Disallow shadowing of top since shadowing top can break frame-busting

code.

Also, make sure that top, window, location, and location.href are not
deletable.

I had to fix a couple of layout tests that rely on top being shadowable.
Review URL: http://codereview.chromium.org/9506

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4984 0039d316-1c4b-4281-b951-d872f2087c98

15 files changed, 340 insertions, 22 deletions

diff --git a/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/README b/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/README
index 4cecb0f..01ce92d 100644
--- a/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/README
+++ b/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/README
@@ -14,3 +14,10 @@ new-window-opener-expected.txt
 It is a time-sensitive test. Chrome passes all tests, Safari failed some,
 so the output expects some failures. Firefox sometimes passes all tests
 and sometimes fails some. Use Chrome's output as the baseline.
+
+window-property-shadowing
+-------------------------
+For security reasons, we do not allow window.top to be shadowed.  This
+is because Flash accesses top.location and allowing the user to shadow
+top.location might therefore break Flash security checks.
+
diff --git a/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/window-property-shadowing-expected.txt b/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/window-property-shadowing-expected.txt
new file mode 100644
index 0000000..231cec1
--- /dev/null
+++ b/webkit/data/layout_test_results/v8/LayoutTests/fast/dom/Window/window-property-shadowing-expected.txt
@@ -0,0 +1,167 @@
+PASS: locationbar successfully shadowed
+PASS: menubar successfully shadowed
+PASS: personalbar successfully shadowed
+PASS: statusbar successfully shadowed
+PASS: toolbar successfully shadowed
+PASS: devicePixelRatio successfully shadowed
+PASS: defaultStatus successfully shadowed
+PASS: defaultstatus successfully shadowed
+PASS: status successfully shadowed
+PASS: frames successfully shadowed
+PASS: event successfully shadowed
+PASS: innerHeight successfully shadowed
+PASS: innerWidth successfully shadowed
+PASS: length successfully shadowed
+PASS: name successfully shadowed
+PASS: navigator successfully shadowed
+PASS: clientInformation successfully shadowed
+PASS: offscreenBuffering successfully shadowed
+PASS: opener successfully shadowed
+PASS: outerHeight successfully shadowed
+PASS: outerWidth successfully shadowed
+PASS: parent successfully shadowed
+PASS: screenX successfully shadowed
+PASS: screenY successfully shadowed
+PASS: screenLeft successfully shadowed
+PASS: screenTop successfully shadowed
+PASS: scrollX successfully shadowed
+PASS: scrollY successfully shadowed
+PASS: self successfully shadowed
+FAIL: top was not shadowed
+PASS: getSelection successfully shadowed
+PASS: getComputedStyle successfully shadowed
+PASS: getMatchedCSSRules successfully shadowed
+PASS: atob successfully shadowed
+PASS: btoa successfully shadowed
+PASS: scroll successfully shadowed
+PASS: scrollBy successfully shadowed
+PASS: scrollTo successfully shadowed
+PASS: moveBy successfully shadowed
+PASS: moveTo successfully shadowed
+PASS: resizeBy successfully shadowed
+PASS: resizeTo successfully shadowed
+PASS: alert successfully shadowed
+PASS: confirm successfully shadowed
+PASS: prompt successfully shadowed
+PASS: open successfully shadowed
+PASS: print successfully shadowed
+PASS: setTimeout successfully shadowed
+PASS: clearTimeout successfully shadowed
+PASS: focus successfully shadowed
+PASS: blur successfully shadowed
+PASS: close successfully shadowed
+PASS: setInterval successfully shadowed
+PASS: clearInterval successfully shadowed
+PASS: captureEvents successfully shadowed
+PASS: releaseEvents successfully shadowed
+PASS: addEventListener successfully shadowed
+PASS: removeEventListener successfully shadowed
+PASS: showModalDialog successfully shadowed
+PASS: find successfully shadowed
+PASS: stop successfully shadowed
+PASS: Image successfully shadowed
+PASS: Option successfully shadowed
+PASS: DOMException successfully shadowed
+PASS: XMLHttpRequest successfully shadowed
+PASS: XSLTProcessor successfully shadowed
+PASS: StyleSheet successfully shadowed
+PASS: CSSStyleSheet successfully shadowed
+PASS: CSSValue successfully shadowed
+PASS: CSSPrimitiveValue successfully shadowed
+PASS: CSSValueList successfully shadowed
+PASS: CSSRule successfully shadowed
+PASS: CSSCharsetRule successfully shadowed
+PASS: CSSFontFaceRule successfully shadowed
+PASS: CSSImportRule successfully shadowed
+PASS: CSSMediaRule successfully shadowed
+PASS: CSSPageRule successfully shadowed
+PASS: CSSStyleRule successfully shadowed
+PASS: CSSStyleDeclaration successfully shadowed
+PASS: MediaList successfully shadowed
+PASS: Counter successfully shadowed
+PASS: CSSRuleList successfully shadowed
+PASS: Rect successfully shadowed
+PASS: DOMImplementation successfully shadowed
+PASS: DocumentFragment successfully shadowed
+PASS: Document successfully shadowed
+PASS: Node successfully shadowed
+PASS: NodeList successfully shadowed
+PASS: NamedNodeMap successfully shadowed
+PASS: CharacterData successfully shadowed
+PASS: Attr successfully shadowed
+PASS: Element successfully shadowed
+PASS: Text successfully shadowed
+PASS: Comment successfully shadowed
+PASS: CDATASection successfully shadowed
+PASS: DocumentType successfully shadowed
+PASS: Notation successfully shadowed
+PASS: Entity successfully shadowed
+PASS: EntityReference successfully shadowed
+PASS: ProcessingInstruction successfully shadowed
+PASS: HTMLDocument successfully shadowed
+PASS: HTMLElement successfully shadowed
+PASS: HTMLAnchorElement successfully shadowed
+PASS: HTMLAppletElement successfully shadowed
+PASS: HTMLAreaElement successfully shadowed
+PASS: HTMLBRElement successfully shadowed
+PASS: HTMLBaseElement successfully shadowed
+PASS: HTMLBaseFontElement successfully shadowed
+PASS: HTMLBlockquoteElement successfully shadowed
+PASS: HTMLBodyElement successfully shadowed
+PASS: HTMLButtonElement successfully shadowed
+PASS: HTMLCanvasElement successfully shadowed
+PASS: HTMLDListElement successfully shadowed
+PASS: HTMLDirectoryElement successfully shadowed
+PASS: HTMLDivElement successfully shadowed
+PASS: HTMLEmbedElement successfully shadowed
+PASS: HTMLFieldSetElement successfully shadowed
+PASS: HTMLFontElement successfully shadowed
+PASS: HTMLFormElement successfully shadowed
+PASS: HTMLFrameElement successfully shadowed
+PASS: HTMLFrameSetElement successfully shadowed
+PASS: HTMLHRElement successfully shadowed
+PASS: HTMLHeadElement successfully shadowed
+PASS: HTMLHeadingElement successfully shadowed
+PASS: HTMLHtmlElement successfully shadowed
+PASS: HTMLIFrameElement successfully shadowed
+PASS: HTMLImageElement successfully shadowed
+PASS: HTMLInputElement successfully shadowed
+PASS: HTMLIsIndexElement successfully shadowed
+PASS: HTMLLIElement successfully shadowed
+PASS: HTMLLabelElement successfully shadowed
+PASS: HTMLLegendElement successfully shadowed
+PASS: HTMLLinkElement successfully shadowed
+PASS: HTMLMapElement successfully shadowed
+PASS: HTMLMarqueeElement successfully shadowed
+PASS: HTMLMenuElement successfully shadowed
+PASS: HTMLMetaElement successfully shadowed
+PASS: HTMLModElement successfully shadowed
+PASS: HTMLOListElement successfully shadowed
+PASS: HTMLObjectElement successfully shadowed
+PASS: HTMLOptGroupElement successfully shadowed
+PASS: HTMLOptionElement successfully shadowed
+PASS: HTMLParagraphElement successfully shadowed
+PASS: HTMLParamElement successfully shadowed
+PASS: HTMLPreElement successfully shadowed
+PASS: HTMLQuoteElement successfully shadowed
+PASS: HTMLScriptElement successfully shadowed
+PASS: HTMLSelectElement successfully shadowed
+PASS: HTMLStyleElement successfully shadowed
+PASS: HTMLTableCaptionElement successfully shadowed
+PASS: HTMLTableCellElement successfully shadowed
+PASS: HTMLTableColElement successfully shadowed
+PASS: HTMLTableElement successfully shadowed
+PASS: HTMLTableRowElement successfully shadowed
+PASS: HTMLTableSectionElement successfully shadowed
+PASS: HTMLTextAreaElement successfully shadowed
+PASS: HTMLTitleElement successfully shadowed
+PASS: HTMLUListElement successfully shadowed
+PASS: Event successfully shadowed
+PASS: MutationEvent successfully shadowed
+PASS: NodeFilter successfully shadowed
+PASS: Range successfully shadowed
+PASS: RangeException successfully shadowed
+PASS: XMLDocument successfully shadowed
+PASS: DOMParser successfully shadowed
+PASS: XMLSerializer successfully shadowed
+
diff --git a/webkit/data/layout_tests/chrome/editing/selection/click-before-and-after-table-expected.txt b/webkit/data/layout_tests/chrome/editing/selection/click-before-and-after-table-expected.txt
new file mode 100644
index 0000000..7e150aa
--- /dev/null
+++ b/webkit/data/layout_tests/chrome/editing/selection/click-before-and-after-table-expected.txt
@@ -0,0 +1,12 @@
+EDITING DELEGATE: shouldBeginEditingInDOMRange:range from 0 of BODY > HTML > #document to 7 of BODY > HTML > #document
+EDITING DELEGATE: webViewDidBeginEditing:WebViewDidBeginEditingNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:(null) toDOMRange:range from 1 of BODY > HTML > #document to 1 of BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 1 of BODY > HTML > #document to 1 of BODY > HTML > #document toDOMRange:range from 8 of #text > TD > TR > TBODY > TABLE > BODY > HTML > #document to 8 of #text > TD > TR > TBODY > TABLE > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 8 of #text > TD > TR > TBODY > TABLE > BODY > HTML > #document to 8 of #text > TD > TR > TBODY > TABLE > BODY > HTML > #document toDOMRange:range from 0 of BODY > HTML > #document to 0 of BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+EDITING DELEGATE: shouldChangeSelectedDOMRange:range from 0 of BODY > HTML > #document to 0 of BODY > HTML > #document toDOMRange:range from 0 of TD > TR > TBODY > TABLE > BODY > HTML > #document to 0 of TD > TR > TBODY > TABLE > BODY > HTML > #document affinity:NSSelectionAffinityDownstream stillSelecting:FALSE
+EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
+cell one	cell two
+
diff --git a/webkit/data/layout_tests/chrome/editing/selection/click-before-and-after-table.html b/webkit/data/layout_tests/chrome/editing/selection/click-before-and-after-table.html
new file mode 100644
index 0000000..eff7fc8
--- /dev/null
+++ b/webkit/data/layout_tests/chrome/editing/selection/click-before-and-after-table.html
@@ -0,0 +1,77 @@
+<script>
+if (window.layoutTestController)
+     layoutTestController.dumpEditingCallbacks();
+</script>
+<style>
+td {
+    border: 1px solid #aaa;
+}
+</style>
+
+<body onload="runTest()" style="border: 1px solid red;" contenteditable="true"><table id="table" style="margin: 25px; border:10px solid #ccc; padding: 10px;"><tr><td>cell one</td><td>cell two</td></tr></table>
+<ul id="console"></ul>
+<script>
+function log(message) {
+    var console = document.getElementById("console");
+    var li = document.createElement("li");
+    var text = document.createTextNode(message);
+    
+    console.appendChild(li);
+    li.appendChild(text);
+}
+function runTest() {
+  if (!window.layoutTestController)
+      log("This test uses the eventSender to do mouse clicks.  To run it manually, click after the table, the caret should appear there (and not inside the table).  Then click inside the table.  The caret should appear inside it.");
+  else {
+      window.layoutTestController.dumpAsText();
+      var s, x, y, e, top, bottom, left, right;
+      table = document.getElementById("table");
+  
+      top = table.offsetTop;
+      left = table.offsetLeft;
+      bottom = top + table.offsetHeight;
+      right = left + table.offsetWidth;
+      
+      x = right + 5;
+      y = (top + bottom) / 2;
+      eventSender.mouseMoveTo(x, y);
+      eventSender.mouseDown();
+      eventSender.mouseUp();
+      s = window.getSelection();
+      if (!(s.anchorNode == document.body && s.anchorOffset == 1))
+          log("Failure: Clicking after the table didn't put the caret after it.");
+      
+      x = right - 5;
+      y = (top + bottom) / 2;
+      eventSender.leapForward(1000);
+      eventSender.mouseMoveTo(x, y);
+      eventSender.mouseDown();
+      eventSender.mouseUp();
+      s = window.getSelection();
+      if (s.anchorNode == document.body)
+          log("Failure: Clicking inside the table put the caret before or after it.");
+          
+      x = left - 5;
+      y = (top + bottom) / 2;
+      eventSender.leapForward(1000);
+      eventSender.mouseMoveTo(x, y);
+      eventSender.mouseDown();
+      eventSender.mouseUp();
+      s = window.getSelection();
+      if (s.anchorNode != table || s.anchorOffset != 0)
+      if (!(s.anchorNode == document.body && s.anchorOffset == 0))
+          log("Failure: Clicking before the table should be the caret before it.");
+          
+      x = left + 5;
+      y = (top + bottom) / 2;
+      eventSender.leapForward(1000);
+      eventSender.mouseMoveTo(x, y);
+      eventSender.mouseDown();
+      eventSender.mouseUp();
+      s = window.getSelection();
+      if (s.anchorNode == document.body)
+          log("Failure: Clicking inside the table put the caret before or after it.");
+  }
+}
+</script>
+</body>
diff --git a/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt
index b9dad28..ee1e22ff 100644
--- a/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt
+++ b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt
@@ -6,4 +6,9 @@ PASS
 PASS
 PASS
 PASS
+PASS
+PASS
+PASS
+PASS
+PASS
 
diff --git a/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html
index 34f9b04..1b5c0aa 100644
--- a/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html
+++ b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html
@@ -39,6 +39,11 @@ function testFunctionOverwrite() {
   for (var i = 0; i < locationFunctions.length; i++) {
     location[locationFunctions[i]] = overwrite;
     check(location[locationFunctions[i]] != overwrite);
+    delete location[locationFunctions[i]];
+    location[locationFunctions[i]] = overwrite;
+    check(location[locationFunctions[i]] != overwrite);
+    location.__defineGetter__(locationFunctions[i], failIfCalled);
+    location[locationFunctions[i]];
   }
 }
 
@@ -51,12 +56,18 @@ function testAccessorOverwrite() {
   window.location;
   this.__defineGetter__("location", failIfCalled);
   this.location;
+  delete location;
+  __defineGetter__("location", failIfCalled);
+  location;
 }
 
 
 function testHrefOverwrite() {
   location.__defineGetter__("href", failIfCalled);
   location.href;
+  delete location.href;
+  location.__defineGetter__("href", failIfCalled);
+  location.href;
 }
 
 function testVarShadowing() {
diff --git a/webkit/data/layout_tests/chrome/fast/dom/resources/window-shadowing-inner.html b/webkit/data/layout_tests/chrome/fast/dom/resources/window-shadowing-inner.html
index 36559a9..9b7cced 100644
--- a/webkit/data/layout_tests/chrome/fast/dom/resources/window-shadowing-inner.html
+++ b/webkit/data/layout_tests/chrome/fast/dom/resources/window-shadowing-inner.html
@@ -4,6 +4,8 @@
 var overwrite = {};
 var window = overwrite;
 top.check(window != overwrite);
+var top = overwrite;
+top.check(top != overwrite);
 top.notifyDone();
 </script>
 </body>
diff --git a/webkit/data/layout_tests/chrome/fast/dom/window-shadowing-expected.txt b/webkit/data/layout_tests/chrome/fast/dom/window-shadowing-expected.txt
index 90e59c7..c7483a3 100644
--- a/webkit/data/layout_tests/chrome/fast/dom/window-shadowing-expected.txt
+++ b/webkit/data/layout_tests/chrome/fast/dom/window-shadowing-expected.txt
@@ -1,4 +1,5 @@
-Test that the window attribute cannot be overwritten by var declarations or accessors defined using __defineGetter__ and __defineSetter__.
+Test that the window and top attributes cannot be overwritten by var declarations or accessors defined using __defineGetter__ and __defineSetter__. Flash accesses top.location and window.location and for security needs to see the actual location.
 
 PASS
+PASS
 
diff --git a/webkit/data/layout_tests/chrome/fast/dom/window-shadowing.html b/webkit/data/layout_tests/chrome/fast/dom/window-shadowing.html
index 2237e9a..fa5bab7 100644
--- a/webkit/data/layout_tests/chrome/fast/dom/window-shadowing.html
+++ b/webkit/data/layout_tests/chrome/fast/dom/window-shadowing.html
@@ -2,7 +2,10 @@
 <body onload="test()">
 <div id='result'>
 <p>
-Test that the window attribute cannot be overwritten by var declarations or accessors defined using __defineGetter__ and __defineSetter__.
+Test that the window and top attributes cannot be overwritten by var
+declarations or accessors defined using __defineGetter__ and
+__defineSetter__.  Flash accesses top.location and window.location and
+for security needs to see the actual location.
 </p>
 </div>
 <iframe id="testFrame"></iframe>
@@ -32,7 +35,7 @@ var overwrite = { location: 'ick' };
 
 function failIfCalled() { check(false); }
 
-function testAccessorOverwrite() {
+function testWindowAccessorOverwrite() {
   __defineGetter__("window", failIfCalled);
   window;
   window.__defineGetter__("window", failIfCalled);
@@ -45,6 +48,28 @@ function testAccessorOverwrite() {
   window.window = overwrite;
   this.__defineSetter__("window", failIfCalled);
   this.window = overwrite;
+  delete window;
+  __defineGetter__("window", failIfCalled);
+  window;
+}
+
+function testTopAccessorOverwrite() {
+  __defineGetter__("top", failIfCalled);
+  top;
+  window.__defineGetter__("top", failIfCalled);
+  window.top;
+  this.__defineGetter__("top", failIfCalled);
+  this.top;
+  __defineSetter__("top", failIfCalled);
+  top = overwrite;
+  window.__defineSetter__("top", failIfCalled);
+  window.top = overwrite;
+  this.__defineSetter__("top", failIfCalled);
+  this.top = overwrite;
+  delete top;
+  __defineGetter__("top", failIfCalled);
+  top;
+
 }
 
 function testVarShadowing() {
@@ -52,7 +77,8 @@ function testVarShadowing() {
 }
 
 function test() {
-  testAccessorOverwrite();
+  testWindowAccessorOverwrite();
+  testTopAccessorOverwrite();
   testVarShadowing();
 }
 </script>
diff --git a/webkit/data/layout_tests/chrome/fast/forms/style-display-none.html b/webkit/data/layout_tests/chrome/fast/forms/style-display-none.html
index bea0a4a..10dce0d 100644
--- a/webkit/data/layout_tests/chrome/fast/forms/style-display-none.html
+++ b/webkit/data/layout_tests/chrome/fast/forms/style-display-none.html
@@ -10,9 +10,9 @@ document.writeln("<div  id=\"result\"> \r\n  This test: FAILED </div>\r\n");
 document.writeln("<div  id=\"announce:Top\">\r\n This text should be hidden </div>\r\n");
 
 with(document) {
-  	var top = getElementById("announce:Top");
-	top.style.display = "none";
-	if ( top.style.display == "none" )
+  	var announceTop = getElementById("announce:Top");
+	announceTop.style.display = "none";
+	if ( announceTop.style.display == "none" )
 	  { getElementById("result").innerHTML=' This test: PASSED!'}
    
 } 
@@ -20,4 +20,4 @@ with(document) {
 </script>
 
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/webkit/port/bindings/scripts/CodeGeneratorV8.pm b/webkit/port/bindings/scripts/CodeGeneratorV8.pm
index f20e486..b8fbe70 100644
--- a/webkit/port/bindings/scripts/CodeGeneratorV8.pm
+++ b/webkit/port/bindings/scripts/CodeGeneratorV8.pm
@@ -874,10 +874,13 @@ sub GenerateBatchedAttributeData
     my $setter;
     my $propAttr = "v8::None";
 
-    # Check enumerability.
-    if ($attribute->signature->extendedAttributes->{"DontEnum"}) {
+    # Check attributes.
+    if ($attrExt->{"DontEnum"}) {
       $propAttr .= "|v8::DontEnum";
     }
+    if ($attrExt->{"DontDelete"}) {
+      $propAttr .= "|v8::DontDelete";
+    }
 
     my $on_proto = "0 /* on instance */";
     my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
@@ -1159,10 +1162,7 @@ END
       my $attrExt = $function->signature->extendedAttributes;
       my $name = $function->signature->name;
 
-      my $property_attributes = "v8::None";
-      if (!$attrExt->{"DontDelete"}) {
-        $property_attributes .= "|v8::DontDelete";
-      }
+      my $property_attributes = "v8::DontDelete";
       if ($attrExt->{"DontEnum"}) {
         $property_attributes .= "|v8::DontEnum";
       }
@@ -1193,7 +1193,6 @@ END
         #
         # The solution is very hacky and fragile, it really needs to be replaced
         # by a better solution.
-
         $property_attributes .= "|v8::ReadOnly";
         push(@implContent, <<END);
 
@@ -1214,7 +1213,6 @@ END
         $signature = "v8::Local<v8::Signature>()";
       }
 
-
       if (RequiresCustomSignature($function)) {
         $signature = "${name}_signature";
         push(@implContent, "\n  // Custom Signature '$name'\n", CreateCustomSignature($function));
@@ -1222,6 +1220,8 @@ END
 
       # Normal function call is a template
       my $templateFunction = GenerateNewFunctionTemplate($function, $dataNode, $signature);
+
+
       push(@implContent, <<END);
 
   // $commentInfo
diff --git a/webkit/port/page/DOMWindow.idl b/webkit/port/page/DOMWindow.idl
index a667251..2b4c483 100644
--- a/webkit/port/page/DOMWindow.idl
+++ b/webkit/port/page/DOMWindow.idl
@@ -52,7 +52,7 @@ module window {
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable, v8referenceattr=navigator] Navigator clientInformation;
-        attribute [DoNotCheckDomainSecurity, CustomSetter, v8DisallowShadowing] Location location;
+        attribute [DoNotCheckDomainSecurity, CustomSetter, DontDelete, v8DisallowShadowing] Location location;
 
         DOMSelection getSelection();
 
@@ -116,7 +116,7 @@ module window {
 
         // Self referential attributes
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow self;
-        readonly attribute [DoNotCheckDomainSecurity, v8DisallowShadowing] DOMWindow window;
+        readonly attribute [DoNotCheckDomainSecurity, DontDelete, v8DisallowShadowing] DOMWindow window;
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow frames;
 
 #if defined(V8_BINDING)
@@ -125,7 +125,7 @@ module window {
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow opener;
 #endif
         attribute [Replaceable, DoNotCheckDomainSecurity] DOMWindow parent;
-        attribute [Replaceable, DoNotCheckDomainSecurity] DOMWindow top;
+        readonly attribute [DoNotCheckDomainSecurity, DontDelete, v8DisallowShadowing] DOMWindow top;
 
         // DOM Level 2 AbstractView Interface
         readonly attribute Document document;
diff --git a/webkit/port/page/Location.idl b/webkit/port/page/Location.idl
index e33a694..5432208 100644
--- a/webkit/port/page/Location.idl
+++ b/webkit/port/page/Location.idl
@@ -7,7 +7,7 @@ module core {
     attribute DOMString hash;
     attribute DOMString host;
     attribute DOMString hostname;
-    attribute [DoNotCheckDomainSecurityOnSet, v8DisallowShadowing] DOMString href;
+    attribute [DoNotCheckDomainSecurityOnSet, DontDelete, v8DisallowShadowing] DOMString href;
     attribute DOMString pathname;
     attribute DOMString port;
     attribute DOMString protocol;
diff --git a/webkit/tools/layout_tests/test_lists/mac/tests_ignored.txt b/webkit/tools/layout_tests/test_lists/mac/tests_ignored.txt
index dae9910..f392d06 100644
--- a/webkit/tools/layout_tests/test_lists/mac/tests_ignored.txt
+++ b/webkit/tools/layout_tests/test_lists/mac/tests_ignored.txt
@@ -168,6 +168,11 @@ V8 # LayoutTests/fast/js/date-proto-generic-invocation.html = FAIL
 V8 # LayoutTests/fast/js/kde/function.html = FAIL
 V8 # LayoutTests/fast/js/kde/inbuilt_function_tostring.html = FAIL
 
+// These tests have been rewritten, with the original being ignored,
+// because they rely on being able to shadow the 'top' variable on the
+// global object.  For security we disallow shadowing of top.
+V8 # LayoutTests/editing/selection/click-before-and-after-table.html = FAIL
+
 // Bug 849085: we're taking a different approach on this test than 
 // Webkit does.
 KJS | V8 # SKIP : LayoutTests/plugins/get-url-with-blank-target.html = FAIL
diff --git a/webkit/tools/layout_tests/test_lists/win/tests_ignored.txt b/webkit/tools/layout_tests/test_lists/win/tests_ignored.txt
index 0e547f6..99a8433 100644
--- a/webkit/tools/layout_tests/test_lists/win/tests_ignored.txt
+++ b/webkit/tools/layout_tests/test_lists/win/tests_ignored.txt
@@ -165,6 +165,12 @@ V8 # LayoutTests/fast/js/date-proto-generic-invocation.html = FAIL
 V8 # LayoutTests/fast/js/kde/function.html = FAIL
 V8 # LayoutTests/fast/js/kde/inbuilt_function_tostring.html = FAIL
 
+
+// These tests have been rewritten, with the original being ignored,
+// because they rely on being able to shadow the 'top' variable on the
+// global object.  For security we disallow shadowing of top.
+V8 # LayoutTests/editing/selection/click-before-and-after-table.html = FAIL
+
 // Bug 849085: we're taking a different approach on this test than 
 // Webkit does.
 KJS | V8 # SKIP : LayoutTests/plugins/get-url-with-blank-target.html = FAIL
@@ -172,7 +178,6 @@ KJS | V8 # SKIP : LayoutTests/plugins/get-url-with-blank-target.html = FAIL
 // This test doesn't work on the bbot.  Works locally.
 KJS | V8 # SKIP : chrome/http/tests/plugins/get-file-url.html = FAIL | PASS | TIMEOUT
 
-
 // These tests tests V8 bindings only, KJS needs to re-baseline the output.
 // See Bug 1205552
 KJS # SKIP : chrome/fast/dom/set-document-body-no-crash.html = FAIL
@@ -182,4 +187,4 @@ KJS # SKIP : chrome/fast/dom/set-table-head-no-crash.html = FAIL
 KJS | V8 # SKIP : LayoutTests/fast/css/dashboard-region-parser.html = FAIL
 
 // Not a test?
-KJS | V8 # SKIP : LayoutTests/http/tests/incremental/pause-in-script-element.pl = FAIL
\ No newline at end of file
+KJS | V8 # SKIP : LayoutTests/http/tests/incremental/pause-in-script-element.pl = FAIL