Track scroll event handlers in nested documents

Source/core/dom/Node.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 24 matching lines @@
 #include "core/dom/ChildListMutationScope.h"
 #include "core/dom/ChildNodeList.h"
 #include "core/dom/DOMImplementation.h"
 #include "core/dom/Document.h"
 #include "core/dom/DocumentFragment.h"
 #include "core/dom/DocumentMarkerController.h"
 #include "core/dom/DocumentType.h"
 #include "core/dom/Element.h"
 #include "core/dom/ElementRareData.h"
 #include "core/dom/ElementTraversal.h"
-#include "core/dom/EventHandlerRegistry.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/LiveNodeList.h"
 #include "core/dom/NodeRareData.h"
 #include "core/dom/NodeRenderingTraversal.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/ProcessingInstruction.h"
 #include "core/dom/Range.h"
 #include "core/dom/StaticNodeList.h"
 #include "core/dom/TemplateContentDocumentFragment.h"
 #include "core/dom/Text.h"
@@ skipping 17 matching lines @@
 #include "core/events/TouchEvent.h"
 #include "core/events/UIEvent.h"
 #include "core/events/WheelEvent.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLAnchorElement.h"
 #include "core/html/HTMLDialogElement.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/html/HTMLStyleElement.h"
 #include "core/page/ContextMenuController.h"
 #include "core/page/EventHandler.h"
+#include "core/page/EventHandlerRegistry.h"
 #include "core/page/Page.h"
 #include "core/frame/Settings.h"
 #include "core/rendering/FlowThreadController.h"
 #include "core/rendering/RenderBox.h"
 #include "core/svg/graphics/SVGImage.h"
 #include "platform/Partitions.h"
 #include "wtf/HashSet.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/RefCountedLeakCounter.h"
 #include "wtf/Vector.h"
@@ skipping 192 matching lines @@
 void Node::willBeDeletedFromDocument()
 {
     if (!isTreeScopeInitialized())
         return;
 
     Document& document = this->document();
 
     if (hasEventTargetData()) {
         clearEventTargetData();
         document.didClearTouchEventHandlers(this);
-        EventHandlerRegistry::from(document)->didRemoveAllEventHandlers(*this);
+        if (document.page())
+            EventHandlerRegistry::from(*document.page())->didRemoveAllEventHandlers(*this);
     }
 
     if (AXObjectCache* cache = document.existingAXObjectCache())
         cache->remove(this);
 
     document.markers().removeMarkers(this);
 }
 
 NodeRareData* Node::rareData() const
 {
@@ skipping 1630 matching lines @@
         oldController->didRemoveWheelEventHandler(oldDocument);
         newController->didAddWheelEventHandler(document());
     }
 
     if (const TouchEventTargetSet* touchHandlers = oldDocument.touchEventTargets()) {
         while (touchHandlers->contains(this)) {
             oldDocument.didRemoveTouchEventHandler(this);
             document().didAddTouchEventHandler(this);
         }
     }
-    EventHandlerRegistry::from(document())->didMoveFromOtherDocument(*this, oldDocument);
+    if (document().page())

[Rick Byers, 2014/04/24 21:30:12]

In what cases does a Document not have a Page?  It seems like whatever those
cases are we could have a problem getting caught up...

[Sami, 2014/04/25 19:51:15]

After a document is detached it will no longer have a page. However, it looks
like we remove all event handlers from a document before it is detached through
this call chain:

FrameLoader::detachFromParent
=> FrameLoader::closeURL
=> Document::dispatchUnloadEvents
=> Document::removeAllEventListenersRecursively

The only exception is for the transitional empty document
(https://bugs.webkit.org/show_bug.cgi?id=28716), but that only concerns window
handlers which we aren't tracking yet.

+        EventHandlerRegistry::from(*document().page())->didMoveFromOtherDocument(*this, oldDocument);
 
     if (Vector<OwnPtr<MutationObserverRegistration> >* registry = mutationObserverRegistry()) {
         for (size_t i = 0; i < registry->size(); ++i) {
             document().addMutationObserverTypes(registry->at(i)->mutationTypes());
         }
     }
 
     if (HashSet<MutationObserverRegistration*>* transientRegistry = transientMutationObserverRegistry()) {
         for (HashSet<MutationObserverRegistration*>::iterator iter = transientRegistry->begin(); iter != transientRegistry->end(); ++iter) {
             document().addMutationObserverTypes((*iter)->mutationTypes());
         }
     }
 }
 
 static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
     if (!targetNode->EventTarget::addEventListener(eventType, listener, useCapture))
         return false;
 
     Document& document = targetNode->document();
     document.addListenerTypeIfNeeded(eventType);
     if (eventType == EventTypeNames::wheel || eventType == EventTypeNames::mousewheel)
         WheelController::from(document)->didAddWheelEventHandler(document);
     else if (isTouchEventType(eventType))
         document.didAddTouchEventHandler(targetNode);
-    EventHandlerRegistry::from(document)->didAddEventHandler(*targetNode, eventType);
+    if (document.page())
+        EventHandlerRegistry::from(*document.page())->didAddEventHandler(*targetNode, eventType);
 
     return true;
 }
 
 bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
     return tryAddEventListener(this, eventType, listener, useCapture);
 }
 
 static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
     if (!targetNode->EventTarget::removeEventListener(eventType, listener, useCapture))
         return false;
 
     // FIXME: Notify Document that the listener has vanished. We need to keep track of a number of
     // listeners for each type, not just a bool - see https://bugs.webkit.org/show_bug.cgi?id=33861
     Document& document = targetNode->document();
     if (eventType == EventTypeNames::wheel || eventType == EventTypeNames::mousewheel)
         WheelController::from(document)->didRemoveWheelEventHandler(document);
     else if (isTouchEventType(eventType))
         document.didRemoveTouchEventHandler(targetNode);
-    EventHandlerRegistry::from(document)->didRemoveEventHandler(*targetNode, eventType);
+    if (document.page())
+        EventHandlerRegistry::from(*document.page())->didRemoveEventHandler(*targetNode, eventType);
 
     return true;
 }
 
 bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
     return tryRemoveEventListener(this, eventType, listener, useCapture);
 }
 
 void Node::removeAllEventListeners()
 {
-    if (hasEventListeners())
-        EventHandlerRegistry::from(document())->didRemoveAllEventHandlers(*this);
+    if (hasEventListeners() && document().page())
+        EventHandlerRegistry::from(*document().page())->didRemoveAllEventHandlers(*this);
     EventTarget::removeAllEventListeners();
     document().didClearTouchEventHandlers(this);
 }
 
 void Node::removeAllEventListenersRecursively()
 {
     for (Node* node = this; node; node = NodeTraversal::next(*node)) {
         node->removeAllEventListeners();
         for (ShadowRoot* root = node->youngestShadowRoot(); root; root = root->olderShadowRoot())
             root->removeAllEventListenersRecursively();
@@ skipping 526 matching lines @@
         node->showTreeForThis();
 }
 
 void showNodePath(const WebCore::Node* node)
 {
     if (node)
         node->showNodePathForThis();
 }
 
 #endif