Implement Custom Elements inserted and removed callbacks.

Source/bindings/v8/CustomElementConstructorBuilder.cpp

Index: Source/bindings/v8/CustomElementConstructorBuilder.cpp
diff --git a/Source/bindings/v8/CustomElementConstructorBuilder.cpp b/Source/bindings/v8/CustomElementConstructorBuilder.cpp
index 315ed0516da9b200ee5987952eecbb494281ae4b..8318dd5ee26936c74c526deb80ffd4cf0db970fe 100644
--- a/Source/bindings/v8/CustomElementConstructorBuilder.cpp
+++ b/Source/bindings/v8/CustomElementConstructorBuilder.cpp
@@ -140,17 +140,24 @@ PassRefPtr<CustomElementCallback> CustomElementConstructorBuilder::createCallbac
 
     RefPtr<Document> protect(document);
 
+    v8::Handle<v8::Function> ready = retrieveCallback("readyCallback");
+    v8::Handle<v8::Function> inserted = retrieveCallback("insertedCallback");
+    v8::Handle<v8::Function> removed = retrieveCallback("removedCallback");
+
+    return V8CustomElementCallback::create(document, m_prototype, ready, inserted, removed);
+}
+
+v8::Handle<v8::Function> CustomElementConstructorBuilder::retrieveCallback(const char* name) const
+{
     v8::TryCatch exceptionCatcher;
     exceptionCatcher.SetVerbose(true);
 
     v8::Isolate* isolate = v8::Isolate::GetCurrent();
-    v8::Handle<v8::Value> readyValue = m_prototype->Get(v8String("readyCallback", isolate));
-
-    v8::Handle<v8::Function> readyFunction;
-    if (!readyValue.IsEmpty() && readyValue->IsFunction())
-        readyFunction = v8::Handle<v8::Function>::Cast(readyValue);
+    v8::Handle<v8::Value> value = m_prototype->Get(v8String(name, isolate));

[abarth-chromium, 2013/06/25 21:13:56]

Would you be willing to add a test that hooks each of these calls in JavaScript
with __defineGetter__ and blows away the document?  I want to make sure to see
ClusterFuzz with those tests cases.  (Maybe you've already done that.)

+    if (value.IsEmpty() || !value->IsFunction())
+        return v8::Handle<v8::Function>();
 
-    return V8CustomElementCallback::create(document, m_prototype, readyFunction);
+    return v8::Handle<v8::Function>::Cast(value);
 }
 
 bool CustomElementConstructorBuilder::createConstructor(Document* document, CustomElementDefinition* definition)
@@ -277,12 +284,12 @@ static void constructCustomElement(const v8::FunctionCallbackInfo<v8::Value>& ar
     V8TRYCATCH_FOR_V8STRINGRESOURCE_VOID(V8StringResource<>, type, maybeType);
 
     ExceptionCode ec = 0;
-    CustomElementCallbackDispatcher::CallbackDeliveryScope deliveryScope;
     RefPtr<Element> element = document->createElementNS(namespaceURI, name, maybeType->IsNull() ? nullAtom : type, ec);
     if (ec) {
         setDOMException(ec, isolate);
         return;
     }
+    CustomElementCallbackDispatcher::instance().dispatchReadyCallback(element.get());
     v8SetReturnValue(args, toV8Fast(element.release(), args, document));
 }