Avoid leaking objects between isolated worlds via attribute event listeners

Source/core/dom/EventTarget.cpp

Index: Source/core/dom/EventTarget.cpp
diff --git a/Source/core/dom/EventTarget.cpp b/Source/core/dom/EventTarget.cpp
index c1ae36707aff494c2b79fe8117f9e86ac912a458..c06d6dd6787d6a18b59b3f932a0175312c225c04 100644
--- a/Source/core/dom/EventTarget.cpp
+++ b/Source/core/dom/EventTarget.cpp
@@ -32,6 +32,7 @@
 #include "config.h"
 #include "core/dom/EventTarget.h"
 
+#include "bindings/v8/DOMWrapperWorld.h"
 #include "bindings/v8/ScriptController.h"
 #include "core/dom/Event.h"
 #include "core/dom/ExceptionCode.h"
@@ -103,27 +104,38 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
     return true;
 }
 
-bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, DOMWrapperWorld* isolatedWorld)
 {
-    clearAttributeEventListener(eventType);
+    clearAttributeEventListener(eventType, isolatedWorld);
     if (!listener)
         return false;
     return addEventListener(eventType, listener, false);
 }
 
-EventListener* EventTarget::getAttributeEventListener(const AtomicString& eventType)
+EventListener* EventTarget::getAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld* isolatedWorld)
 {
     const EventListenerVector& entry = getEventListeners(eventType);
     for (size_t i = 0; i < entry.size(); ++i) {
-        if (entry[i].listener->isAttribute())
-            return entry[i].listener.get();
+        EventListener* listener = entry[i].listener.get();
+        if (listener->isAttribute()) {
+            DOMWrapperWorld* listenerWorld = listener->world();
+            // Worker listener
+            if (!listenerWorld) {
+                ASSERT(!isolatedWorld);
+                return listener;
+            }
+            if (listenerWorld->isMainWorld() && !isolatedWorld)
+                return listener;
+            if (listenerWorld == isolatedWorld)
+                return listener;
+        }
     }
     return 0;
 }
 
-bool EventTarget::clearAttributeEventListener(const AtomicString& eventType)
+bool EventTarget::clearAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld* isolatedWorld)
 {
-    EventListener* listener = getAttributeEventListener(eventType);
+    EventListener* listener = getAttributeEventListener(eventType, isolatedWorld);
     if (!listener)
         return false;
     return removeEventListener(eventType, listener, false);