Fix event warning crash when a listener is removed while dispatching event

third_party/WebKit/Source/core/events/EventTarget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 79 matching lines @@
     if (registeredListener->listener()->type() != EventListener::JSEventListenerType)
         return;
 
     V8AbstractEventListener* v8Listener = V8AbstractEventListener::cast(registeredListener->listener());
     v8::HandleScope handles(v8Listener->isolate());
     v8::Local<v8::Object> handler = v8Listener->getListenerObject(context);
 
     String messageText = String::format(
         "Handling of '%s' input event was delayed for %ld ms due to main thread being busy. "
         "Consider marking event handler as 'passive' to make the page more responive.",
-        event->type().characters8(), lround(delayedSeconds * 1000));
+        event->type().getString().utf8().data(), lround(delayedSeconds * 1000));
     ConsoleMessage* message = nullptr;
 
     v8::Local<v8::Function> function = eventListenerEffectiveFunction(v8Listener->isolate(), handler);
     if (!function.IsEmpty())
         message = ConsoleMessage::create(JSMessageSource, WarningMessageLevel, messageText, String(), function->GetScriptLineNumber() + 1, function->GetScriptColumnNumber() + 1, nullptr, function->ScriptId());
     else
         message = ConsoleMessage::create(JSMessageSource, WarningMessageLevel, messageText, String(), 0, 0);
     context->addConsoleMessage(message);
     registeredListener->setBlockedEventWarningEmitted();
 }
@@ skipping 458 matching lines @@
 
         // If stopImmediatePropagation has been called, we just break out immediately, without
         // handling any more events on this target.
         if (event->immediatePropagationStopped())
             break;
 
         event->setHandlingPassive(registeredListener.passive());
 
         InspectorInstrumentation::NativeBreakpoint nativeBreakpoint(context, this, event);
 
+        EventListener* listener = registeredListener.listener();
+
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
-        registeredListener.listener()->handleEvent(context, event);
+        listener->handleEvent(context, event);
         firedListener = true;
 
-        if (shouldReportBlockedEvent && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented())
-            reportBlockedEvent(context, event, &registeredListener, now - event->platformTimeStamp());
+        // If we're about to report this event listener as blocking, make sure it wasn't
+        // removed while handling the event.
+        if (shouldReportBlockedEvent && i > 0 && entry[i - 1].listener() == listener
+            && !entry[i - 1].passive() && !entry[i - 1].blockedEventWarningEmitted() && !event->defaultPrevented()) {
+            reportBlockedEvent(context, event, &entry[i - 1], now - event->platformTimeStamp());
+        }
 
         event->setHandlingPassive(false);
 
         RELEASE_ASSERT(i <= size);
     }
     d->firingEventIterators->removeLast();
     return firedListener;
 }
 
 DispatchEventResult EventTarget::dispatchEventResult(const Event& event)
@@ skipping 30 matching lines @@
     // they have one less listener to invoke.
     if (d->firingEventIterators) {
         for (size_t i = 0; i < d->firingEventIterators->size(); ++i) {
             d->firingEventIterators->at(i).iterator = 0;
             d->firingEventIterators->at(i).end = 0;
         }
     }
 }
 
 } // namespace blink