| Summary: | document.open() event listener removal is not immediate | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Anne van Kesteren <annevk> | ||||
| Component: | DOM | Assignee: | Chris Dumez <cdumez> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | cdumez, commit-queue, darin, dbates, esprehn+autocc, ews-watchlist, ggaren, kangil.han, rniwa, sam, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
|
Description
Anne van Kesteren
2018-05-02 02:13:06 PDT
I believe the issue is that EventListenerMap::clear() clears m_entries but fails to call markAsRemoved() on each RegisteredEventListener. Therefore, if somebody already had a reference to the RegisteredEventListeners, it can still fire events at them. Yeah, that sounds similar to how the standard works. When you invoke removeEventListener() it both removes from the list and sets a removed flag that dispatch will take into account. I think this should work similar (and it does in Chrome and Firefox). Created attachment 339310 [details]
Patch
Comment on attachment 339310 [details] Patch Clearing flags on attachment: 339310 Committed r231248: <https://trac.webkit.org/changeset/231248> All reviewed patches have been landed. Closing bug. |