Clean up WebDOMEvent ownership of WebCore::Event.

Source/WebKit/chromium/src/WebDOMEvent.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 32 matching lines @@
 class WebDOMEventPrivate : public WebCore::Event {
 };
 
 void WebDOMEvent::reset()
 {
     assign(0);
 }
 
 void WebDOMEvent::assign(const WebDOMEvent& other)
 {
-    WebDOMEventPrivate* p = const_cast<WebDOMEventPrivate*>(other.m_private);
-    if (p)
-        p->ref();
-    assign(p);
-}
-
-void WebDOMEvent::assign(WebDOMEventPrivate* p)
-{
-    // p is already ref'd for us by the caller
-    if (m_private)
-        m_private->deref();
-    m_private = p;
+    m_private = other.m_private;
 }
 
 WebDOMEvent::WebDOMEvent(const WTF::PassRefPtr<WebCore::Event>& event)
-    : m_private(static_cast<WebDOMEventPrivate*>(event.leakRef()))
+    : m_private(event)
 {
 }
 
 WebDOMEvent::operator WTF::PassRefPtr<WebCore::Event>() const
 {
-    return static_cast<WebCore::Event*>(m_private);

[dmichael (off chromium), 2013/05/20 21:58:44]

This actually looks like a bug to me ^^^^

There's one reference count, and two objects that think they own it (this
WebDOMEvent, and the caller). It looks like this was being used here at least:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

+    return m_private;
 }
 
 WebString WebDOMEvent::type() const
 {
     ASSERT(m_private);
     return m_private->type();
 }
 
 WebNode WebDOMEvent::target() const
 {
@@ skipping 121 matching lines @@
     return m_private->hasInterface(eventNames().interfaceForXMLHttpRequestProgressEvent);
 }
 
 bool WebDOMEvent::isBeforeLoadEvent() const
 {
     ASSERT(m_private);
     return m_private->hasInterface(eventNames().interfaceForBeforeLoadEvent);
 }
 
 } // namespace WebKit