Fix event warning crash when a listener is removed while dispatching event

third_party/WebKit/Source/core/events/EventTarget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 548 matching lines @@
 
         // If stopImmediatePropagation has been called, we just break out immediately, without
         // handling any more events on this target.
         if (event->immediatePropagationStopped())
             break;
 
         event->setHandlingPassive(registeredListener.passive());
 
         InspectorInstrumentation::NativeBreakpoint nativeBreakpoint(context, this, event);
 
+        EventListener* listener = registeredListener.listener();
+
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
-        registeredListener.listener()->handleEvent(context, event);
+        listener->handleEvent(context, event);
 
-        if (shouldReportBlockedEvent && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented())
-            reportBlockedEvent(context, event, &registeredListener, now - event->platformTimeStamp());
+        // If we're about to report this event listener as blocking, make sure it wasn't
+        // removed while handling the event.
+        if (shouldReportBlockedEvent && i > 0 && entry[i - 1].listener() == listener

[dtapuska, 2016/05/19 15:41:21]

This doesn't look too correct to me. What happens when this is the only
listener? Doesn't entry[i-1] refer to invalid memory then?

+            && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented()) {
+            reportBlockedEvent(context, event, &entry[i - 1], now - event->platformTimeStamp());
+        }
 
         event->setHandlingPassive(false);
 
         RELEASE_ASSERT(i <= size);
     }
     d->firingEventIterators->removeLast();
 }
 
 DispatchEventResult EventTarget::dispatchEventResult(const Event& event)
 {
@@ skipping 29 matching lines @@
     // they have one less listener to invoke.
     if (d->firingEventIterators) {
         for (size_t i = 0; i < d->firingEventIterators->size(); ++i) {
             d->firingEventIterators->at(i).iterator = 0;
             d->firingEventIterators->at(i).end = 0;
         }
     }
 }
 
 } // namespace blink