Track scroll event handlers in nested documents

Source/core/dom/Node.cpp

Index: Source/core/dom/Node.cpp
diff --git a/Source/core/dom/Node.cpp b/Source/core/dom/Node.cpp
index f7594b0770ea741ed1556cde05f78eba663f0848..eea724ab928135ab593780d672eab0d4ae9c2bed 100644
--- a/Source/core/dom/Node.cpp
+++ b/Source/core/dom/Node.cpp
@@ -42,7 +42,6 @@
 #include "core/dom/Element.h"
 #include "core/dom/ElementRareData.h"
 #include "core/dom/ElementTraversal.h"
-#include "core/dom/EventHandlerRegistry.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/LiveNodeList.h"
 #include "core/dom/NodeRareData.h"
@@ -80,6 +79,7 @@
 #include "core/html/HTMLStyleElement.h"
 #include "core/page/ContextMenuController.h"
 #include "core/page/EventHandler.h"
+#include "core/page/EventHandlerRegistry.h"
 #include "core/page/Page.h"
 #include "core/frame/Settings.h"
 #include "core/rendering/FlowThreadController.h"
@@ -292,7 +292,8 @@ void Node::willBeDeletedFromDocument()
     if (hasEventTargetData()) {
         clearEventTargetData();
         document.didClearTouchEventHandlers(this);
-        EventHandlerRegistry::from(document)->didRemoveAllEventHandlers(*this);
+        if (document.page())
+            EventHandlerRegistry::from(*document.page())->didRemoveAllEventHandlers(*this);
     }
 
     if (AXObjectCache* cache = document.existingAXObjectCache())
@@ -1943,7 +1944,8 @@ void Node::didMoveToNewDocument(Document& oldDocument)
             document().didAddTouchEventHandler(this);
         }
     }
-    EventHandlerRegistry::from(document())->didMoveFromOtherDocument(*this, oldDocument);
+    if (document().page())

[Rick Byers, 2014/04/24 21:30:12]

In what cases does a Document not have a Page?  It seems like whatever those
cases are we could have a problem getting caught up...

[Sami, 2014/04/25 19:51:15]

After a document is detached it will no longer have a page. However, it looks
like we remove all event handlers from a document before it is detached through
this call chain:

FrameLoader::detachFromParent
=> FrameLoader::closeURL
=> Document::dispatchUnloadEvents
=> Document::removeAllEventListenersRecursively

The only exception is for the transitional empty document
(https://bugs.webkit.org/show_bug.cgi?id=28716), but that only concerns window
handlers which we aren't tracking yet.

+        EventHandlerRegistry::from(*document().page())->didMoveFromOtherDocument(*this, oldDocument);
 
     if (Vector<OwnPtr<MutationObserverRegistration> >* registry = mutationObserverRegistry()) {
         for (size_t i = 0; i < registry->size(); ++i) {
@@ -1969,7 +1971,8 @@ static inline bool tryAddEventListener(Node* targetNode, const AtomicString& eve
         WheelController::from(document)->didAddWheelEventHandler(document);
     else if (isTouchEventType(eventType))
         document.didAddTouchEventHandler(targetNode);
-    EventHandlerRegistry::from(document)->didAddEventHandler(*targetNode, eventType);
+    if (document.page())
+        EventHandlerRegistry::from(*document.page())->didAddEventHandler(*targetNode, eventType);
 
     return true;
 }
@@ -1991,7 +1994,8 @@ static inline bool tryRemoveEventListener(Node* targetNode, const AtomicString&
         WheelController::from(document)->didRemoveWheelEventHandler(document);
     else if (isTouchEventType(eventType))
         document.didRemoveTouchEventHandler(targetNode);
-    EventHandlerRegistry::from(document)->didRemoveEventHandler(*targetNode, eventType);
+    if (document.page())
+        EventHandlerRegistry::from(*document.page())->didRemoveEventHandler(*targetNode, eventType);
 
     return true;
 }
@@ -2003,8 +2007,8 @@ bool Node::removeEventListener(const AtomicString& eventType, EventListener* lis
 
 void Node::removeAllEventListeners()
 {
-    if (hasEventListeners())
-        EventHandlerRegistry::from(document())->didRemoveAllEventHandlers(*this);
+    if (hasEventListeners() && document().page())
+        EventHandlerRegistry::from(*document().page())->didRemoveAllEventHandlers(*this);
     EventTarget::removeAllEventListeners();
     document().didClearTouchEventHandlers(this);
 }