[Replaceable] attributes must be readonly

Source/core/page/DOMWindow.idl

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 164 matching lines @@
     [MeasureAs=UnprefixedRequestAnimationFrame] long requestAnimationFrame(RequestAnimationFrameCallback callback);
     void cancelAnimationFrame(long id);
     [MeasureAs=PrefixedRequestAnimationFrame] long webkitRequestAnimationFrame(RequestAnimationFrameCallback callback);
     [ImplementedAs=cancelAnimationFrame] void webkitCancelAnimationFrame(long id);
     [ImplementedAs=cancelAnimationFrame] void webkitCancelRequestAnimationFrame(long id); // This is a deprecated alias for webkitCancelAnimationFrame(). Remove this when removing vendor prefix.
 
     // Base64
     [RaisesException] DOMString atob([TreatNullAs=NullString,Default=Undefined] optional DOMString string);
     [RaisesException] DOMString btoa([TreatNullAs=NullString,Default=Undefined] optional DOMString string);
 
-    [Replaceable] attribute DOMWindowCSS CSS;
+    [Replaceable] readonly attribute DOMWindowCSS CSS;
 
     // Events
     attribute EventListener onabort;
     attribute EventListener onbeforeunload;
     attribute EventListener onblur;
     attribute EventListener oncanplay;
     attribute EventListener oncanplaythrough;
     attribute EventListener onchange;
     attribute EventListener onclick;
     attribute EventListener oncontextmenu;
@@ skipping 550 matching lines @@
     attribute MutationRecordConstructor MutationRecord;
 
     [EnabledAtRuntime=mediaSource] attribute MediaSourceConstructor WebKitMediaSource;
     [EnabledAtRuntime=mediaSource] attribute SourceBufferConstructor WebKitSourceBuffer;
     [EnabledAtRuntime=mediaSource] attribute SourceBufferListConstructor WebKitSourceBufferList;
 
     // window.toString() requires special handling in V8
     [DoNotCheckSignature, DoNotCheckSecurity, Custom, NotEnumerable] DOMString toString();
 };