A patch for http://crbug.com/17400...

bindings/v8/custom/V8NodeCustom.cpp

 /*
  * Copyright (C) 2007-2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "Node.h"
 
 #include "Document.h"
 #include "EventListener.h"
 
+#include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
+#include "V8ObjectEventListener.h"
 #include "V8Node.h"
 #include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+static inline String toEventType(v8::Local<v8::String> value)
+{
+    String key = toWebCoreString(value);
+    ASSERT(key.startsWith("on"));
+    return key.substring(2);
+}
+
+static PassRefPtr<EventListener> getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
+{
+    V8Proxy* proxy = V8Proxy::retrieve(node->scriptExecutionContext());
+    // the document might be created using createDocument,
+    // which does not have a frame, use the active frame
+    if (!proxy)
+        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
+
+    if (proxy) {
+        V8EventListenerList* list = proxy->objectListeners();
+        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
+    }
+
+    return PassRefPtr<EventListener>();
+}
+
+ACCESSOR_SETTER(NodeEventHandler)
+{
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(info.Holder());
+
+    String eventType = toEventType(name);
+
+    // Set handler if the value is a function.  Otherwise, clear the
+    // event handler.
+    if (value->IsFunction()) {
+        RefPtr<EventListener> listener = getEventListener(node, value, true, false);
+        if (listener) {
+            node->setAttributeEventListener(eventType, listener);
+            createHiddenDependency(info.Holder(), value, V8Custom::kNodeEventListenerCacheIndex);
+        }
+    } else {
+        if (EventListener* listener = node->getAttributeEventListener(eventType)) {
+            if (!static_cast<V8AbstractEventListener*>(listener)->isLazy()) {
+                v8::Local<v8::Object> v8Listener = static_cast<V8ObjectEventListener*>(listener)->getListenerObject();
+                removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kNodeEventListenerCacheIndex);
+            }
+        }
+        node->clearAttributeEventListener(eventType);
+    }
+}
+
+ACCESSOR_GETTER(NodeEventHandler)
+{
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(info.Holder());
+
+    EventListener* listener = node->getAttributeEventListener(toEventType(name));
+    return V8DOMWrapper::convertEventListenerToV8Object(listener);
+}
+
 CALLBACK_FUNC_DECL(NodeAddEventListener)
 {
     INC_STATS("DOM.Node.addEventListener()");
     Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(node->document()->frame());
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = getEventListener(node, args[1], false, false);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         node->addEventListener(type, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
     }
     return v8::Undefined();
 }
 
 CALLBACK_FUNC_DECL(NodeRemoveEventListener)
 {
     INC_STATS("DOM.Node.removeEventListener()");
     Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(node->document()->frame());
     // It is possbile that the owner document of the node is detached
-    // from the frame, return immediately in this case.
+    // from the frame.
     // See issue http://b/878909
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->eventListeners()->findWrapper(args[1], false);
+    RefPtr<EventListener> listener = getEventListener(node, args[1], false, true);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         node->removeEventListener(type, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
     }
 
     return v8::Undefined();
 }
 
 // This function is customized to take advantage of the optional 4th argument: shouldLazyAttach
 CALLBACK_FUNC_DECL(NodeInsertBefore)
 {
     INC_STATS("DOM.Node.insertBefore");
     v8::Handle<v8::Object> holder = args.Holder();
@@ skipping 59 matching lines @@
     if (ec) {
         V8Proxy::setDOMException(ec);
         return v8::Handle<v8::Value>();
     }
     if (success)
         return args[0];
     return v8::Null();
 }
 
 } // namespace WebCore