Implement Custom Elements inserted and removed callbacks.

Source/bindings/v8/CustomElementConstructorBuilder.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 122 matching lines @@
 
     return false;
 }
 
 PassRefPtr<CustomElementCallback> CustomElementConstructorBuilder::createCallback(Document* document)
 {
     ASSERT(!m_prototype.IsEmpty());
 
     RefPtr<Document> protect(document);
 
+    v8::Handle<v8::Function> ready = retrieveCallback("readyCallback");
+    v8::Handle<v8::Function> inserted = retrieveCallback("insertedCallback");
+    v8::Handle<v8::Function> removed = retrieveCallback("removedCallback");
+
+    return V8CustomElementCallback::create(document, m_prototype, ready, inserted, removed);
+}
+
+v8::Handle<v8::Function> CustomElementConstructorBuilder::retrieveCallback(const char* name) const
+{
     v8::TryCatch exceptionCatcher;
     exceptionCatcher.SetVerbose(true);
 
     v8::Isolate* isolate = v8::Isolate::GetCurrent();
-    v8::Handle<v8::Value> readyValue = m_prototype->Get(v8String("readyCallback", isolate));
+    v8::Handle<v8::Value> value = m_prototype->Get(v8String(name, isolate));

[abarth-chromium, 2013/06/25 21:13:56]

Would you be willing to add a test that hooks each of these calls in JavaScript
with __defineGetter__ and blows away the document?  I want to make sure to see
ClusterFuzz with those tests cases.  (Maybe you've already done that.)

+    if (value.IsEmpty() || !value->IsFunction())
+        return v8::Handle<v8::Function>();
 
-    v8::Handle<v8::Function> readyFunction;
-    if (!readyValue.IsEmpty() && readyValue->IsFunction())
-        readyFunction = v8::Handle<v8::Function>::Cast(readyValue);
-
-    return V8CustomElementCallback::create(document, m_prototype, readyFunction);
+    return v8::Handle<v8::Function>::Cast(value);
 }
 
 bool CustomElementConstructorBuilder::createConstructor(Document* document, CustomElementDefinition* definition)
 {
     ASSERT(!m_prototype.IsEmpty());
     ASSERT(m_constructor.IsEmpty());
     ASSERT(document);
 
     v8::Isolate* isolate = m_context->GetIsolate();
 
@@ skipping 106 matching lines @@
         return;
     }
 
     Document* document = V8Document::toNative(v8::Handle<v8::Object>::Cast(args.Callee()->GetHiddenValue(V8HiddenPropertyName::document())));
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, namespaceURI, args.Callee()->GetHiddenValue(V8HiddenPropertyName::namespaceURI()));
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, name, args.Callee()->GetHiddenValue(V8HiddenPropertyName::name()));
     v8::Handle<v8::Value> maybeType = args.Callee()->GetHiddenValue(V8HiddenPropertyName::type());
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, type, maybeType);
 
     ExceptionCode ec = 0;
-    CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
     RefPtr<Element> element = document->createElementNS(namespaceURI, name, maybeType->IsNull() ? nullAtom : type, ec);
     if (ec) {
         setDOMException(ec, isolate);
         return;
     }
+    CustomElementCallbackDispatcher::instance().dispatchReadyCallback(element.get());
     v8SetReturnValue(args, toV8Fast(element.release(), args, document));
 }
 
 } // namespace WebCore