ChangeLog

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"

        https://bugs.webkit.org/show_bug.cgi?id=86991

        Reviewed by Ojan Vafai.

        Original Chromium bug: http://code.google.com/p/chromium/issues/detail?id=128723

        Consider the following html:

        <html><body><form>

        <input type="hidden" name="arguments"></input>

        <div onclick="onclicked()" id="divInsideForm">Click here</div>

        </form></body>

        <script>

        function onclicked() {

          alert("onclicked");

        }

        </script>

        </html>

        If we click "Click here", JavaScript throws "Uncaught TypeError: undefined has no properties".

        This is a regression caused by r110315. V8LazyEventListener should not use

        'arguments' to retrieve the execution contexts, since 'arguments' can be

        being overwritten by JavaScript.

        This patch changes V8LazyEventListener so that it retrieves contexts

        by this.ownerDocument, this.form, and this.

        Test: fast/forms/form-input-named-arguments.html

        * bindings/v8/V8LazyEventListener.cpp:

        (WebCore::V8LazyEventListener::prepareListenerObject):

2012-05-21  Emil A Eklund  <eae@chromium.org>

        Move padding/margin/offset writing mode logic from RenderStyle to LengthBox

Source/WebCore/bindings/v8/V8LazyEventListener.cpp

@@void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)

    // FIXME: V8 does not allow us to programmatically create object environments so

    //        we have to do this hack! What if m_code escapes to run arbitrary script?

    //

    // Call with 4 arguments instead of 3, pass additional null as last parameter.

    // By calling the function with 4 arguments, we create a setter on arguments object

    // which would shadow property "3" on the prototype.

140143 String code = "(function() {" \

        "with (arguments[2]) {" \

        "with (arguments[1]) {" \

        "with (arguments[0]) {";

        "arguments[3] = function() {" \

        "with (this[2]) {" \

        "with (this[1]) {" \

        "with (this[0]) {";

    code.append("return function(");

    code.append(m_eventParameterName);

    code.append(") {");

    code.append(m_code);

    // Insert '\n' otherwise //-style comments could break the handler.

149 code.append("\n};}}}})");

153 code.append("\n};}}}}; return arguments[3]();})");

    v8::Handle<v8::String> codeExternalString = v8ExternalString(code);

    v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);

LayoutTests/ChangeLog

2012-05-20  Kentaro Hara  <haraken@chromium.org>

        REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"

        https://bugs.webkit.org/show_bug.cgi?id=86991

        Reviewed by Ojan Vafai.

        The added test checks whether an event handler is successfully invoked

        for an input element with name="arguments".

        * fast/forms/form-input-named-arguments-expected.txt: Added.

        * fast/forms/form-input-named-arguments.html: Added.

2012-05-21  Levi Weintraub  <leviw@chromium.org>

        Unreviewed. More rebaselines following r117815.

LayoutTests/fast/forms/form-input-named-arguments-expected.txt

onclicked() is successfully called.

PASS successfullyParsed is true

TEST COMPLETE

LayoutTests/fast/forms/form-input-named-arguments.html

<!DOCTYPE html>

<html>

<head></head>

<body>

<script src="../js/resources/js-test-pre.js"></script>

<form>

<input type="hidden" name="arguments"></input>

<div onclick="onclicked()" id="divInsideForm"></div>

</form>

</body>

<script>

if (window.layoutTestController)

  layoutTestController.waitUntilDone();

function onclicked() {

   debug("onclicked() is successfully called.");

   if (window.layoutTestController) {

     successfullyParsed = true;

     layoutTestController.notifyDone();

   }

}

var event = document.createEvent("MouseEvents");

event.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);

var div = document.getElementById("divInsideForm");

div.dispatchEvent(event);

</script>

<script src="../js/resources/js-test-post.js"></script>

</html>