Fix event warning crash when a listener is removed while dispatching event

third_party/WebKit/Source/core/events/EventTarget.cpp

Index: third_party/WebKit/Source/core/events/EventTarget.cpp
diff --git a/third_party/WebKit/Source/core/events/EventTarget.cpp b/third_party/WebKit/Source/core/events/EventTarget.cpp
index 4dfecb5ef90714c6229f9a9d0ff1af622bdb41db..09e65af9e1767a8554531de1a5428c2d086e0513 100644
--- a/third_party/WebKit/Source/core/events/EventTarget.cpp
+++ b/third_party/WebKit/Source/core/events/EventTarget.cpp
@@ -97,7 +97,7 @@ void reportBlockedEvent(ExecutionContext* context, const Event* event, Registere
     String messageText = String::format(
         "Handling of '%s' input event was delayed for %ld ms due to main thread being busy. "
         "Consider marking event handler as 'passive' to make the page more responive.",
-        event->type().characters8(), lround(delayedSeconds * 1000));
+        event->type().getString().utf8().data(), lround(delayedSeconds * 1000));
     ConsoleMessage* message = nullptr;
 
     v8::Local<v8::Function> function = eventListenerEffectiveFunction(v8Listener->isolate(), handler);
@@ -576,13 +576,19 @@ bool EventTarget::fireEventListeners(Event* event, EventTargetData* d, EventList
 
         InspectorInstrumentation::NativeBreakpoint nativeBreakpoint(context, this, event);
 
+        EventListener* listener = registeredListener.listener();
+
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
-        registeredListener.listener()->handleEvent(context, event);
+        listener->handleEvent(context, event);
         firedListener = true;
 
-        if (shouldReportBlockedEvent && !registeredListener.passive() && !registeredListener.blockedEventWarningEmitted() && !event->defaultPrevented())
-            reportBlockedEvent(context, event, &registeredListener, now - event->platformTimeStamp());
+        // If we're about to report this event listener as blocking, make sure it wasn't
+        // removed while handling the event.
+        if (shouldReportBlockedEvent && i > 0 && entry[i - 1].listener() == listener
+            && !entry[i - 1].passive() && !entry[i - 1].blockedEventWarningEmitted() && !event->defaultPrevented()) {
+            reportBlockedEvent(context, event, &entry[i - 1], now - event->platformTimeStamp());
+        }
 
         event->setHandlingPassive(false);