Protect readystatechange event dispatch on XMLHttpRequest.

Source/core/xmlhttprequest/XMLHttpRequestProgressEventThrottle.cpp

 /*
  * Copyright (C) 2010 Julien Chaffraix <jchaffraix@webkit.org>  All right reserved.
  * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 10 matching lines @@
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "core/xmlhttprequest/XMLHttpRequestProgressEventThrottle.h"
 
 #include "core/EventTypeNames.h"
-#include "core/events/EventTarget.h"
+#include "core/xmlhttprequest/XMLHttpRequest.h"
 #include "core/xmlhttprequest/XMLHttpRequestProgressEvent.h"
 #include "wtf/Assertions.h"
 #include "wtf/text/AtomicString.h"
 
 namespace blink {
 
 class XMLHttpRequestProgressEventThrottle::DeferredEvent {
 public:
     DeferredEvent() { clear(); }
     void set(bool lengthComputable, unsigned long long loaded, unsigned long long total)
@@ skipping 17 matching lines @@
 
 private:
     unsigned long long m_loaded;
     unsigned long long m_total;
     bool m_isDeferred;
     bool m_lengthComputable;
 };
 
 const double XMLHttpRequestProgressEventThrottle::minimumProgressEventDispatchingIntervalInSeconds = .05; // 50 ms per specification.
 
-XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle(EventTarget* target)
+XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle(XMLHttpRequest* target)
     : m_target(target)
     , m_deferred(adoptPtr(new DeferredEvent))
 {
     ASSERT(target);
 }
 
 XMLHttpRequestProgressEventThrottle::~XMLHttpRequestProgressEventThrottle()
 {
 }
 
 void XMLHttpRequestProgressEventThrottle::dispatchProgressEvent(const AtomicString& type, bool lengthComputable, unsigned long long loaded, unsigned long long total)
 {
     // Given that ResourceDispatcher doesn't deliver an event when suspended,
     // we don't have to worry about event dispatching while suspended.
     if (type != EventTypeNames::progress) {
         m_target->dispatchEvent(XMLHttpRequestProgressEvent::create(type, lengthComputable, loaded, total));
         return;
     }
 
     if (isActive()) {
         m_deferred->set(lengthComputable, loaded, total);
     } else {
         m_target->dispatchEvent(XMLHttpRequestProgressEvent::create(type, lengthComputable, loaded, total));
         startOneShot(minimumProgressEventDispatchingIntervalInSeconds, FROM_HERE);
     }
 }
 
 void XMLHttpRequestProgressEventThrottle::dispatchReadyStateChangeEvent(PassRefPtrWillBeRawPtr<Event> event, DeferredEventAction action)
 {
+    XMLHttpRequest::State state = m_target->readyState();
     // Given that ResourceDispatcher doesn't deliver an event when suspended,
     // we don't have to worry about event dispatching while suspended.
     if (action == Flush) {
         dispatchDeferredEvent();
+        // |m_target| is protected by the caller.
         stop();
     } else if (action == Clear) {
         m_deferred->clear();
         stop();
     }
 
-    m_target->dispatchEvent(event);
+    if (state == m_target->readyState()) {
+        // We don't dispatch the event when an event handler associated with

[sof, 2015/06/29 11:00:27]

This repeats in prose what the check above does; it would be more interesting to
state why.

[yhirano, 2015/06/29 11:43:47]

Done.

+        // the previously dispatched event changes the readyState.
+        m_target->dispatchEvent(event);
+    }
 }
 
 void XMLHttpRequestProgressEventThrottle::dispatchDeferredEvent()
 {
     if (m_deferred->isDeferred()) {
         m_target->dispatchEvent(XMLHttpRequestProgressEvent::create(EventTypeNames::progress, m_deferred->lengthComputable(), m_deferred->loaded(), m_deferred->total()));
         m_deferred->clear();
     }
 }
 
@@ skipping 26 matching lines @@
     // event-handler could insert new active DOM objects to the list.
     startOneShot(0, FROM_HERE);
 }
 
 DEFINE_TRACE(XMLHttpRequestProgressEventThrottle)
 {
     visitor->trace(m_target);
 }
 
 } // namespace blink