Avoid leaking objects between isolated worlds via attribute event listeners

Source/core/dom/EventTarget.h

Index: Source/core/dom/EventTarget.h
diff --git a/Source/core/dom/EventTarget.h b/Source/core/dom/EventTarget.h
index 80033f722b9fb252b4894b867f225836d5451d92..afd4aba61fdb086295f0d03b6128c095bdc4f5bd 100644
--- a/Source/core/dom/EventTarget.h
+++ b/Source/core/dom/EventTarget.h
@@ -120,9 +120,8 @@ namespace WebCore {
         virtual void uncaughtExceptionInEventHandler();
 
         // Used for legacy "onEvent" attribute APIs.
-        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
-        bool clearAttributeEventListener(const AtomicString& eventType);
-        EventListener* getAttributeEventListener(const AtomicString& eventType);
+        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, DOMWrapperWorld* = 0);
+        EventListener* getAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld* = 0);
 
         bool hasEventListeners();
         bool hasEventListeners(const AtomicString& eventType);
@@ -143,34 +142,36 @@ namespace WebCore {
         
         void fireEventListeners(Event*, EventTargetData*, EventListenerVector&);
 
+        bool clearAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld*);
+
         friend class EventListenerIterator;
     };
 
     // FIXME: These macros should be split into separate DEFINE and DECLARE
     // macros to avoid causing so many header includes.
     #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return getAttributeEventListener(eventNames().attribute##Event, world); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world = 0) { setAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     #define DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        virtual EventListener* on##attribute(); \
-        virtual void setOn##attribute(PassRefPtr<EventListener> listener); \
+        virtual EventListener* on##attribute(DOMWrapperWorld*); \
+        virtual void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld*); \
 
     #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(type, attribute) \
-        EventListener* type::on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
-        void type::setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* type::on##attribute(DOMWrapperWorld* world) { return getAttributeEventListener(eventNames().attribute##Event, world); } \
+        void type::setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { setAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     #define DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        EventListener* on##attribute() { return document()->getWindowAttributeEventListener(eventNames().attribute##Event); } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return document()->getWindowAttributeEventListener(eventNames().attribute##Event, world); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     #define DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(attribute, eventName) \
-        EventListener* on##attribute() { return getAttributeEventListener(eventNames().eventName##Event); } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().eventName##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return getAttributeEventListener(eventNames().eventName##Event, world); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { setAttributeEventListener(eventNames().eventName##Event, listener, world); } \
 
     #define DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(recipient, attribute) \
-        EventListener* on##attribute() { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event) : 0; } \
-        void setOn##attribute(PassRefPtr<EventListener> listener) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener); } \
+        EventListener* on##attribute(DOMWrapperWorld* world) { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event, world) : 0; } \
+        void setOn##attribute(PassRefPtr<EventListener> listener, DOMWrapperWorld* world) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener, world); } \
 
     inline bool EventTarget::isFiringEventListeners()
     {