Attachment #128159 for bug #65595

View Details Raw Unified Return to Bug 65595

| Differences between



2012-02-22  MORITA Hajime  <morrita@google.com>

        This test checks select attribute of content element is valid.
        https://bugs.webkit.org/show_bug.cgi?id=65595

        Reviewed by NOBODY (OOPS!).

        This change introduced FrameTree::documentChild() and
        FrameTree::documentChild(), which can be used for scope-aware
        frame lookup. Using these, now the named accessor and the indexed
        acceccor on Document, and Window.length is TreeScope aware. They
        don't count iframes in Shadow DOM.

        This change also removes FrameTree::m_childCount since
        Frame::childCount() is no longer in the hot
        path. m_documentChildCount is added instead.

        Test: fast/dom/shadow/iframe-shadow.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::childFrameGetter):
        (WebCore::indexGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
        * bindings/v8/custom/V8DOMWindowCustom.cpp:
        (WebCore::V8DOMWindow::indexedPropertyGetter):
        (WebCore::V8DOMWindow::namedPropertyGetter):
        (WebCore::V8DOMWindow::namedSecurityCheck):
        (WebCore::V8DOMWindow::indexedSecurityCheck):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::length):
        * page/Frame.cpp:
        (WebCore::Frame::isScopedBy):
        (WebCore):
        * page/Frame.h:
        (WebCore):
        (Frame):
        * page/FrameTree.cpp:
        (WebCore::FrameTree::actuallyAppendChild):
        (WebCore::FrameTree::removeChild):
        (WebCore::FrameTree::scopedChild):
        (WebCore):
        (WebCore::FrameTree::scopedChildCount):
        (WebCore::FrameTree::documentChild):
        (WebCore::FrameTree::documentChildCount):
        (WebCore::FrameTree::childCount):
        * page/FrameTree.h:
        (WebCore):
        (FrameTree):
        (WebCore::FrameTree::FrameTree):

2012-02-20  Raymond Liu  <raymond.liu@intel.com>

        Have the DynamicsCompressorNode support multi-channel data




static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
{
    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->documentChild(identifierToAtomicString(propertyName))->domWindow());
}

static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
{
    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->documentChild(index)->domWindow());
}

static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)

    // naming frames things that conflict with window properties that
    // are in Moz but not IE. Since we have some of these, we have to do
    // it the Moz way.
    if (thisObject->impl()->frame()->tree()->documentChild(identifierToAtomicString(propertyName))) {
        slot.setCustom(thisObject, childFrameGetter);
        return true;
    }

    // allow window[1] or parent[1] etc. (#56983)
    bool ok;
    unsigned i = propertyName.toArrayIndex(ok);
    if (ok && i < thisObject->impl()->frame()->tree()->documentChildCount()) {
        slot.setCustomIndex(thisObject, i, indexGetter);
        return true;
    }

    // naming frames things that conflict with window properties that
    // are in Moz but not IE. Since we have some of these, we have to do
    // it the Moz way.
    if (thisObject->impl()->frame()->tree()->documentChild(identifierToAtomicString(propertyName))) {
        PropertySlot slot;
        slot.setCustom(thisObject, childFrameGetter);
        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);

    
    bool ok;
    unsigned i = propertyName.toArrayIndex(ok);
    if (ok && i < thisObject->impl()->frame()->tree()->documentChildCount()) {
        PropertySlot slot;
        slot.setCustomIndex(thisObject, i, indexGetter);
        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);



    if (!frame)
        return notHandledByInterceptor();

    Frame* child = frame->tree()->documentChild(index);
    if (child)
        return toV8(child->domWindow());



    // Search sub-frames.
    AtomicString propName = v8StringToAtomicWebCoreString(name);
    Frame* child = frame->tree()->documentChild(propName);
    if (child)
        return toV8(child->domWindow());


        DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));

        String name = toWebCoreString(key);
        Frame* childFrame = target->tree()->documentChild(name);
        // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
        // because that would generate infinite recursion.
        if (type == v8::ACCESS_HAS && childFrame)
            return true;
        // We need to explicitly compare against nameOfProtoProperty because
        // V8's JSObject::LocalLookup finds __proto__ before
        // interceptors and even when __proto__ isn't a "real named property".
        if (type == v8::ACCESS_GET && childFrame && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
            return true;
    }


    Frame* target = targetWindow->frame();
    if (!target)
        return false;
    Frame* childFrame =  target->tree()->documentChild(index);

    // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
    // because that would generate infinite recursion.
    if (type == v8::ACCESS_HAS && childFrame)
        return true;
    if (type == v8::ACCESS_GET && childFrame && !host->HasRealIndexedProperty(index))
        return true;

    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);

Lines 1206-1212 unsigned DOMWindow::length() const a/Source/WebCore/page/DOMWindow.cpp_sec1
- a/Source/WebCore/page/DOMWindow.cpp -1 / +1 lines
1206	if (!isCurrentlyDisplayedInFrame())	1206	if (!isCurrentlyDisplayedInFrame())
1207	return 0;	1207	return 0;
1208		1208
1209	return m_frame->tree()->childCount();	1209	return m_frame->tree()->documentChildCount();
1210	}	1210	}
1211		1211
1212	String DOMWindow::name() const	1212	String DOMWindow::name() const

Lines 1125-1130 DragImageRef Frame::dragImageForSelection() a/Source/WebCore/page/Frame.cpp_sec1
- a/Source/WebCore/page/Frame.cpp +9 lines
1125	return createDragImageFromImage(image.get());	1125	return createDragImageFromImage(image.get());
1126	}	1126	}
1127		1127
		1128	bool Frame::isScopedBy(TreeScope* scope) const
		1129	{
		1130	ASSERT(scope);
		1131	HTMLFrameOwnerElement* owner = document()->ownerElement();
		1132	// Scoping test should be done only for child frames.
		1133	ASSERT(owner);
		1134	return owner->treeScope() == scope;
		1135	}
		1136
1128	#endif	1137	#endif
1129		1138
1130	} // namespace WebCore	1139	} // namespace WebCore

Lines 74-79 namespace WebCore { a/Source/WebCore/page/Frame.h_sec1
- a/Source/WebCore/page/Frame.h +3 lines
74	class TiledBackingStoreClient { };	74	class TiledBackingStoreClient { };
75	#endif	75	#endif
76		76
		77	class TreeScope;
		78
77	class Frame : public RefCounted<Frame>, public TiledBackingStoreClient {	79	class Frame : public RefCounted<Frame>, public TiledBackingStoreClient {
78	public:	80	public:
79	static PassRefPtr<Frame> create(Page, HTMLFrameOwnerElement, FrameLoaderClient*);	81	static PassRefPtr<Frame> create(Page, HTMLFrameOwnerElement, FrameLoaderClient*);
Lines 123-128 namespace WebCore { a/Source/WebCore/page/Frame.h_sec2
123	void setIsDisconnected(bool);	125	void setIsDisconnected(bool);
124	bool excludeFromTextSearch() const;	126	bool excludeFromTextSearch() const;
125	void setExcludeFromTextSearch(bool);	127	void setExcludeFromTextSearch(bool);
		128	bool isScopedBy(TreeScope*) const;
126		129
127	void injectUserScripts(UserScriptInjectionTime);	130	void injectUserScripts(UserScriptInjectionTime);
128		131



    } else
        m_firstChild = child;

    m_documentChildCount = invalidCount;

    ASSERT(!m_lastChild->tree()->m_nextSibling);
}

    child->tree()->m_previousSibling = 0;
    child->tree()->m_nextSibling = 0;

    m_documentChildCount = invalidCount;
}

AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const

    return AtomicString(name);
}

inline Frame* FrameTree::scopedChild(unsigned index, TreeScope* scope) const
{
    unsigned scopedIndex = 0;
    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
        if (result->isScopedBy(scope)) {
            if (scopedIndex == index)
                return result;
            scopedIndex++;
        }
    }

    return 0;
}

inline Frame* FrameTree::scopedChild(const AtomicString& name, TreeScope* scope) const
{
    for (Frame* child = firstChild(); child; child = child->tree()->nextSibling())
        if (child->tree()->uniqueName() == name && child->isScopedBy(scope))
            return child;
    return 0;
}

inline unsigned FrameTree::scopedChildCount(TreeScope* scope) const
{
    unsigned scopedCount = 0;
    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
        if (result->isScopedBy(scope))
            scopedCount++;
    }

    return scopedCount;
}

Frame* FrameTree::documentChild(unsigned index) const
{
    return scopedChild(index, m_thisFrame->document());
}

Frame* FrameTree::documentChild(const AtomicString& name) const
{
    return scopedChild(name, m_thisFrame->document());
}

unsigned FrameTree::documentChildCount() const
{
    if (m_documentChildCount == invalidCount)
        m_documentChildCount = scopedChildCount(m_thisFrame->document());
    return m_documentChildCount;
}

unsigned FrameTree::childCount() const
{
    unsigned count = 0;
    for (Frame* result = firstChild(); result; result = result->tree()->nextSibling())
        ++count;
    return count;
}

Frame* FrameTree::child(unsigned index) const
{
    Frame* result = firstChild();



#ifndef FrameTree_h
#define FrameTree_h

#include <wtf/NotFound.h>
#include <wtf/text/AtomicString.h>

namespace WebCore {

    class Frame;
    class TreeScope;

    class FrameTree {
        WTF_MAKE_NONCOPYABLE(FrameTree);
    public:
        const static unsigned invalidCount = static_cast<unsigned>(WTF::notFound);

        FrameTree(Frame* thisFrame, Frame* parentFrame) 
            : m_thisFrame(thisFrame)
            , m_parent(parentFrame)
            , m_previousSibling(0)
            , m_lastChild(0)
            , m_documentChildCount(invalidCount)
        {
        }

        ~FrameTree();

        const AtomicString& name() const { return m_name; }

        Frame* previousSibling() const { return m_previousSibling; }
        Frame* firstChild() const { return m_firstChild.get(); }
        Frame* lastChild() const { return m_lastChild; }
        unsigned childCount() const { return m_childCount; }

        bool isDescendantOf(const Frame* ancestor) const;
        Frame* traverseNext(const Frame* stayWithin = 0) const;

        Frame* child(unsigned index) const;
        Frame* child(const AtomicString& name) const;
        Frame* find(const AtomicString& name) const;
        unsigned childCount() const;

        AtomicString uniqueChildName(const AtomicString& requestedName) const;

        Frame* top(bool checkForDisconnectedFrame = false) const;

        Frame* documentChild(unsigned index) const;
        Frame* documentChild(const AtomicString& name) const;
        unsigned documentChildCount() const;

    private:
        Frame* deepLastChild() const;
        void actuallyAppendChild(PassRefPtr<Frame>);

        bool scopedBy(TreeScope*) const;
        Frame* scopedChild(unsigned index, TreeScope*) const;
        Frame* scopedChild(const AtomicString& name, TreeScope*) const;
        unsigned scopedChildCount(TreeScope*) const;

        Frame* m_thisFrame;

        Frame* m_parent;

        Frame* m_previousSibling;
        RefPtr<Frame> m_firstChild;
        Frame* m_lastChild;
        mutable unsigned m_documentChildCount;
    };

} // namespace WebCore



2012-02-22  MORITA Hajime  <morrita@google.com>

        This test checks select attribute of content element is valid.
        https://bugs.webkit.org/show_bug.cgi?id=65595

        Reviewed by NOBODY (OOPS!).

        * fast/dom/shadow/iframe-shadow-expected.txt: Added.
        * fast/dom/shadow/iframe-shadow.html: Added.

2012-02-20  David Barton  <dbarton@mathscribe.com>

        RenderMathMLRow::baselinePosition() only if linePositionMode == PositionOnContainingLine



This test ensures that iframe inside shadow isn't visible from the host document.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS window.length is 4
PASS i0byname.length is 1
PASS i0 is i0byname[0].contentWindow
PASS i1.length is 2
PASS window.length is 4
PASS i2byname.length is 1
PASS i2byname[0].contentWindow is i2
PASS i3byname.length is 0
PASS i3 is undefined
PASS window.length is 3
PASS document['i0'] is undefined
PASS window.length is 4
PASS document['i3'] is i3InShadow.contentWindow
PASS successfullyParsed is true

TEST COMPLETE
   




<!DOCTYPE html>
<html>
<head>
<script src="../../js/resources/js-test-pre.js"></script>
</head>
<body>
<pre id="console"></pre>
<iframe name="i0"></iframe>
<iframe name="i1"></iframe>
<iframe name="i1"></iframe>
<iframe name="i2"></iframe>

<div id="host"></div>

<script>

description("This test ensures that iframe inside shadow isn't visible from the host document.");

// At first, check iframe in usual way
shouldBe("window.length", "4");
var i0 = document["i0"];
var i0byname = document.getElementsByName("i0");
shouldBe("i0byname.length", "1");
shouldBe("i0", "i0byname[0].contentWindow");

var i1 = document["i1"];
var i2byname = document.getElementsByName("i0");
shouldBe("i1.length", "2");

// Then Adding some iframes into a shadow.

var host = document.getElementById("host");
var shadow = new WebKitShadowRoot(host);
var i2InShadow = document.createElement("iframe");
i2InShadow.setAttribute("name", "i2");
shadow.appendChild(i2InShadow);

var i3InShadow = document.createElement("iframe");
i3InShadow.setAttribute("name", "i3");
shadow.appendChild(i3InShadow);

shouldBe("window.length", "4");

var i2 = document["i2"];
var i2byname = document.getElementsByName("i2");
shouldBe("i2byname.length", "1");
shouldBe("i2byname[0].contentWindow", "i2");

var i3 = document["i3"];
var i3byname = document.getElementsByName("i3");
shouldBe("i3byname.length", "0");
shouldBe("i3", "undefined");

// Moving iframes across shadow boundary to ensure
// That window.length and property availability are
// correctly updated.

shadow.appendChild(i0.frameElement);

shouldBe("window.length", "3");
shouldBe("document['i0']", "undefined");

document.body.appendChild(i3InShadow);
shouldBe("window.length", "4");
shouldBe("document['i3']", "i3InShadow.contentWindow");

</script>

<script src="../../js/resources/js-test-post.js"></script>
</body>
</html>

Return to Bug 65595

Lines 476-482 v8::Handle<v8::Value> V8DOMWindow::indexedPropertyGetter(uint32_t index, const v a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp_sec1
- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp -6 / +8 lines
476	if (!frame)	476	if (!frame)
477	return notHandledByInterceptor();	477	return notHandledByInterceptor();
478		478
479	Frame* child = frame->tree()->child(index);	479	Frame* child = frame->tree()->documentChild(index);
480	if (child)	480	if (child)
481	return toV8(child->domWindow());	481	return toV8(child->domWindow());
482		482
Lines 499-505 v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp_sec2
499		499
500	// Search sub-frames.	500	// Search sub-frames.
501	AtomicString propName = v8StringToAtomicWebCoreString(name);	501	AtomicString propName = v8StringToAtomicWebCoreString(name);
502	Frame* child = frame->tree()->child(propName);	502	Frame* child = frame->tree()->documentChild(propName);
503	if (child)	503	if (child)
504	return toV8(child->domWindow());	504	return toV8(child->domWindow());
505		505
Lines 556-569 bool V8DOMWindow::namedSecurityCheck(v8::Local<v8::Object> host, v8::Local<v8::V a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp_sec3
556	DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));	556	DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));
557		557
558	String name = toWebCoreString(key);	558	String name = toWebCoreString(key);
		559	Frame* childFrame = target->tree()->documentChild(name);
559	// Notice that we can't call HasRealNamedProperty for ACCESS_HAS	560	// Notice that we can't call HasRealNamedProperty for ACCESS_HAS
560	// because that would generate infinite recursion.	561	// because that would generate infinite recursion.
561	if (type == v8::ACCESS_HAS && target->tree()->child(name))	562	if (type == v8::ACCESS_HAS && childFrame)
562	return true;	563	return true;
563	// We need to explicitly compare against nameOfProtoProperty because	564	// We need to explicitly compare against nameOfProtoProperty because
564	// V8's JSObject::LocalLookup finds __proto__ before	565	// V8's JSObject::LocalLookup finds __proto__ before
565	// interceptors and even when __proto__ isn't a "real named property".	566	// interceptors and even when __proto__ isn't a "real named property".
566	if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)	567	if (type == v8::ACCESS_GET && childFrame && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
567	return true;	568	return true;
568	}	569	}
569		570
Lines 583-594 bool V8DOMWindow::indexedSecurityCheck(v8::Local<v8::Object> host, uint32_t inde a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp_sec4
583	Frame* target = targetWindow->frame();	584	Frame* target = targetWindow->frame();
584	if (!target)	585	if (!target)
585	return false;	586	return false;
		587	Frame* childFrame = target->tree()->documentChild(index);
586		588
587	// Notice that we can't call HasRealNamedProperty for ACCESS_HAS	589	// Notice that we can't call HasRealNamedProperty for ACCESS_HAS
588	// because that would generate infinite recursion.	590	// because that would generate infinite recursion.
589	if (type == v8::ACCESS_HAS && target->tree()->child(index))	591	if (type == v8::ACCESS_HAS && childFrame)
590	return true;	592	return true;
591	if (type == v8::ACCESS_GET && target->tree()->child(index) && !host->HasRealIndexedProperty(index))	593	if (type == v8::ACCESS_GET && childFrame && !host->HasRealIndexedProperty(index))
592	return true;	594	return true;
593		595
594	return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);	596	return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, false);

Lines 103-109 void FrameTree::actuallyAppendChild(PassRefPtr<Frame> child) a/Source/WebCore/page/FrameTree.cpp_sec1
- a/Source/WebCore/page/FrameTree.cpp -2 / +60 lines
103	} else	103	} else
104	m_firstChild = child;	104	m_firstChild = child;
105		105
106	m_childCount++;	106	m_documentChildCount = invalidCount;
107		107
108	ASSERT(!m_lastChild->tree()->m_nextSibling);	108	ASSERT(!m_lastChild->tree()->m_nextSibling);
109	}	109	}
Lines 125-131 void FrameTree::removeChild(Frame* child) a/Source/WebCore/page/FrameTree.cpp_sec2
125	child->tree()->m_previousSibling = 0;	125	child->tree()->m_previousSibling = 0;
126	child->tree()->m_nextSibling = 0;	126	child->tree()->m_nextSibling = 0;
127		127
128	m_childCount--;	128	m_documentChildCount = invalidCount;
129	}	129	}
130		130
131	AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const	131	AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const
Lines 177-182 AtomicString FrameTree::uniqueChildName(const AtomicString& requestedName) const a/Source/WebCore/page/FrameTree.cpp_sec3
177	return AtomicString(name);	177	return AtomicString(name);
178	}	178	}
179		179
		180	inline Frame* FrameTree::scopedChild(unsigned index, TreeScope* scope) const
		181	{
		182	unsigned scopedIndex = 0;
		183	for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
		184	if (result->isScopedBy(scope)) {
		185	if (scopedIndex == index)
		186	return result;
		187	scopedIndex++;
		188	}
		189	}
		190
		191	return 0;
		192	}
		193
		194	inline Frame* FrameTree::scopedChild(const AtomicString& name, TreeScope* scope) const
		195	{
		196	for (Frame* child = firstChild(); child; child = child->tree()->nextSibling())
		197	if (child->tree()->uniqueName() == name && child->isScopedBy(scope))
		198	return child;
		199	return 0;
		200	}
		201
		202	inline unsigned FrameTree::scopedChildCount(TreeScope* scope) const
		203	{
		204	unsigned scopedCount = 0;
		205	for (Frame* result = firstChild(); result; result = result->tree()->nextSibling()) {
		206	if (result->isScopedBy(scope))
		207	scopedCount++;
		208	}
		209
		210	return scopedCount;
		211	}
		212
		213	Frame* FrameTree::documentChild(unsigned index) const
		214	{
		215	return scopedChild(index, m_thisFrame->document());
		216	}
		217
		218	Frame* FrameTree::documentChild(const AtomicString& name) const
		219	{
		220	return scopedChild(name, m_thisFrame->document());
		221	}
		222
		223	unsigned FrameTree::documentChildCount() const
		224	{
		225	if (m_documentChildCount == invalidCount)
		226	m_documentChildCount = scopedChildCount(m_thisFrame->document());
		227	return m_documentChildCount;
		228	}
		229
		230	unsigned FrameTree::childCount() const
		231	{
		232	unsigned count = 0;
		233	for (Frame* result = firstChild(); result; result = result->tree()->nextSibling())
		234	++count;
		235	return count;
		236	}
		237
180	Frame* FrameTree::child(unsigned index) const	238	Frame* FrameTree::child(unsigned index) const
181	{	239	{
182	Frame* result = firstChild();	240	Frame* result = firstChild();

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +51 lines
		1	2012-02-22 MORITA Hajime <morrita@google.com>
		2
		3	This test checks select attribute of content element is valid.
		4	https://bugs.webkit.org/show_bug.cgi?id=65595
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	This change introduced FrameTree::documentChild() and
		9	FrameTree::documentChild(), which can be used for scope-aware
		10	frame lookup. Using these, now the named accessor and the indexed
		11	acceccor on Document, and Window.length is TreeScope aware. They
		12	don't count iframes in Shadow DOM.
		13
		14	This change also removes FrameTree::m_childCount since
		15	Frame::childCount() is no longer in the hot
		16	path. m_documentChildCount is added instead.
		17
		18	Test: fast/dom/shadow/iframe-shadow.html
		19
		20	* bindings/js/JSDOMWindowCustom.cpp:
		21	(WebCore::childFrameGetter):
		22	(WebCore::indexGetter):
		23	(WebCore::JSDOMWindow::getOwnPropertySlot):
		24	(WebCore::JSDOMWindow::getOwnPropertyDescriptor):
		25	* bindings/v8/custom/V8DOMWindowCustom.cpp:
		26	(WebCore::V8DOMWindow::indexedPropertyGetter):
		27	(WebCore::V8DOMWindow::namedPropertyGetter):
		28	(WebCore::V8DOMWindow::namedSecurityCheck):
		29	(WebCore::V8DOMWindow::indexedSecurityCheck):
		30	* page/DOMWindow.cpp:
		31	(WebCore::DOMWindow::length):
		32	* page/Frame.cpp:
		33	(WebCore::Frame::isScopedBy):
		34	(WebCore):
		35	* page/Frame.h:
		36	(WebCore):
		37	(Frame):
		38	* page/FrameTree.cpp:
		39	(WebCore::FrameTree::actuallyAppendChild):
		40	(WebCore::FrameTree::removeChild):
		41	(WebCore::FrameTree::scopedChild):
		42	(WebCore):
		43	(WebCore::FrameTree::scopedChildCount):
		44	(WebCore::FrameTree::documentChild):
		45	(WebCore::FrameTree::documentChildCount):
		46	(WebCore::FrameTree::childCount):
		47	* page/FrameTree.h:
		48	(WebCore):
		49	(FrameTree):
		50	(WebCore::FrameTree::FrameTree):
		51
1	2012-02-20 Raymond Liu <raymond.liu@intel.com>	52	2012-02-20 Raymond Liu <raymond.liu@intel.com>
2		53
3	Have the DynamicsCompressorNode support multi-channel data	54	Have the DynamicsCompressorNode support multi-channel data

Lines 99-110 JSValue nonCachingStaticFunctionGetter(ExecState* exec, JSValue, const Identifie a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp_sec1
- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp -6 / +6 lines
99		99
100	static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)	100	static JSValue childFrameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
101	{	101	{
102	return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))->domWindow());	102	return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->documentChild(identifierToAtomicString(propertyName))->domWindow());
103	}	103	}
104		104
105	static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)	105	static JSValue indexGetter(ExecState* exec, JSValue slotBase, unsigned index)
106	{	106	{
107	return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->child(index)->domWindow());	107	return toJS(exec, static_cast<JSDOMWindow*>(asObject(slotBase))->impl()->frame()->tree()->documentChild(index)->domWindow());
108	}	108	}
109		109
110	static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)	110	static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
Lines 220-226 bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp_sec2
220	// naming frames things that conflict with window properties that	220	// naming frames things that conflict with window properties that
221	// are in Moz but not IE. Since we have some of these, we have to do	221	// are in Moz but not IE. Since we have some of these, we have to do
222	// it the Moz way.	222	// it the Moz way.
223	if (thisObject->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))) {	223	if (thisObject->impl()->frame()->tree()->documentChild(identifierToAtomicString(propertyName))) {
224	slot.setCustom(thisObject, childFrameGetter);	224	slot.setCustom(thisObject, childFrameGetter);
225	return true;	225	return true;
226	}	226	}
Lines 244-250 bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identi a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp_sec3
244	// allow window[1] or parent[1] etc. (#56983)	244	// allow window[1] or parent[1] etc. (#56983)
245	bool ok;	245	bool ok;
246	unsigned i = propertyName.toArrayIndex(ok);	246	unsigned i = propertyName.toArrayIndex(ok);
247	if (ok && i < thisObject->impl()->frame()->tree()->childCount()) {	247	if (ok && i < thisObject->impl()->frame()->tree()->documentChildCount()) {
248	slot.setCustomIndex(thisObject, i, indexGetter);	248	slot.setCustomIndex(thisObject, i, indexGetter);
249	return true;	249	return true;
250	}	250	}
Lines 310-316 bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp_sec4
310	// naming frames things that conflict with window properties that	310	// naming frames things that conflict with window properties that
311	// are in Moz but not IE. Since we have some of these, we have to do	311	// are in Moz but not IE. Since we have some of these, we have to do
312	// it the Moz way.	312	// it the Moz way.
313	if (thisObject->impl()->frame()->tree()->child(identifierToAtomicString(propertyName))) {	313	if (thisObject->impl()->frame()->tree()->documentChild(identifierToAtomicString(propertyName))) {
314	PropertySlot slot;	314	PropertySlot slot;
315	slot.setCustom(thisObject, childFrameGetter);	315	slot.setCustom(thisObject, childFrameGetter);
316	descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly \| DontDelete \| DontEnum);	316	descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly \| DontDelete \| DontEnum);
Lines 319-325 bool JSDOMWindow::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, co a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp_sec5
319		319
320	bool ok;	320	bool ok;
321	unsigned i = propertyName.toArrayIndex(ok);	321	unsigned i = propertyName.toArrayIndex(ok);
322	if (ok && i < thisObject->impl()->frame()->tree()->childCount()) {	322	if (ok && i < thisObject->impl()->frame()->tree()->documentChildCount()) {
323	PropertySlot slot;	323	PropertySlot slot;
324	slot.setCustomIndex(thisObject, i, indexGetter);	324	slot.setCustomIndex(thisObject, i, indexGetter);
325	descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly \| DontDelete \| DontEnum);	325	descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly \| DontDelete \| DontEnum);

Lines 20-42 a/Source/WebCore/page/FrameTree.h_sec1
- a/Source/WebCore/page/FrameTree.h -3 / +17 lines
20	#ifndef FrameTree_h	20	#ifndef FrameTree_h
21	#define FrameTree_h	21	#define FrameTree_h
22		22
		23	#include <wtf/NotFound.h>
23	#include <wtf/text/AtomicString.h>	24	#include <wtf/text/AtomicString.h>
24		25
25	namespace WebCore {	26	namespace WebCore {
26		27
27	class Frame;	28	class Frame;
		29	class TreeScope;
28		30
29	class FrameTree {	31	class FrameTree {
30	WTF_MAKE_NONCOPYABLE(FrameTree);	32	WTF_MAKE_NONCOPYABLE(FrameTree);
31	public:	33	public:
		34	const static unsigned invalidCount = static_cast<unsigned>(WTF::notFound);
		35
32	FrameTree(Frame* thisFrame, Frame* parentFrame)	36	FrameTree(Frame* thisFrame, Frame* parentFrame)
33	: m_thisFrame(thisFrame)	37	: m_thisFrame(thisFrame)
34	, m_parent(parentFrame)	38	, m_parent(parentFrame)
35	, m_previousSibling(0)	39	, m_previousSibling(0)
36	, m_lastChild(0)	40	, m_lastChild(0)
37	, m_childCount(0)	41	, m_documentChildCount(invalidCount)
38	{	42	{
39	}	43	}
		44
40	~FrameTree();	45	~FrameTree();
41		46
42	const AtomicString& name() const { return m_name; }	47	const AtomicString& name() const { return m_name; }
Lines 50-56 namespace WebCore { a/Source/WebCore/page/FrameTree.h_sec2
50	Frame* previousSibling() const { return m_previousSibling; }	55	Frame* previousSibling() const { return m_previousSibling; }
51	Frame* firstChild() const { return m_firstChild.get(); }	56	Frame* firstChild() const { return m_firstChild.get(); }
52	Frame* lastChild() const { return m_lastChild; }	57	Frame* lastChild() const { return m_lastChild; }
53	unsigned childCount() const { return m_childCount; }
54		58
55	bool isDescendantOf(const Frame* ancestor) const;	59	bool isDescendantOf(const Frame* ancestor) const;
56	Frame* traverseNext(const Frame* stayWithin = 0) const;	60	Frame* traverseNext(const Frame* stayWithin = 0) const;
Lines 65-79 namespace WebCore { a/Source/WebCore/page/FrameTree.h_sec3
65	Frame* child(unsigned index) const;	69	Frame* child(unsigned index) const;
66	Frame* child(const AtomicString& name) const;	70	Frame* child(const AtomicString& name) const;
67	Frame* find(const AtomicString& name) const;	71	Frame* find(const AtomicString& name) const;
		72	unsigned childCount() const;
68		73
69	AtomicString uniqueChildName(const AtomicString& requestedName) const;	74	AtomicString uniqueChildName(const AtomicString& requestedName) const;
70		75
71	Frame* top(bool checkForDisconnectedFrame = false) const;	76	Frame* top(bool checkForDisconnectedFrame = false) const;
72		77
		78	Frame* documentChild(unsigned index) const;
		79	Frame* documentChild(const AtomicString& name) const;
		80	unsigned documentChildCount() const;
		81
73	private:	82	private:
74	Frame* deepLastChild() const;	83	Frame* deepLastChild() const;
75	void actuallyAppendChild(PassRefPtr<Frame>);	84	void actuallyAppendChild(PassRefPtr<Frame>);
76		85
		86	bool scopedBy(TreeScope*) const;
		87	Frame* scopedChild(unsigned index, TreeScope*) const;
		88	Frame* scopedChild(const AtomicString& name, TreeScope*) const;
		89	unsigned scopedChildCount(TreeScope*) const;
		90
77	Frame* m_thisFrame;	91	Frame* m_thisFrame;
78		92
79	Frame* m_parent;	93	Frame* m_parent;
Lines 85-91 namespace WebCore { a/Source/WebCore/page/FrameTree.h_sec4
85	Frame* m_previousSibling;	99	Frame* m_previousSibling;
86	RefPtr<Frame> m_firstChild;	100	RefPtr<Frame> m_firstChild;
87	Frame* m_lastChild;	101	Frame* m_lastChild;
88	unsigned m_childCount;	102	mutable unsigned m_documentChildCount;
89	};	103	};
90		104
91	} // namespace WebCore	105	} // namespace WebCore

Lines 1-3 a/LayoutTests/ChangeLog_sec1
- a/LayoutTests/ChangeLog +10 lines
		1	2012-02-22 MORITA Hajime <morrita@google.com>
		2
		3	This test checks select attribute of content element is valid.
		4	https://bugs.webkit.org/show_bug.cgi?id=65595
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* fast/dom/shadow/iframe-shadow-expected.txt: Added.
		9	* fast/dom/shadow/iframe-shadow.html: Added.
		10
1	2012-02-20 David Barton <dbarton@mathscribe.com>	11	2012-02-20 David Barton <dbarton@mathscribe.com>
2		12
3	RenderMathMLRow::baselinePosition() only if linePositionMode == PositionOnContainingLine	13	RenderMathMLRow::baselinePosition() only if linePositionMode == PositionOnContainingLine

Line 0 a/LayoutTests/fast/dom/shadow/iframe-shadow-expected.txt_sec1
- a/LayoutTests/fast/dom/shadow/iframe-shadow-expected.txt +23 lines
	1	This test ensures that iframe inside shadow isn't visible from the host document.
	2
	3	On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
	4
	5
	6	PASS window.length is 4
	7	PASS i0byname.length is 1
	8	PASS i0 is i0byname[0].contentWindow
	9	PASS i1.length is 2
	10	PASS window.length is 4
	11	PASS i2byname.length is 1
	12	PASS i2byname[0].contentWindow is i2
	13	PASS i3byname.length is 0
	14	PASS i3 is undefined
	15	PASS window.length is 3
	16	PASS document['i0'] is undefined
	17	PASS window.length is 4
	18	PASS document['i3'] is i3InShadow.contentWindow
	19	PASS successfullyParsed is true
	20
	21	TEST COMPLETE
	22
	23

Line 0 a/LayoutTests/fast/dom/shadow/iframe-shadow.html_sec1
- a/LayoutTests/fast/dom/shadow/iframe-shadow.html +71 lines
		1	<!DOCTYPE html>
		2	<html>
		3	<head>
		4	<script src="../../js/resources/js-test-pre.js"></script>
		5	</head>
		6	<body>
		7	<pre id="console"></pre>
		8	<iframe name="i0"></iframe>
		9	<iframe name="i1"></iframe>
		10	<iframe name="i1"></iframe>
		11	<iframe name="i2"></iframe>
		12
		13	<div id="host"></div>
		14
		15	<script>
		16
		17	description("This test ensures that iframe inside shadow isn't visible from the host document.");
		18
		19	// At first, check iframe in usual way
		20	shouldBe("window.length", "4");
		21	var i0 = document["i0"];
		22	var i0byname = document.getElementsByName("i0");
		23	shouldBe("i0byname.length", "1");
		24	shouldBe("i0", "i0byname[0].contentWindow");
		25
		26	var i1 = document["i1"];
		27	var i2byname = document.getElementsByName("i0");
		28	shouldBe("i1.length", "2");
		29
		30	// Then Adding some iframes into a shadow.
		31
		32	var host = document.getElementById("host");
		33	var shadow = new WebKitShadowRoot(host);
		34	var i2InShadow = document.createElement("iframe");
		35	i2InShadow.setAttribute("name", "i2");
		36	shadow.appendChild(i2InShadow);
		37
		38	var i3InShadow = document.createElement("iframe");
		39	i3InShadow.setAttribute("name", "i3");
		40	shadow.appendChild(i3InShadow);
		41
		42	shouldBe("window.length", "4");
		43
		44	var i2 = document["i2"];
		45	var i2byname = document.getElementsByName("i2");
		46	shouldBe("i2byname.length", "1");
		47	shouldBe("i2byname[0].contentWindow", "i2");
		48
		49	var i3 = document["i3"];
		50	var i3byname = document.getElementsByName("i3");
		51	shouldBe("i3byname.length", "0");
		52	shouldBe("i3", "undefined");
		53
		54	// Moving iframes across shadow boundary to ensure
		55	// That window.length and property availability are
		56	// correctly updated.
		57
		58	shadow.appendChild(i0.frameElement);
		59
		60	shouldBe("window.length", "3");
		61	shouldBe("document['i0']", "undefined");
		62
		63	document.body.appendChild(i3InShadow);
		64	shouldBe("window.length", "4");
65	shouldBe("document['i3']", "i3InShadow.contentWindow");
66
67	</script>
68
69	<script src="../../js/resources/js-test-post.js"></script>
70	</body>
71	</html>