Bug 106522
| Summary: | [JSC] Author script cannot override HTMLCollection’s methods | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> |
| Component: | DOM | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | abarth, a.renevier, arv, barraclough, eoconnor, fpizlo, haraken, sam, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Ryosuke Niwa
Say collection is a HTMLCollection, then:
collection.namedItem = 10;
alert(collection.namedItem === 10);
alerts false because collection.namedItem is still the builtin method.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/12986718>
Ryosuke Niwa
Turned out this isn't as trivial as I had hoped it to be.
The trickiness comes from the fact JSHTMLCollection's subclasses have their own name getter implementations. Because of this, we can't call Base::getOwnPropertySlot in JSHTMLCollection's subclasses because that'll end up invoking JSHTMLCollection's name getter implementation.
Discussing the issue with Gavin and Filip, we came up a solution like this:
1. Add a virtual method like postGetOwnPropertySlot, which deals with name getters and remove the name getter code from getOwnPropertySlot.
2. get() will, in addition to going through getOwnPropertySlot, will call postGetOwnPropertySlot at the very end if earlier calls to getOwnPropertySlot had not returned a value.