Only execute default actions on trusted events.

Source/core/events/EventDispatcher.cpp

Index: Source/core/events/EventDispatcher.cpp
diff --git a/Source/core/events/EventDispatcher.cpp b/Source/core/events/EventDispatcher.cpp
index 1cd6cd67a3a2bf89cb6cb9c2699dba3e0695282e..9bae23167fa3f3d5d8759026052af3b64339c45f 100644
--- a/Source/core/events/EventDispatcher.cpp
+++ b/Source/core/events/EventDispatcher.cpp
@@ -203,10 +203,14 @@ inline void EventDispatcher::dispatchEventPostProcess(void* preDispatchEventHand
     // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
     m_node->postDispatchEventHandler(m_event.get(), preDispatchEventHandlerResult);
 
+    // The DOM Events spec says that events dispatched by JS (other than "click")
+    // should not have their default handlers invoked.
+    bool isTrustedOrClick = !RuntimeEnabledFeatures::trustedEventsDefaultActionEnabled() || m_event->isTrusted() || (m_event->isMouseEvent() && toMouseEvent(*m_event).type() == EventTypeNames::click);
+
     // Call default event handlers. While the DOM does have a concept of preventing
     // default handling, the detail of which handlers are called is an internal
     // implementation detail and not part of the DOM.
-    if (!m_event->defaultPrevented() && !m_event->defaultHandled()) {
+    if (!m_event->defaultPrevented() && !m_event->defaultHandled() && isTrustedOrClick) {
         // Non-bubbling events call only one default event handler, the one for the target.
         m_node->willCallDefaultEventHandler(*m_event);
         m_node->defaultEventHandler(m_event.get());