There is no difference in functionality between JSC and V8.
These IDL attributes enforce proper cross-domain security checking for the History object. JSC implements this as part of its CustomGetOwnPropertySlot; v8 does this by using CheckDomainSecurity, allowing access specifically to back(), forward(), and go().
Both pass the layout tests.
Created attachment 28364 [details]
Comment on attachment 28364 [details]
Looks good to me. Sam should see this pass by, but I expect he agrees with me. :)