Fix event warning crash when a listener is removed while dispatching event

third_party/WebKit/Source/core/events/EventTarget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 552 matching lines @@
             break;
 
         event->setHandlingPassive(registeredListener.passive());
 
         InspectorInstrumentation::NativeBreakpoint nativeBreakpoint(context, this, event);
 
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener()->handleEvent(context, event);
 
-        if (shouldReportBlockedEvent && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented())
+        if (shouldReportBlockedEvent &&  i > 0 && registeredListener == entry[i - 1]
+            && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented()) {
             reportBlockedEvent(context, event, &registeredListener, now - event->platformTimeStamp());

[dtapuska, 2016/05/18 23:44:17]

Eek, can we just not hold a reference but a copy of the registered event
listener on the stack? 

+        }
 
         event->setHandlingPassive(false);
 
         RELEASE_ASSERT(i <= size);
     }
     d->firingEventIterators->removeLast();
 }
 
 DispatchEventResult EventTarget::dispatchEventResult(const Event& event)
 {
@@ skipping 29 matching lines @@
     // they have one less listener to invoke.
     if (d->firingEventIterators) {
         for (size_t i = 0; i < d->firingEventIterators->size(); ++i) {
             d->firingEventIterators->at(i).iterator = 0;
             d->firingEventIterators->at(i).end = 0;
         }
     }
 }
 
 } // namespace blink