Always remove registered handlers for deleted node

Source/web/tests/WebViewTest.cpp

Index: Source/web/tests/WebViewTest.cpp
diff --git a/Source/web/tests/WebViewTest.cpp b/Source/web/tests/WebViewTest.cpp
index 503729fa0320edab3c04c63acccb6406e8e0ce03..60a64287b59825d9f426122b721fd0f98052d5b6 100644
--- a/Source/web/tests/WebViewTest.cpp
+++ b/Source/web/tests/WebViewTest.cpp
@@ -33,6 +33,7 @@
 
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
+#include "core/frame/EventHandlerRegistry.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ -1798,6 +1799,28 @@ TEST_F(WebViewTest, HasTouchEventHandlers)
     m_webViewHelper.reset();
 }
 
+// This test checks that deleting nodes which have only non-JS-registered touch
+// handlers also removes them from the event handler registry. Note that this
+// is different from detaching and re-attaching the same node, which is covered
+// by layout tests under fast/events/.
+TEST_F(WebViewTest, DeleteElementWithRegisteredHandler)
+{
+    std::string url = m_baseURL + "simple_div.html";
+    URLTestHelpers::registerMockedURLLoad(toKURL(url), "simple_div.html");
+    WebViewImpl* webViewImpl = m_webViewHelper.initializeAndLoad(url, true);
+
+    WebCore::Document* document = webViewImpl->mainFrameImpl()->frame()->document();
+    WebCore::Element* div = document->getElementById("div");
+    WebCore::EventHandlerRegistry& registry = document->frameHost()->eventHandlerRegistry();
+
+    registry.didAddEventHandler(*div, WebCore::EventHandlerRegistry::ScrollEvent);
+    EXPECT_TRUE(registry.hasEventHandlers(WebCore::EventHandlerRegistry::ScrollEvent));
+
+    WebCore::TrackExceptionState exceptionState;
+    div->remove(exceptionState);
+    EXPECT_FALSE(registry.hasEventHandlers(WebCore::EventHandlerRegistry::ScrollEvent));
+}
+
 static WebRect ExpectedRootBounds(WebCore::Document* document, float scaleFactor)
 {
     WebCore::Element* element = document->getElementById("root");