window.event may get set on wrong global when dispatching an event.
Created attachment 413122 [details] WIP Patch
Created attachment 413163 [details] Patch
Created attachment 413165 [details] Patch
Comment on attachment 413165 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=413165&action=review > Source/WebCore/ChangeLog:9 > + 'current event', stating that global the 'listener callbackâs associated Realmâs global that global the => that global is the > Source/WebCore/bindings/js/JSDOMWindowBase.h:114 > + Event* m_currentEvent { nullptr }; Can we use RefPtr here? > Source/WebCore/bindings/js/JSErrorHandler.cpp:83 > + Event* savedEvent = nullptr; Can we use RefPtr here? > Source/WebCore/bindings/js/JSErrorHandler.cpp:86 > + jsFunctionWindow->currentEvent(); I think you meant to assign to savedEvent here? Seems like a bug. Might need a new test. > Source/WebCore/bindings/js/JSEventListener.cpp:166 > + Event* savedEvent = nullptr; Can we use RefPtr here?
Comment on attachment 413165 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=413165&action=review >> Source/WebCore/bindings/js/JSDOMWindowBase.h:114 >> + Event* m_currentEvent { nullptr }; > > Can we use RefPtr here? I am merely moving the code so this is not new. I think we can make it a RefPtr though, even if not strictly needed for safety.
Created attachment 413182 [details] Patch
Created attachment 413184 [details] Patch
Created attachment 413221 [details] Patch
Committed r269414: <https://trac.webkit.org/changeset/269414> All reviewed patches have been landed. Closing bug and clearing flags on attachment 413221 [details].
<rdar://problem/71060677>