Avoid leaking objects between isolated worlds via attribute event listeners

Source/core/dom/EventTarget.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 102 matching lines @@
         virtual DOMWindow* toDOMWindow();
 
         virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
         virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
         virtual void removeAllEventListeners();
         virtual bool dispatchEvent(PassRefPtr<Event>);
         bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&); // DOM API
         virtual void uncaughtExceptionInEventHandler();
 
         // Used for legacy "onEvent" attribute APIs.
-        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
-        bool clearAttributeEventListener(const AtomicString& eventType);
-        EventListener* getAttributeEventListener(const AtomicString& eventType);
+        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, DOMWrapperWorld* = 0);
+        EventListener* getAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld* = 0);
 
         bool hasEventListeners();
         bool hasEventListeners(const AtomicString& eventType);
         const EventListenerVector& getEventListeners(const AtomicString& eventType);
 
         bool fireEventListeners(Event*);
         bool isFiringEventListeners();
 
     protected:
         virtual ~EventTarget();
         
         virtual EventTargetData* eventTargetData() = 0;
         virtual EventTargetData* ensureEventTargetData() = 0;
 
     private:
         virtual void refEventTarget() = 0;
         virtual void derefEventTarget() = 0;
         
         void fireEventListeners(Event*, EventTargetData*, EventListenerVector&);
 
+        bool clearAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld*);
+
         friend class EventListenerIterator;
     };
 
     // FIXME: These macros should be split into separate DEFINE and DECLARE
     // macros to avoid causing so many header includes.
     #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return getAttributeEventListener(eventNames().attribute##Event, world); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world = 0) { setAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     #define DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        virtual EventListener* on##attribute(); \
-        virtual void setOn##attribute(PassRefPtr<EventListener> listener); \
+        virtual EventListener* on##attribute(DOMWrapperWorld*); \
+        virtual void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld*); \
 
     #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(type, attribute) \
-        EventListener* type::on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
-        void type::setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* type::on##attribute(DOMWrapperWorld* world) { return getAttributeEventListener(eventNames().attribute##Event, world); } \
+        void type::setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { setAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     #define DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        EventListener* on##attribute() { return document()->getWindowAttributeEventListener(eventNames().attribute##Event); } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return document()->getWindowAttributeEventListener(eventNames().attribute##Event, world); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     #define DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(attribute, eventName) \
-        EventListener* on##attribute() { return getAttributeEventListener(eventNames().eventName##Event); } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().eventName##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return getAttributeEventListener(eventNames().eventName##Event, world); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { setAttributeEventListener(eventNames().eventName##Event, listener, world); } \
 
     #define DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(recipient, attribute) \
-        EventListener* on##attribute() { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event) : 0; } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event, world) : 0; } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     inline bool EventTarget::isFiringEventListeners()
     {
         EventTargetData* d = eventTargetData();
         if (!d)
             return false;
         return d->firingEventIterators && !d->firingEventIterators->isEmpty();
     }
 
     inline bool EventTarget::hasEventListeners()
     {
         EventTargetData* d = eventTargetData();
         if (!d)
             return false;
         return !d->eventListenerMap.isEmpty();
     }
 
     inline bool EventTarget::hasEventListeners(const AtomicString& eventType)
     {
         EventTargetData* d = eventTargetData();
         if (!d)
             return false;
         return d->eventListenerMap.contains(eventType);
     }
 
 } // namespace WebCore
 
 #endif // EventTarget_h