Bug 218546 – window.event may get set on wrong global when dispatching an event

• Component: DOM
• Status: RESOLVED FIXED

[Chris Dumez]

window.event may get set on wrong global when dispatching an event.

[Chris Dumez]

Created attachment 413122 [details]
WIP Patch

[Chris Dumez]

Created attachment 413163 [details]
Patch

[Chris Dumez]

Created attachment 413165 [details]
Patch

[Geoffrey Garen]

Comment on attachment 413165 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=413165&action=review

> Source/WebCore/ChangeLog:9
> +        'current event', stating that global the 'listener callbackâs associated Realmâs global

that global the => that global is the

> Source/WebCore/bindings/js/JSDOMWindowBase.h:114
> +    Event* m_currentEvent { nullptr };

Can we use RefPtr here?

> Source/WebCore/bindings/js/JSErrorHandler.cpp:83
> +        Event* savedEvent = nullptr;

Can we use RefPtr here?

> Source/WebCore/bindings/js/JSErrorHandler.cpp:86
> +            jsFunctionWindow->currentEvent();

I think you meant to assign to savedEvent here? Seems like a bug. Might need a new test.

> Source/WebCore/bindings/js/JSEventListener.cpp:166
> +    Event* savedEvent = nullptr;

Can we use RefPtr here?

[Chris Dumez]

Comment on attachment 413165 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=413165&action=review

>> Source/WebCore/bindings/js/JSDOMWindowBase.h:114
>> +    Event* m_currentEvent { nullptr };
> 
> Can we use RefPtr here?

I am merely moving the code so this is not new. I think we can make it a RefPtr though, even if not strictly needed for safety.

[Chris Dumez]

Created attachment 413182 [details]
Patch

[Chris Dumez]

Created attachment 413184 [details]
Patch

[Chris Dumez]

Created attachment 413221 [details]
Patch

[EWS]

Committed r269414: <https://trac.webkit.org/changeset/269414>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 413221 [details].

[Radar WebKit Bug Importer]

<rdar://problem/71060677>