{
>+    JSAnchoredFunction* anchoredFunction = jsCast<JSAnchoredFunction*>(exec->callee());
>+    JSObject* baseObject = anchoredFunction->anchor();
>+    CustomGetterSetter* customGetterSetter = anchoredFunction->customGetterSetter();
>+
>+    if (anchoredFunction->isSetter()) {
>+        callCustomSetter(exec, customGetterSetter, baseObject, exec->thisValue(), exec->argument(0));
>+        return JSValue::encode(jsUndefined());
>+    }
>+
>+    CustomGetterSetter::CustomGetter getter = customGetterSetter->getter();
>+    if (!getter)
>+        return JSValue::encode(jsUndefined());
>+
>+    const String& name = anchoredFunction->name(exec);
>+    return getter(exec, baseObject, JSValue::encode(exec->thisValue()), PropertyName(Identifier::fromString(exec, name)));
>+}
>+
>+JSAnchoredFunction::JSAnchoredFunction(VM& vm, JSGlobalObject* globalObject, Structure* structure, JSObject* anchor, CustomGetterSetter* getterSetter, const Type type)
>+    : Base(vm, globalObject, structure)
>+    , m_anchor(vm, this, anchor)
>+    , m_getterSetter(vm, this, getterSetter)
>+    , m_type(type)
>+{
>+}
>+
>+JSAnchoredFunction* JSAnchoredFunction::create(VM& vm, JSGlobalObject* globalObject, JSObject* anchor, CustomGetterSetter* getterSetter, const Type type, const String& name)
>+{
>+    NativeExecutable* executable = vm.getHostFunction(anchoredFunctionCall, callHostFunctionAsConstructor);
>+
>+    JSAnchoredFunction* function = new (NotNull, allocateCell<JSAnchoredFunction>(vm.heap)) JSAnchoredFunction(vm, globalObject, globalObject->anchoredFunctionStructure(), anchor, getterSetter, type);
>+
>+    // Can't do this during initialization because getHostFunction might do a GC allocation.
>+    function->finishCreation(vm, executable, name);
>+    return function;
>+}
>+
>+void JSAnchoredFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
>+{
>+    JSAnchoredFunction* thisObject = jsCast<JSAnchoredFunction*>(cell);
>+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
>+    Base::visitChildren(thisObject, visitor);
>+
>+    visitor.append(&thisObject->m_anchor);
>+    visitor.append(&thisObject->m_getterSetter);
>+}
>+
>+void JSAnchoredFunction::finishCreation(VM& vm, NativeExecutable* executable, const String& name)
>+{
>+    ASSERT(inherits(info()));
>+    Base::finishCreation(vm, executable, isSetter(), name);
>+}
>+
>+} // namespace JSC
>diff --git Source/JavaScriptCore/runtime/JSAnchoredFunction.h Source/JavaScriptCore/runtime/JSAnchoredFunction.h
>new file mode 100644
>index 0000000..af9e698
>--- /dev/null
>+++ Source/JavaScriptCore/runtime/JSAnchoredFunction.h
>@@ -0,0 +1,78 @@
>+/*
>+ * Copyright (C) 2015 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#ifndef JSAnchoredFunction_h
>+#define JSAnchoredFunction_h
>+
>+#include "JSFunction.h"
>+
>+namespace JSC {
>+
>+class CustomGetterSetter;
>+
>+EncodedJSValue JSC_HOST_CALL anchoredFunctionCall(ExecState*);
>+
>+class JSAnchoredFunction : public JSFunction {
>+
>+public:
>+
>+    typedef JSFunction Base;
>+
>+    // The Type is set to the number of arguments the resultant function will have.
>+    enum class Type { Getter = 0, Setter = 1 };
>+
>+    static const unsigned StructureFlags = Base::StructureFlags;
>+
>+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>+    {
>+        ASSERT(globalObject);
>+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info()); 
>+    }
>+
>+    static JSAnchoredFunction* create(VM&, JSGlobalObject*, JSObject*, CustomGetterSetter*, const Type, const String&);
>+
>+    JSObject* anchor() const { return m_anchor.get(); }
>+    CustomGetterSetter* customGetterSetter() const { return m_getterSetter.get(); }
>+    bool isSetter() const { return m_type == Type::Setter; }
>+
>+    DECLARE_EXPORT_INFO;
>+
>+protected:
>+
>+    static void visitChildren(JSCell*, SlotVisitor&);
>+
>+private:
>+
>+    JSAnchoredFunction(VM&, JSGlobalObject*, Structure*, JSObject*, CustomGetterSetter*, Type);
>+
>+    void finishCreation(VM&, NativeExecutable*, const String&);
>+
>+    WriteBarrier<JSObject> m_anchor;
>+    WriteBarrier<CustomGetterSetter> m_getterSetter;
>+    Type m_type;
>+};
>+} // namespace JSC
>+
>+#endif // JSAnchoredFunction_h
>diff --git Source/JavaScriptCore/runtime/JSGlobalObject.cpp Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>index 0165dc6..298d8e5 100644
>--- Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>@@ -60,6 +60,7 @@
> #include "JSArrayBufferPrototype.h"
> #include "JSArrayIterator.h"
> #include "JSBoundFunction.h"
>+#include "JSBoundSlotBaseFunction.h"
> #include "JSCInlines.h"
> #include "JSCallbackConstructor.h"
> #include "JSCallbackFunction.h"
>@@ -241,6 +242,7 @@ void JSGlobalObject::init(VM& vm)
>     exec->setCallee(m_globalCallee.get());
> 
>     m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
>+    m_boundSlotBaseFunctionStructure.set(vm, this, JSBoundSlotBaseFunction::createStructure(vm, this, m_functionPrototype.get()));
>     m_boundFunctionStructure.set(vm, this, JSBoundFunction::createStructure(vm, this, m_functionPrototype.get()));
>     m_namedFunctionStructure.set(vm, this, Structure::addPropertyTransition(vm, m_functionStructure.get(), vm.propertyNames->name, DontDelete | ReadOnly | DontEnum, m_functionNameOffset));
>     m_internalFunctionStructure.set(vm, this, InternalFunction::createStructure(vm, this, m_functionPrototype.get()));
>@@ -775,6 +777,7 @@ void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
>     visitor.append(&thisObject->m_errorStructure);
>     visitor.append(&thisObject->m_calleeStructure);
>     visitor.append(&thisObject->m_functionStructure);
>+    visitor.append(&thisObject->m_boundSlotBaseFunctionStructure);
>     visitor.append(&thisObject->m_boundFunctionStructure);
>     visitor.append(&thisObject->m_namedFunctionStructure);
>     visitor.append(&thisObject->m_symbolObjectStructure);
>diff --git Source/JavaScriptCore/runtime/JSGlobalObject.h Source/JavaScriptCore/runtime/JSGlobalObject.h
>index 9b0e7ba..9f5c6e8 100644
>--- Source/JavaScriptCore/runtime/JSGlobalObject.h
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.h
>@@ -238,6 +238,7 @@ protected:
>     WriteBarrier<Structure> m_calleeStructure;
>     WriteBarrier<Structure> m_functionStructure;
>     WriteBarrier<Structure> m_boundFunctionStructure;
>+    WriteBarrier<Structure> m_boundSlotBaseFunctionStructure;
>     WriteBarrier<Structure> m_namedFunctionStructure;
>     PropertyOffset m_functionNameOffset;
>     WriteBarrier<Structure> m_privateNameStructure;
>@@ -478,6 +479,7 @@ public:
>     Structure* calleeStructure() const { return m_calleeStructure.get(); }
>     Structure* functionStructure() const { return m_functionStructure.get(); }
>     Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(); }
>+    Structure* boundSlotBaseFunctionStructure() const { return m_boundSlotBaseFunctionStructure.get(); }
>     Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(); }
>     PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
>     Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
>diff --git Source/JavaScriptCore/runtime/JSObject.cpp Source/JavaScriptCore/runtime/JSObject.cpp
>index faece30..67fd962 100644
>--- Source/JavaScriptCore/runtime/JSObject.cpp
>+++ Source/JavaScriptCore/runtime/JSObject.cpp
>@@ -35,6 +35,7 @@
> #include "Executable.h"
> #include "GetterSetter.h"
> #include "IndexingHeaderInlines.h"
>+#include "JSBoundSlotBaseFunction.h"
> #include "JSCatchScope.h"
> #include "JSFunction.h"
> #include "JSFunctionNameScope.h"
>@@ -2488,6 +2489,17 @@ Butterfly* JSObject::growOutOfLineStorage(VM& vm, size_t oldSize, size_t newSize
>     return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize);
> }
> 
>+static JSBoundSlotBaseFunction* getBoundSlotBaseFunctionForGetterSetter(ExecState* exec, PropertyName propertyName, JSC::PropertySlot& slot, CustomGetterSetter* getterSetter, JSBoundSlotBaseFunction::Type type)
>+{
>+    auto key = std::make_pair(getterSetter, (int)type);
>+    JSBoundSlotBaseFunction* boundSlotBase = exec->vm().customGetterSetterFunctionMap.get(key);
>+    if (!boundSlotBase) {
>+        boundSlotBase = JSBoundSlotBaseFunction::create(exec->vm(), exec->lexicalGlobalObject(), slot.slotBase(), getterSetter, type, propertyName.publicName());
>+        exec->vm().customGetterSetterFunctionMap.set(key, boundSlotBase);
>+    }
>+    return boundSlotBase;
>+}
>+
> bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
> {
>     JSC::PropertySlot slot(this);
>@@ -2498,9 +2510,22 @@ bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyNa
>         return false;
>     if (slot.isAccessor())
>         descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
>-    else if (slot.attributes() & CustomAccessor)
>+    else if (slot.attributes() & CustomAccessor) {
>         descriptor.setCustomDescriptor(slot.attributes());
>-    else
>+        
>+        JSValue maybeGetterSetter = getDirect(exec->vm(), propertyName);
>+        if (maybeGetterSetter) {
>+
>+            CustomGetterSetter* getterSetter = jsCast<CustomGetterSetter*>(maybeGetterSetter);
>+            ASSERT(getterSetter);
>+
>+            if (getterSetter->getter())
>+                descriptor.setGetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Getter));
>+            if (getterSetter->setter())
>+                descriptor.setSetter(getBoundSlotBaseFunctionForGetterSetter(exec, propertyName, slot, getterSetter, JSBoundSlotBaseFunction::Type::Setter));
>+            descriptor.setEnumerable(true);
>+        }
>+    } else
>         descriptor.setDescriptor(slot.getValue(exec, propertyName), slot.attributes());
>     return true;
> }
>diff --git Source/JavaScriptCore/runtime/VM.cpp Source/JavaScriptCore/runtime/VM.cpp
>index 7d9df80..e366a6e 100644
>--- Source/JavaScriptCore/runtime/VM.cpp
>+++ Source/JavaScriptCore/runtime/VM.cpp
>@@ -152,6 +152,7 @@ VM::VM(VMType vmType, HeapType heapType)
>     , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
>     , propertyNames(nullptr)
>     , emptyList(new MarkedArgumentBuffer)
>+    , customGetterSetterFunctionMap(*this)
>     , stringCache(*this)
>     , prototypeMap(*this)
>     , keywords(std::make_unique<Keywords>(*this))
>diff --git Source/JavaScriptCore/runtime/VM.h Source/JavaScriptCore/runtime/VM.h
>index bfc4f4a..aa81a89 100644
>--- Source/JavaScriptCore/runtime/VM.h
>+++ Source/JavaScriptCore/runtime/VM.h
>@@ -76,6 +76,7 @@ class BuiltinExecutables;
> class CodeBlock;
> class CodeCache;
> class CommonIdentifiers;
>+class CustomGetterSetter;
> class ExecState;
> class Exception;
> class HandleStack;
>@@ -83,6 +84,7 @@ class TypeProfiler;
> class TypeProfilerLog;
> class Identifier;
> class Interpreter;
>+class JSBoundSlotBaseFunction;
> class JSGlobalObject;
> class JSObject;
> class Keywords;
>@@ -290,6 +292,7 @@ public:
>     NumericStrings numericStrings;
>     DateInstanceCache dateInstanceCache;
>     WTF::SimpleStats machineCodeBytesPerBytecodeWordForBaselineJIT;
>+    WeakGCMap<std::pair<CustomGetterSetter*, int>, JSBoundSlotBaseFunction> customGetterSetterFunctionMap;
>     WeakGCMap<StringImpl*, JSString, PtrHash<StringImpl*>> stringCache;
>     Strong<JSString> lastCachedString;
> 
>-- 
>2.2.1 (Apple Git-53)
>

Actions: View | Formatted Diff | Diff

Attachments on bug 140575: 246543 | 246565 | 246569 | 246689 | 255043 | 255122 | 255235 | 255249 | 255251 | 255362 | 255432 | 255436 | 255438 | 270151 | 270153 | 270160 | 270162 | 270164 | 270170 | 270279 | 270284 | 270285 | 270429 | 270438 | 270445 | 270463