When any event is ongoing, we don't set user gesture correctly...

webkit/port/bindings/v8/v8_events.cpp

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 // 
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 66 matching lines @@
   v8::Context::Scope scope(context);
 
   // m_frame can removed by the callback function,
   // protect it until the callback function returns.
   RefPtr<Frame> protector(m_frame);
 
   IF_DEVEL(log_info(frame, "Handling DOM event", m_frame->document()->URL()));
 
   v8::Handle<v8::Value> jsevent = V8Proxy::EventToV8Object(event);
 
   v8::Local<v8::String> event_symbol = v8::String::NewSymbol("event");

[Mike Belshe, 2009/01/14 23:36:00]

Let's add a comment here:

For compatibility, we store the event object as a property on the window called
"event".  Because this is the global namespace, we save away any existing
"event" property, and then restore it after executing the javascript handler.

 
   // Save the old 'event' property.
   v8::Local<v8::Value> saved_evt = context->Global()->Get(event_symbol);
 
   // Make the event available in the window object.
   //
   // TODO: This does not work as in safari if the window.event
   // property is already set. We need to make sure that property
   // access is intercepted correctly.
   context->Global()->Set(event_symbol, jsevent);
 
   v8::Local<v8::Value> ret;
   {
     // Catch exceptions thrown in the event handler so they do not
     // propagate to javascript code that caused the event to fire.
     v8::TryCatch try_catch;
     try_catch.SetVerbose(true);
 
     // Call the event handler.
     ret = CallListenerFunction(jsevent, event, isWindowEvent);
   }
 
+  // Restore the old event.

[Mike Belshe, 2009/01/14 23:36:00]

Update comment to:

Restore the old event.  This must be done for all exit paths through this
method.

+  context->Global()->Set(event_symbol, saved_evt);
+
   if (V8Proxy::HandleOutOfMemory())
     ASSERT(ret.IsEmpty());
 
   if (ret.IsEmpty()) {
     return;
   }
 
   if (!ret.IsEmpty()) {
     if (!ret->IsNull() && !ret->IsUndefined() &&
         event->storesResultAsString()) {
       event->storeResult(ToWebCoreString(ret));
     }
     // Prevent default action if the return value is false;
     // TODO(fqian): example, and reference to buganizer entry
     if (m_isInline) {
       if (ret->IsBoolean() && !ret->BooleanValue()) {
         event->preventDefault();
       }
     }
   }
 
-  // Restore the old event.
-  context->Global()->Set(event_symbol, saved_evt);
-
   Document::updateDocumentsRendering();
 }
 
 
 void V8AbstractEventListener::DisposeListenerObject() {
   if (!m_listener.IsEmpty()) {
 #ifndef NDEBUG
     V8Proxy::UnregisterGlobalHandle(this, m_listener);
 #endif
     m_listener.Dispose();
@@ skipping 294 matching lines @@
         m_wrapped_function->SetName(v8::String::New(
             FromWebCoreString(m_func_name), m_func_name.length()));
       }
     }
   }  // end of local scope
 
   return v8::Local<v8::Function>::New(m_wrapped_function);
 }
 
 }  // namespace WebCore