[JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements
https://bugs.webkit.org/show_bug.cgi?id=105775

Reviewed by Sam Weinig.

Source/WebCore: 

Fixed the bug by respecting properties on ancestor classes.

Test: fast/dom/collection-length-should-not-be-overridden.html

* bindings/js/JSDOMBinding.h:
(WebCore::getStaticValueSlotEntryWithoutCaching): Added.
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateGetOwnPropertySlotBody): Use getStaticValueSlotEntryWithoutCaching to climb up the class
hierarchy.

LayoutTests: 

Added a regression tests for all known HTMLCollection sublcasses except HTMLNameCollection,
which is used only to implement named getters on window and document objects and HTMLPropertiesCollection
since it's not enabled on all ports yet.

* fast/dom/collection-length-should-not-be-overridden-expected.txt: Added.
* fast/dom/collection-length-should-not-be-overridden.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139278 268f45cc-cd09-0410-ab3c-d52691b4dbfc