Add the ability to return descedant event listeners.

third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp

Index: third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
diff --git a/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
index 743c452559ad8112d1288fccab97a26c37f742b3..a24c4b202ff269bbe5c324b2d527c149f2ce0a5e 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
@@ -33,15 +33,19 @@
 #include "bindings/core/v8/ScriptEventListener.h"
 #include "bindings/core/v8/V8EventTarget.h"
 #include "core/dom/Element.h"
+#include "core/dom/ElementTraversal.h"
 #include "core/dom/Node.h"
 #include "core/events/Event.h"
 #include "core/events/EventTarget.h"
 #include "core/frame/LocalDOMWindow.h"
+#include "core/html/HTMLFrameOwnerElement.h"
 #include "core/inspector/InspectorDOMAgent.h"
 #include "platform/inspector_protocol/Values.h"
 #include "platform/v8_inspector/public/V8EventListenerInfo.h"
 #include "platform/v8_inspector/public/V8InspectorSession.h"
 
+namespace blink {
+
 namespace {
 
 enum DOMBreakpointType {
@@ -57,23 +61,73 @@ static const char instrumentationEventCategoryType[] = "instrumentation:";
 const uint32_t inheritableDOMBreakpointTypesMask = (1 << SubtreeModified);
 const int domBreakpointDerivedTypeShift = 16;
 
-} // namespace
+void addEventListenersForEventTarget(EventTarget* target, unsigned filterMask, V8EventListenerInfoList& eventInformation)
+{
+    ExecutionContext* executionContext = target->getExecutionContext();
+    // Nodes and their Listeners for the concerned event types (order is top to bottom)
+    Vector<AtomicString> eventTypes = target->eventTypes();
+    for (size_t j = 0; j < eventTypes.size(); ++j) {
+        AtomicString& type = eventTypes[j];
+        EventListenerVector* listeners = target->getEventListeners(type);
+        if (!listeners)
+            continue;
+        for (size_t k = 0; k < listeners->size(); ++k) {
+            auto& registeredEventListener = listeners->at(k);
+            EventListener* eventListener = registeredEventListener.listener;
+            if (eventListener->type() != EventListener::JSEventListenerType)
+                continue;
+            if ((filterMask & V8EventListenerInfo::EventListenerFilterShowPassive) == 0 && registeredEventListener.passive)
+                continue;
+            if ((filterMask & V8EventListenerInfo::EventListenerFilterShowBlocking) == 0 && !registeredEventListener.passive)
+                continue;
+            V8AbstractEventListener* v8Listener = static_cast<V8AbstractEventListener*>(eventListener);
+            // getListenerObject() may cause JS in the event attribute to get
+            // compiled, potentially unsuccessfully.  In that case, the function
+            // returns the empty handle without an exception.
+            v8::Local<v8::Object> handler = v8Listener->getListenerObject(executionContext);
+            if (handler.IsEmpty())
+                continue;
+            eventInformation.append(V8EventListenerInfo(type, registeredEventListener.useCapture, registeredEventListener.passive, handler));
+        }
+    }
 
-namespace blink {
+    if (filterMask & V8EventListenerInfo::EventListenerFilterShowDescendants) {
+        if (LocalDOMWindow* window = target->toLocalDOMWindow()) {
+            if (Document* document = window->document()) {
+                addEventListenersForEventTarget(document, filterMask, eventInformation);
+                for (Element& element : ElementTraversal::descendantsOf(*document))
+                    addEventListenersForEventTarget(&element, filterMask, eventInformation);
+            }
+        }
+        if (Node* node = target->toNode()) {
+            if (node->isFrameOwnerElement()) {
+                if (HTMLFrameOwnerElement* frameElement = toHTMLFrameOwnerElement(node)) {
+                    if (DOMWindow* subFrameWindow = frameElement->contentWindow()) {
+                        addEventListenersForEventTarget(subFrameWindow, filterMask, eventInformation);
+                    }
+                }
+            }
+        }
+    }
+}
 
 static const char webglErrorFiredEventName[] = "webglErrorFired";
 static const char webglWarningFiredEventName[] = "webglWarningFired";
 static const char webglErrorNameProperty[] = "webglErrorName";
 
+} // namespace
+
 namespace DOMDebuggerAgentState {
+
 static const char eventListenerBreakpoints[] = "eventListenerBreakpoints";
 static const char eventTargetAny[] = "*";
 static const char pauseOnAllXHRs[] = "pauseOnAllXHRs";
 static const char xhrBreakpoints[] = "xhrBreakpoints";
 static const char enabled[] = "enabled";
-}
 
-void InspectorDOMDebuggerAgent::eventListenersInfoForTarget(v8::Isolate* isolate, v8::Local<v8::Value> value, V8EventListenerInfoList& eventInformation)
+} // namespace DOMDebuggerAgentState
+
+void InspectorDOMDebuggerAgent::eventListenersInfoForTarget(v8::Isolate* isolate, v8::Local<v8::Value> value, unsigned filterMask, V8EventListenerInfoList& eventInformation)
 {
     EventTarget* target = V8EventTarget::toImplWithTypeCheck(isolate, value);
     // We need to handle LocalDOMWindow specially, because LocalDOMWindow wrapper exists on prototype chain.
@@ -82,31 +136,12 @@ void InspectorDOMDebuggerAgent::eventListenersInfoForTarget(v8::Isolate* isolate
     if (!target || !target->getExecutionContext())
         return;
 
-    ExecutionContext* executionContext = target->getExecutionContext();
+    addEventListenersForEventTarget(target, filterMask, eventInformation);
 
-    // Nodes and their Listeners for the concerned event types (order is top to bottom)
-    Vector<AtomicString> eventTypes = target->eventTypes();
-    for (size_t j = 0; j < eventTypes.size(); ++j) {
-        AtomicString& type = eventTypes[j];
-        EventListenerVector* listeners = target->getEventListeners(type);
-        if (!listeners)
-            continue;
-        for (size_t k = 0; k < listeners->size(); ++k) {
-            EventListener* eventListener = listeners->at(k).listener;
-            if (eventListener->type() != EventListener::JSEventListenerType)
-                continue;
-            V8AbstractEventListener* v8Listener = static_cast<V8AbstractEventListener*>(eventListener);
-            v8::Local<v8::Context> context = toV8Context(executionContext, v8Listener->world());

[dtapuska, 2016/05/05 19:51:42]

Please look at these lines hard. The checking of the same context was removed
for this to work across iframes. I wasn't sure if it should be kept in some
scenario; but I couldn't find how to get the v8::Context from the iframe's
document.

caseq@ was the one that added this check so would like some feedback.

[caseq, 2016/05/05 23:00:04]

The primary use case for getEventListeners() console API call was in fact to
expose it to DevTools extensions, so we wanted to ensure that the extensions
only see the handlers that the page has installed and not those of other
extensions. In general, considering we return actual listener functions,
allowing to do this cross execution context sounds scary to me from the security
point of view. Perhaps what we could do here is to return actual functions only
in case the security origin and the DOM world match?

[dtapuska, 2016/05/18 14:04:53]

I've just added back the check for the v8 context matching. Make sense?

-            // Hide listeners from other contexts.
-            if (context != isolate->GetCurrentContext())
-                continue;
-            // getListenerObject() may cause JS in the event attribute to get
-            // compiled, potentially unsuccessfully.  In that case, the function
-            // returns the empty handle without an exception.
-            v8::Local<v8::Object> handler = v8Listener->getListenerObject(executionContext);
-            if (handler.IsEmpty())
-                continue;
-            eventInformation.append(V8EventListenerInfo(type, listeners->at(k).useCapture, listeners->at(k).passive, handler));
+    if (filterMask & V8EventListenerInfo::EventListenerFilterShowDescendants) {
+        if (Node* node = target->toNode()) {
+            for (Element& element : ElementTraversal::descendantsOf(*node))
+                addEventListenersForEventTarget(&element, filterMask, eventInformation);
         }
     }
 }
@@ -331,7 +366,7 @@ void InspectorDOMDebuggerAgent::removeDOMBreakpoint(ErrorString* errorString, in
     didRemoveBreakpoint();
 }
 
-void InspectorDOMDebuggerAgent::getEventListeners(ErrorString* errorString, const String16& objectId, OwnPtr<protocol::Array<protocol::DOMDebugger::EventListener>>* listenersArray)
+void InspectorDOMDebuggerAgent::getEventListeners(ErrorString* errorString, const String16& objectId, const Maybe<bool>& inDescendants, OwnPtr<protocol::Array<protocol::DOMDebugger::EventListener>>* listenersArray)
 {
     v8::HandleScope handles(m_isolate);
 
@@ -340,15 +375,19 @@ void InspectorDOMDebuggerAgent::getEventListeners(ErrorString* errorString, cons
     v8::Local<v8::Value> value = m_v8Session->findObject(errorString, objectId, &context, &objectGroup);
     if (value.IsEmpty())
         return;
+
     v8::Context::Scope scope(context);
     *listenersArray = protocol::Array<protocol::DOMDebugger::EventListener>::create();
-    eventListeners(context, value, objectGroup, listenersArray->get());
+    unsigned filterMask = V8EventListenerInfo::EventListenerFilterShowPassive | V8EventListenerInfo::EventListenerFilterShowBlocking;
+    if (inDescendants.fromMaybe(false))
+        filterMask |= V8EventListenerInfo::EventListenerFilterShowDescendants;
+    eventListeners(context, value, objectGroup, filterMask, listenersArray->get());
 }
 
-void InspectorDOMDebuggerAgent::eventListeners(v8::Local<v8::Context> context, v8::Local<v8::Value> object, const String16& objectGroup, protocol::Array<protocol::DOMDebugger::EventListener>* listenersArray)
+void InspectorDOMDebuggerAgent::eventListeners(v8::Local<v8::Context> context, v8::Local<v8::Value> object, const String16& objectGroup, unsigned filterMask, protocol::Array<protocol::DOMDebugger::EventListener>* listenersArray)
 {
     V8EventListenerInfoList eventInformation;
-    InspectorDOMDebuggerAgent::eventListenersInfoForTarget(context->GetIsolate(), object, eventInformation);
+    InspectorDOMDebuggerAgent::eventListenersInfoForTarget(context->GetIsolate(), object, filterMask, eventInformation);
     for (const auto& info : eventInformation) {
         if (!info.useCapture)
             continue;