Extract a DOMWindow interface from LocalDOMWindow and use it in the idl.

Source/core/events/MouseRelatedEvent.cpp

Index: Source/core/events/MouseRelatedEvent.cpp
diff --git a/Source/core/events/MouseRelatedEvent.cpp b/Source/core/events/MouseRelatedEvent.cpp
index 9b7f32ec3a37666eff6bb73e64b3b17a7e226d55..42351626b9024296bcdc57d557f959ee7ebc096e 100644
--- a/Source/core/events/MouseRelatedEvent.cpp
+++ b/Source/core/events/MouseRelatedEvent.cpp
@@ -40,9 +40,9 @@ MouseRelatedEvent::MouseRelatedEvent()
 
 static LayoutSize contentsScrollOffset(AbstractView* abstractView)
 {
-    if (!abstractView)
+    if (!abstractView || !abstractView->isLocalDOMWindow())

[haraken, 2014/11/10 08:58:20]

Is it OK to return LayoutSize() for a RemoteDOMWindow?

[dcheng, 2014/11/10 09:29:43]

This code is hit on the path for initMouseEvent(). Since JS can pass any window
to initMouseEvent(), it could pass a window for a frame that is remote. I think
you could argue that the current implementation is actually an info leak. I
think you could potentially use it to detect page zoom across origins--pass a
cross-origin Window object to initMouseEvent() and observe how the
clientX/clientY coordinates change from the supplied values. In that respect, I
think that returning LayoutSize() is reasonable here.

         return LayoutSize();
-    LocalFrame* frame = abstractView->frame();
+    LocalFrame* frame = toLocalDOMWindow(abstractView)->frame();
     if (!frame)
         return LayoutSize();
     FrameView* frameView = frame->view();
@@ -64,7 +64,7 @@ MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubb
     LayoutPoint adjustedPageLocation;
     LayoutPoint scrollPosition;
 
-    LocalFrame* frame = view() ? view()->frame() : 0;
+    LocalFrame* frame = view() && view()->isLocalDOMWindow() ? toLocalDOMWindow(view())->frame() : 0;

[dcheng, 2014/11/10 09:29:43]

Note: looking at more code, I'm not sure if we can actually get a
RemoteDOMWindow here. I will probably change this to just call
toLocalDOMWindow() directly for the time being, and see if we get any errors
with the --site-per-process flag.

[dcheng, 2014/11/10 20:41:55]

Actually it turns out this is web-exposed:
https://code.google.com/p/chromium/codesearch#chromium/src/out/Debug/gen/blin...

UIEventInit/MouseEventInit can pass a user-supplied DOMWindow back to us. So we
can't eliminate this check =(

     if (frame && !isSimulated) {
         if (FrameView* frameView = frame->view()) {
             scrollPosition = frameView->scrollPosition();
@@ -110,10 +110,9 @@ void MouseRelatedEvent::initCoordinates(const LayoutPoint& clientLocation)
 
 static float pageZoomFactor(const UIEvent* event)
 {
-    LocalDOMWindow* window = event->view();
-    if (!window)
+    if (!event->view() || !event->view()->isLocalDOMWindow())

[haraken, 2014/11/10 08:58:20]

Is it OK to return 1 for a RemoteDOMWindow?

[dcheng, 2014/11/10 09:29:43]

This is similar to my previous comment.

         return 1;
-    LocalFrame* frame = window->frame();
+    LocalFrame* frame = toLocalDOMWindow(event->view())->frame();
     if (!frame)
         return 1;
     return frame->pageZoomFactor();