Clean up WebDOMEvent ownership of WebCore::Event.

Source/WebKit/chromium/src/WebDOMEvent.cpp

Index: Source/WebKit/chromium/src/WebDOMEvent.cpp
diff --git a/Source/WebKit/chromium/src/WebDOMEvent.cpp b/Source/WebKit/chromium/src/WebDOMEvent.cpp
index f72170cfa7eaba433ee127f0ee941985b5a965ec..e9ac8800c7249328eae394973186ee987103b329 100644
--- a/Source/WebKit/chromium/src/WebDOMEvent.cpp
+++ b/Source/WebKit/chromium/src/WebDOMEvent.cpp
@@ -50,28 +50,17 @@ void WebDOMEvent::reset()
 
 void WebDOMEvent::assign(const WebDOMEvent& other)
 {
-    WebDOMEventPrivate* p = const_cast<WebDOMEventPrivate*>(other.m_private);
-    if (p)
-        p->ref();
-    assign(p);
-}
-
-void WebDOMEvent::assign(WebDOMEventPrivate* p)
-{
-    // p is already ref'd for us by the caller
-    if (m_private)
-        m_private->deref();
-    m_private = p;
+    m_private = other.m_private;
 }
 
 WebDOMEvent::WebDOMEvent(const WTF::PassRefPtr<WebCore::Event>& event)
-    : m_private(static_cast<WebDOMEventPrivate*>(event.leakRef()))
+    : m_private(event)
 {
 }
 
 WebDOMEvent::operator WTF::PassRefPtr<WebCore::Event>() const
 {
-    return static_cast<WebCore::Event*>(m_private);

[dmichael (off chromium), 2013/05/20 21:58:44]

This actually looks like a bug to me ^^^^

There's one reference count, and two objects that think they own it (this
WebDOMEvent, and the caller). It looks like this was being used here at least:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

+    return m_private;
 }
 
 WebString WebDOMEvent::type() const