Fix event warning crash when a listener is removed while dispatching event

third_party/WebKit/Source/core/events/EventTarget.cpp

Index: third_party/WebKit/Source/core/events/EventTarget.cpp
diff --git a/third_party/WebKit/Source/core/events/EventTarget.cpp b/third_party/WebKit/Source/core/events/EventTarget.cpp
index 7781288b249f8885ed54b6ba726baf63644f95d4..0f53f4bf898bbd1139728a149b63b114235a5267 100644
--- a/third_party/WebKit/Source/core/events/EventTarget.cpp
+++ b/third_party/WebKit/Source/core/events/EventTarget.cpp
@@ -566,12 +566,18 @@ void EventTarget::fireEventListeners(Event* event, EventTargetData* d, EventList
 
         InspectorInstrumentation::NativeBreakpoint nativeBreakpoint(context, this, event);
 
+        EventListener* listener = registeredListener.listener();
+
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
-        registeredListener.listener()->handleEvent(context, event);
+        listener->handleEvent(context, event);
 
-        if (shouldReportBlockedEvent && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented())
-            reportBlockedEvent(context, event, &registeredListener, now - event->platformTimeStamp());
+        // If we're about to report this event listener as blocking, make sure it wasn't
+        // removed while handling the event.
+        if (shouldReportBlockedEvent && i > 0 && entry[i - 1].listener() == listener

[dtapuska, 2016/05/19 15:41:21]

This doesn't look too correct to me. What happens when this is the only
listener? Doesn't entry[i-1] refer to invalid memory then?

+            && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented()) {
+            reportBlockedEvent(context, event, &entry[i - 1], now - event->platformTimeStamp());
+        }
 
         event->setHandlingPassive(false);