Fix event warning crash when a listener is removed while dispatching event

third_party/WebKit/Source/core/events/EventTarget.cpp

Index: third_party/WebKit/Source/core/events/EventTarget.cpp
diff --git a/third_party/WebKit/Source/core/events/EventTarget.cpp b/third_party/WebKit/Source/core/events/EventTarget.cpp
index 7781288b249f8885ed54b6ba726baf63644f95d4..86a35575bdf3e91275a4882e391de13301634875 100644
--- a/third_party/WebKit/Source/core/events/EventTarget.cpp
+++ b/third_party/WebKit/Source/core/events/EventTarget.cpp
@@ -570,8 +570,10 @@ void EventTarget::fireEventListeners(Event* event, EventTargetData* d, EventList
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener()->handleEvent(context, event);
 
-        if (shouldReportBlockedEvent && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented())
+        if (shouldReportBlockedEvent &&  i > 0 && registeredListener == entry[i - 1]
+            && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented()) {
             reportBlockedEvent(context, event, &registeredListener, now - event->platformTimeStamp());

[dtapuska, 2016/05/18 23:44:17]

Eek, can we just not hold a reference but a copy of the registered event
listener on the stack? 

+        }
 
         event->setHandlingPassive(false);