ScriptState used by EventListener::handleEvent() is wrong

Source/core/xml/DocumentXSLT.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/xml/DocumentXSLT.h"
 
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8AbstractEventListener.h"
@@ skipping 18 matching lines @@
     }
 
     using V8AbstractEventListener::ref;
     using V8AbstractEventListener::deref;
 
     virtual bool operator==(const EventListener&)
     {
         return true;
     }
 
-    virtual void handleEvent(ExecutionContext* context, Event* event)
+    virtual void handleEvent(ScriptState* scriptState, Event* event)
     {
         ASSERT(RuntimeEnabledFeatures::xsltEnabled());
         ASSERT(event->type() == "DOMContentLoaded");
-        ScriptState::Scope scope(scriptState());
+        ScriptState::Scope scope(scriptState);
 
-        Document& document = *toDocument(context);
+        Document& document = *toDocument(scriptState->executionContext());
         ASSERT(!document.parsing());
 
         // Processing instruction (XML documents only).
         // We don't support linking to embedded CSS stylesheets,
         // see <https://bugs.webkit.org/show_bug.cgi?id=49281> for discussion.
         // Don't apply XSL transforms to already transformed documents.
         if (DocumentXSLT::hasTransformSourceDocument(document))
             return;
 
         ProcessingInstruction* pi = DocumentXSLT::findXSLStyleSheet(document);
         if (!pi || pi != m_processingInstruction || pi->isLoading())
             return;
         DocumentXSLT::applyXSLTransform(document, pi);
     }
 
     virtual void detach() override
     {
         m_processingInstruction = nullptr;
     }
 
     virtual EventListener* toEventListener() override
     {
         return this;
     }
 
 private:
     DOMContentLoadedListener(ScriptState* scriptState, ProcessingInstruction* pi)
-        : V8AbstractEventListener(false, scriptState)
+        : V8AbstractEventListener(false, scriptState->world(), scriptState->isolate())
         , m_processingInstruction(pi)
     {
     }
 
     virtual void refDetachableEventListener() override { ref(); }
     virtual void derefDetachableEventListener() override { deref(); }
 
-    virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*)
+    virtual v8::Local<v8::Value> callListenerFunction(ScriptState*, v8::Handle<v8::Value>, Event*)
     {
         ASSERT_NOT_REACHED();
         return v8::Local<v8::Value>();
     }
 
     // If this event listener is attached to a ProcessingInstruction, keep a
     // weak reference back to it. That ProcessingInstruction is responsible for
     // detaching itself and clear out the reference.
     //
     // FIXME: Oilpan: when EventListener is on the heap, make this a WeakMember<>,
@@ skipping 104 matching lines @@
     return *supplement;
 }
 
 void DocumentXSLT::trace(Visitor* visitor)
 {
     visitor->trace(m_transformSourceDocument);
     DocumentSupplement::trace(visitor);
 }
 
 } // namespace blink