Skipping mouseenter/over/out/leave on deleted nodes.

Source/core/input/EventHandler.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2012 Digia Plc. and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 80 matching lines @@
 #include "platform/heap/Handle.h"
 #include "platform/scroll/ScrollAnimator.h"
 #include "platform/scroll/Scrollbar.h"
 #include "wtf/Assertions.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/TemporaryChange.h"
 
 namespace blink {
 
+namespace {
+
+bool isNodeInDocument(Node* n)
+{
+    return n && n->inDocument();
+}
+
+}
+
 using namespace HTMLNames;
 
 // The link drag hysteresis is much larger than the others because there
 // needs to be enough space to cancel the link press without starting a link drag,
 // and because dragging links is rare.
 static const int LinkDragHysteresis = 40;
 static const int ImageDragHysteresis = 5;
 static const int TextDragHysteresis = 3;
 static const int GeneralDragHysteresis = 3;
 
@@ skipping 1408 matching lines @@
 
         m_lastNodeUnderMouse = m_nodeUnderMouse;
     }
 }
 
 void EventHandler::sendMouseEventsForNodeTransition(Node* exitedNode, Node* enteredNode, const PlatformMouseEvent& mouseEvent)
 {
     ASSERT(exitedNode != enteredNode);
 
     // First, dispatch mouseout event (which bubbles to ancestors)
-    if (exitedNode)
+    if (isNodeInDocument(exitedNode))
         exitedNode->dispatchMouseEvent(mouseEvent, EventTypeNames::mouseout, 0, enteredNode);
 
     // A note on mouseenter and mouseleave: These are non-bubbling events, and they are dispatched if there
     // is a capturing event handler on an ancestor or a normal event handler on the element itself. This special
     // handling is necessary to avoid O(n^2) capturing event handler checks.
     //
     //   Note, however, that this optimization can possibly cause some unanswered/missing/redundant mouseenter or
     // mouseleave events in certain contrived eventhandling scenarios, e.g., when:
     // - the mouseleave handler for a node sets the only capturing-mouseleave-listener in its ancestor, or
     // - DOM mods in any mouseenter/mouseleave handler changes the common ancestor of exited & entered nodes, etc.
     // We think the spec specifies a "frozen" state to avoid such corner cases (check the discussion on "candidate event
     // listeners" at http://www.w3.org/TR/uievents), but our code below preserves one such behavior from past only to
     // match Firefox and IE behavior.
     //
     // TODO(mustaq): Confirm spec conformance, double-check with other browsers.
 
     // Create lists of all exited/entered ancestors.
     WillBeHeapVector<RefPtrWillBeMember<Node>, 32> exitedAncestors;
     WillBeHeapVector<RefPtrWillBeMember<Node>, 32> enteredAncestors;
-    if (exitedNode) {
+    if (isNodeInDocument(exitedNode)) {
         exitedNode->updateDistribution();
         for (Node* node = exitedNode; node; node = ComposedTreeTraversal::parent(*node)) {
             exitedAncestors.append(node);
         }
     }
-    if (enteredNode) {
+    if (isNodeInDocument(enteredNode)) {
         enteredNode->updateDistribution();
         for (Node* node = enteredNode; node; node = ComposedTreeTraversal::parent(*node)) {
             enteredAncestors.append(node);
         }
     }
 
     size_t numExitedAncestors = exitedAncestors.size();
     size_t numEnteredAncestors = enteredAncestors.size();
 
     // Locate the common ancestor in the two lists. Start with the assumption that it's off both the lists.
@@ skipping 18 matching lines @@
             exitedNodeHasCapturingAncestor = true;
     }
 
     // Send mouseleave events to appropriate exited ancestors, in child-to-parent order.
     for (size_t j = 0; j < exitedAncestorIndex; j++) {
         if (exitedNodeHasCapturingAncestor || exitedAncestors[j]->hasEventListeners(EventTypeNames::mouseleave))
             exitedAncestors[j]->dispatchMouseEvent(mouseEvent, EventTypeNames::mouseleave, 0, enteredNode);
     }
 
     // Dispatch mouseover event (which bubbles to ancestors) after the mouseleave events are sent.
-    if (enteredNode)
+    if (isNodeInDocument(enteredNode))
         enteredNode->dispatchMouseEvent(mouseEvent, EventTypeNames::mouseover, 0, exitedNode);
 
     // Determine if there is a capturing mouseenter listener in an ancestor. This must be done /after/ dispatching the
     // mouseleave events because the handler for mouseleave might set a capturing mouseenter handler.
     bool enteredNodeHasCapturingAncestor = false;
     for (size_t i = 0; i < numEnteredAncestors; i++) {
         if (enteredAncestors[i]->hasCapturingEventListeners(EventTypeNames::mouseenter))
             enteredNodeHasCapturingAncestor = true;
     }
 
@@ skipping 2394 matching lines @@
 unsigned EventHandler::accessKeyModifiers()
 {
 #if OS(MACOSX)
     return PlatformEvent::CtrlKey | PlatformEvent::AltKey;
 #else
     return PlatformEvent::AltKey;
 #endif
 }
 
 } // namespace blink