Changeset 215486 in webkit


Ignore:
Timestamp:
Apr 18, 2017 4:27:04 PM (7 years ago)
Author:
Brent Fulgham
Message:

Correct handling of isolatedWorld in event handling
​https://bugs.webkit.org/show_bug.cgi?id=65589
<rdar://problem/24097804>

Reviewed by Geoffrey Garen.

Source/WebCore:

This patch was inspired by Adam's original patch as well as the
following Blink change:
​https://src.chromium.org/viewvc/blink?revision=152377&view=revision

Thread isolatedWorld state through event handling logic.

Tests: fast/dom/event-attrs-isolated-world.html

http/tests/security/isolatedWorld/onclick-attribute.html

  • bindings/js/JSEventListener.cpp:

(WebCore::JSEventListener::initializeJSFunction):
(WebCore::JSEventListener::world):
(WebCore::eventHandlerAttribute):
(WebCore::setEventHandlerAttribute):
(WebCore::windowEventHandlerAttribute):
(WebCore::setWindowEventHandlerAttribute):
(WebCore::documentEventHandlerAttribute):
(WebCore::setDocumentEventHandlerAttribute):

  • bindings/js/JSEventListener.h:
  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

  • dom/Document.cpp:

(WebCore::Document::setWindowAttributeEventListener):
(WebCore::Document::getWindowAttributeEventListener):

  • dom/Document.h:
  • dom/Element.cpp:

(WebCore::Element::setAttributeEventListener):

  • dom/EventTarget.cpp:

(WebCore::EventTarget::setAttributeEventListener):
(WebCore::EventTarget::attributeEventListener):

  • dom/EventTarget.h:
  • editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplacementFragment::ReplacementFragment):

  • html/HTMLBodyElement.cpp:

(WebCore::HTMLBodyElement::parseAttribute):

  • html/HTMLFrameSetElement.cpp:

(WebCore::HTMLFrameSetElement::parseAttribute):

  • svg/SVGSVGElement.cpp:

(WebCore::SVGSVGElement::parseAttribute):

LayoutTests:

This following test cases are from the following Blink change:
​https://src.chromium.org/viewvc/blink?revision=152377&view=revision

  • fast/dom/event-attrs-isolated-world-expected.txt: Added.
  • fast/dom/event-attrs-isolated-world.html: Added.
  • http/tests/security/isolatedWorld/onclick-attribute-expected.txt: Added.
  • http/tests/security/isolatedWorld/onclick-attribute.html: Added.
Location:
trunk
Files:
4 added
14 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r215484 r215486  
     12017-04-18  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Correct handling of isolatedWorld in event handling
     4        https://bugs.webkit.org/show_bug.cgi?id=65589
     5        <rdar://problem/24097804>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        This following test cases are from the following Blink change:
     10        https://src.chromium.org/viewvc/blink?revision=152377&view=revision
     11
     12        * fast/dom/event-attrs-isolated-world-expected.txt: Added.
     13        * fast/dom/event-attrs-isolated-world.html: Added.
     14        * http/tests/security/isolatedWorld/onclick-attribute-expected.txt: Added.
     15        * http/tests/security/isolatedWorld/onclick-attribute.html: Added.
     16
    1172017-04-18  Wenson Hsieh  <wenson_hsieh@apple.com>
    218

  • trunk/Source/WebCore/ChangeLog

    r215485 r215486  
     12017-04-18  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Correct handling of isolatedWorld in event handling
     4        https://bugs.webkit.org/show_bug.cgi?id=65589
     5        <rdar://problem/24097804>
     6
     7        Reviewed by Geoffrey Garen.
     8
     9        This patch was inspired by Adam's original patch as well as the
     10        following Blink change:
     11        https://src.chromium.org/viewvc/blink?revision=152377&view=revision
     12
     13        Thread isolatedWorld state through event handling logic.
     14
     15        Tests: fast/dom/event-attrs-isolated-world.html
     16               http/tests/security/isolatedWorld/onclick-attribute.html
     17
     18        * bindings/js/JSEventListener.cpp:
     19        (WebCore::JSEventListener::initializeJSFunction):
     20        (WebCore::JSEventListener::world):
     21        (WebCore::eventHandlerAttribute):
     22        (WebCore::setEventHandlerAttribute):
     23        (WebCore::windowEventHandlerAttribute):
     24        (WebCore::setWindowEventHandlerAttribute):
     25        (WebCore::documentEventHandlerAttribute):
     26        (WebCore::setDocumentEventHandlerAttribute):
     27        * bindings/js/JSEventListener.h:
     28        * bindings/scripts/CodeGeneratorJS.pm:
     29        (GenerateImplementation):
     30        * dom/Document.cpp:
     31        (WebCore::Document::setWindowAttributeEventListener):
     32        (WebCore::Document::getWindowAttributeEventListener):
     33        * dom/Document.h:
     34        * dom/Element.cpp:
     35        (WebCore::Element::setAttributeEventListener):
     36        * dom/EventTarget.cpp:
     37        (WebCore::EventTarget::setAttributeEventListener):
     38        (WebCore::EventTarget::attributeEventListener):
     39        * dom/EventTarget.h:
     40        * editing/ReplaceSelectionCommand.cpp:
     41        (WebCore::ReplacementFragment::ReplacementFragment):
     42        * html/HTMLBodyElement.cpp:
     43        (WebCore::HTMLBodyElement::parseAttribute):
     44        * html/HTMLFrameSetElement.cpp:
     45        (WebCore::HTMLFrameSetElement::parseAttribute):
     46        * svg/SVGSVGElement.cpp:
     47        (WebCore::SVGSVGElement::parseAttribute):
     48
    1492017-04-18  Jeremy Jones  <jeremyj@apple.com>
    250

  • trunk/Source/WebCore/bindings/js/JSEventListener.cpp

    r215477 r215486  
    11/*
    22 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
    3  *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All Rights Reserved.
     3 *  Copyright (C) 2003-2017 Apple Inc. All Rights Reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    6363JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
    6464{
    65     return 0;
     65    return nullptr;
    6666}
    6767
    … …  
    217217}
    218218
    219 JSC::JSValue eventHandlerAttribute(EventTarget& target, const AtomicString& eventType)
    220 {
    221     return eventHandlerAttribute(target.attributeEventListener(eventType), *target.scriptExecutionContext());
     219JSC::JSValue eventHandlerAttribute(EventTarget& target, const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
     220{
     221    return eventHandlerAttribute(target.attributeEventListener(eventType, isolatedWorld), *target.scriptExecutionContext());
    222222}
    223223
    224224void setEventHandlerAttribute(JSC::ExecState& state, JSC::JSObject& wrapper, EventTarget& target, const AtomicString& eventType, JSC::JSValue value)
    225225{
    226     target.setAttributeEventListener(eventType, createEventListenerForEventHandlerAttribute(state, value, wrapper));
    227 }
    228 
    229 JSC::JSValue windowEventHandlerAttribute(HTMLElement& element, const AtomicString& eventType)
     226    target.setAttributeEventListener(eventType, createEventListenerForEventHandlerAttribute(state, value, wrapper), currentWorld(&state));
     227}
     228
     229JSC::JSValue windowEventHandlerAttribute(HTMLElement& element, const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
    230230{
    231231    auto& document = element.document();
    232     return eventHandlerAttribute(document.getWindowAttributeEventListener(eventType), document);
     232    return eventHandlerAttribute(document.getWindowAttributeEventListener(eventType, isolatedWorld), document);
    233233}
    234234
    … …  
    236236{
    237237    ASSERT(wrapper.globalObject());
    238     element.document().setWindowAttributeEventListener(eventType, createEventListenerForEventHandlerAttribute(state, value, *wrapper.globalObject()));
    239 }
    240 
    241 JSC::JSValue windowEventHandlerAttribute(DOMWindow& window, const AtomicString& eventType)
    242 {
    243     return eventHandlerAttribute(window, eventType);
     238    element.document().setWindowAttributeEventListener(eventType, createEventListenerForEventHandlerAttribute(state, value, *wrapper.globalObject()), currentWorld(&state));
     239}
     240
     241JSC::JSValue windowEventHandlerAttribute(DOMWindow& window, const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
     242{
     243    return eventHandlerAttribute(window, eventType, isolatedWorld);
    244244}
    245245
    … …  
    249249}
    250250
    251 JSC::JSValue documentEventHandlerAttribute(HTMLElement& element, const AtomicString& eventType)
     251JSC::JSValue documentEventHandlerAttribute(HTMLElement& element, const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
    252252{
    253253    auto& document = element.document();
    254     return eventHandlerAttribute(document.attributeEventListener(eventType), document);
     254    return eventHandlerAttribute(document.attributeEventListener(eventType, isolatedWorld), document);
    255255}
    256256
    … …  
    261261    auto* documentWrapper = JSC::jsCast<JSDocument*>(toJS(&state, JSC::jsCast<JSDOMGlobalObject*>(wrapper.globalObject()), document));
    262262    ASSERT(documentWrapper);
    263     document.setAttributeEventListener(eventType, createEventListenerForEventHandlerAttribute(state, value, *documentWrapper));
    264 }
    265 
    266 JSC::JSValue documentEventHandlerAttribute(Document& document, const AtomicString& eventType)
    267 {
    268     return eventHandlerAttribute(document, eventType);
     263    document.setAttributeEventListener(eventType, createEventListenerForEventHandlerAttribute(state, value, *documentWrapper), currentWorld(&state));
     264}
     265
     266JSC::JSValue documentEventHandlerAttribute(Document& document, const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
     267{
     268    return eventHandlerAttribute(document, eventType, isolatedWorld);
    269269}
    270270

  • trunk/Source/WebCore/bindings/js/JSEventListener.h

    r209627 r215486  
    11/*
    22 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
    3  *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    2626#include <heap/WeakInlines.h>
    2727#include <wtf/Ref.h>
     28#include <wtf/TypeCasts.h>
    2829#include <wtf/text/TextPosition.h>
    2930#include <wtf/text/WTFString.h>
    … …  
    9293
    9394// For "onxxx" attributes that automatically set up JavaScript event listeners.
    94 JSC::JSValue eventHandlerAttribute(EventTarget&, const AtomicString& eventType);
     95JSC::JSValue eventHandlerAttribute(EventTarget&, const AtomicString& eventType, DOMWrapperWorld&);
    9596void setEventHandlerAttribute(JSC::ExecState&, JSC::JSObject&, EventTarget&, const AtomicString& eventType, JSC::JSValue);
    9697
    9798// Like the functions above, but for attributes that forward event handlers to the window object rather than setting them on the target.
    98 JSC::JSValue windowEventHandlerAttribute(HTMLElement&, const AtomicString& eventType);
     99JSC::JSValue windowEventHandlerAttribute(HTMLElement&, const AtomicString& eventType, DOMWrapperWorld&);
    99100void setWindowEventHandlerAttribute(JSC::ExecState&, JSC::JSObject&, HTMLElement&, const AtomicString& eventType, JSC::JSValue);
    100 JSC::JSValue windowEventHandlerAttribute(DOMWindow&, const AtomicString& eventType);
     101JSC::JSValue windowEventHandlerAttribute(DOMWindow&, const AtomicString& eventType, DOMWrapperWorld&);
    101102void setWindowEventHandlerAttribute(JSC::ExecState&, JSC::JSObject&, DOMWindow&, const AtomicString& eventType, JSC::JSValue);
    102103
    103104// Like the functions above, but for attributes that forward event handlers to the document rather than setting them on the target.
    104 JSC::JSValue documentEventHandlerAttribute(HTMLElement&, const AtomicString& eventType);
     105JSC::JSValue documentEventHandlerAttribute(HTMLElement&, const AtomicString& eventType, DOMWrapperWorld&);
    105106void setDocumentEventHandlerAttribute(JSC::ExecState&, JSC::JSObject&, HTMLElement&, const AtomicString& eventType, JSC::JSValue);
    106 JSC::JSValue documentEventHandlerAttribute(Document&, const AtomicString& eventType);
     107JSC::JSValue documentEventHandlerAttribute(Document&, const AtomicString& eventType, DOMWrapperWorld&);
    107108void setDocumentEventHandlerAttribute(JSC::ExecState&, JSC::JSObject&, Document&, const AtomicString& eventType, JSC::JSValue);
    108109
    … …  
    139140
    140141} // namespace WebCore
     142
     143SPECIALIZE_TYPE_TRAITS_BEGIN(WebCore::JSEventListener)
     144static bool isType(const WebCore::EventListener& input) { return input.type() == WebCore::JSEventListener::JSEventListenerType; }
     145SPECIALIZE_TYPE_TRAITS_END()

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r215477 r215486  
    36873687                    : "eventHandlerAttribute";
    36883688                my $eventName = EventHandlerAttributeEventName($attribute);
    3689                 push(@implContent, "    return $getter(thisObject.wrapped(), $eventName);\n");
     3689                push(@implContent, "    return $getter(thisObject.wrapped(), $eventName, worldForDOMObject(&thisObject));\n");
    36903690            } elsif ($codeGenerator->IsConstructorType($attribute->type)) {
    36913691                my $constructorType = $attribute->type->name;
    … …  
    38643864                if ((($interfaceName eq "DOMWindow") or ($interfaceName eq "WorkerGlobalScope")) and $name eq "onerror") {
    38653865                    $implIncludes{"JSErrorHandler.h"} = 1;
    3866                     push(@implContent, "    thisObject.wrapped().setAttributeEventListener($eventName, createJSErrorHandler(&state, value, &thisObject));\n");
     3866                    push(@implContent, "    thisObject.wrapped().setAttributeEventListener($eventName, createJSErrorHandler(&state, value, &thisObject), worldForDOMObject(&thisObject));\n");
    38673867                } else {
    38683868                    $implIncludes{"JSEventListener.h"} = 1;

  • trunk/Source/WebCore/dom/Document.cpp

    r215465 r215486  
    39943994}
    39953995
    3996 void Document::setAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& attributeValue)
    3997 {
    3998     setAttributeEventListener(eventType, JSLazyEventListener::create(*this, attributeName, attributeValue));
    3999 }
    4000 
    4001 void Document::setWindowAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&& listener)
     3996void Document::setAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& attributeValue, DOMWrapperWorld& isolatedWorld)
     3997{
     3998    setAttributeEventListener(eventType, JSLazyEventListener::create(*this, attributeName, attributeValue), isolatedWorld);
     3999}
     4000
     4001void Document::setWindowAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&& listener, DOMWrapperWorld& isolatedWorld)
    40024002{
    40034003    if (!m_domWindow)
    40044004        return;
    4005     m_domWindow->setAttributeEventListener(eventType, WTFMove(listener));
    4006 }
    4007 
    4008 void Document::setWindowAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& attributeValue)
     4005    m_domWindow->setAttributeEventListener(eventType, WTFMove(listener), isolatedWorld);
     4006}
     4007
     4008void Document::setWindowAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& attributeValue, DOMWrapperWorld& isolatedWorld)
    40094009{
    40104010    if (!m_domWindow)
    40114011        return;
    4012     setWindowAttributeEventListener(eventType, JSLazyEventListener::create(*m_domWindow, attributeName, attributeValue));
    4013 }
    4014 
    4015 EventListener* Document::getWindowAttributeEventListener(const AtomicString& eventType)
     4012    setWindowAttributeEventListener(eventType, JSLazyEventListener::create(*m_domWindow, attributeName, attributeValue), isolatedWorld);
     4013}
     4014
     4015EventListener* Document::getWindowAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
    40164016{
    40174017    if (!m_domWindow)
    40184018        return nullptr;
    4019     return m_domWindow->attributeEventListener(eventType);
     4019    return m_domWindow->attributeEventListener(eventType, isolatedWorld);
    40204020}
    40214021

  • trunk/Source/WebCore/dom/Document.h

    r215444 r215486  
    759759
    760760    // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
    761     void setWindowAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& value);
    762     void setWindowAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&&);
    763     EventListener* getWindowAttributeEventListener(const AtomicString& eventType);
     761    void setWindowAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& value, DOMWrapperWorld&);
     762    void setWindowAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&&, DOMWrapperWorld&);
     763    EventListener* getWindowAttributeEventListener(const AtomicString& eventType, DOMWrapperWorld&);
    764764    WEBCORE_EXPORT void dispatchWindowEvent(Event&, EventTarget* = nullptr);
    765765    void dispatchWindowLoadEvent();
    … …  
    12891289
    12901290    using ContainerNode::setAttributeEventListener;
    1291     void setAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& value);
     1291    void setAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& value, DOMWrapperWorld& isolatedWorld);
    12921292
    12931293    DOMSelection* getSelection();

  • trunk/Source/WebCore/dom/Element.cpp

    r214510 r215486  
    55 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    66 *           (C) 2007 David Smith (catfish.man@gmail.com)
    7  * Copyright (C) 2004-2016 Apple Inc. All rights reserved.
     7 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    88 *           (C) 2007 Eric Seidel (eric@webkit.org)
    99 *
    … …  
    20562056void Element::setAttributeEventListener(const AtomicString& eventType, const QualifiedName& attributeName, const AtomicString& attributeValue)
    20572057{
    2058     setAttributeEventListener(eventType, JSLazyEventListener::create(*this, attributeName, attributeValue));
     2058    setAttributeEventListener(eventType, JSLazyEventListener::create(*this, attributeName, attributeValue), mainThreadNormalWorld());
    20592059}
    20602060

  • trunk/Source/WebCore/dom/EventTarget.cpp

    r212321 r215486  
    33 *           (C) 1999 Antti Koivisto (koivisto@kde.org)
    44 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    5  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
     5 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    66 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
    77 *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
    … …  
    3333#include "EventTarget.h"
    3434
     35#include "DOMWrapperWorld.h"
    3536#include "EventNames.h"
    3637#include "ExceptionCode.h"
    3738#include "InspectorInstrumentation.h"
     39#include "JSEventListener.h"
    3840#include "NoEventDispatchAssertion.h"
    3941#include "ScriptController.h"
    … …  
    105107}
    106108
    107 bool EventTarget::setAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&& listener)
    108 {
    109     auto* existingListener = attributeEventListener(eventType);
     109bool EventTarget::setAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&& listener, DOMWrapperWorld& isolatedWorld)
     110{
     111    auto* existingListener = attributeEventListener(eventType, isolatedWorld);
    110112    if (!listener) {
    111113        if (existingListener)
    … …  
    120122}
    121123
    122 EventListener* EventTarget::attributeEventListener(const AtomicString& eventType)
     124EventListener* EventTarget::attributeEventListener(const AtomicString& eventType, DOMWrapperWorld& isolatedWorld)
    123125{
    124126    for (auto& eventListener : eventListeners(eventType)) {
    125         if (eventListener->callback().isAttribute())
    126             return &eventListener->callback();
    127     }
     127        auto& listener = eventListener->callback();
     128        if (!listener.isAttribute())
     129            continue;
     130
     131        auto& listenerWorld = downcast<JSEventListener>(listener).isolatedWorld();
     132        if (&listenerWorld == &isolatedWorld)
     133            return &listener;
     134    }
     135
    128136    return nullptr;
    129137}

  • trunk/Source/WebCore/dom/EventTarget.h

    r209570 r215486  
    33 *           (C) 1999 Antti Koivisto (koivisto@kde.org)
    44 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    5  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
     5 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    66 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
    77 *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
    … …  
    4242
    4343class DOMWindow;
     44class DOMWrapperWorld;
    4445class Node;
    4546
    … …  
    105106
    106107    // Used for legacy "onevent" attributes.
    107     bool setAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&&);
    108     EventListener* attributeEventListener(const AtomicString& eventType);
     108    bool setAttributeEventListener(const AtomicString& eventType, RefPtr<EventListener>&&, DOMWrapperWorld&);
     109    EventListener* attributeEventListener(const AtomicString& eventType, DOMWrapperWorld&);
    109110
    110111    bool hasEventListeners() const;

  • trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp

    r213355 r215486  
    11/*
    2  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
     2 * Copyright (C) 2005-2017 Apple Inc. All rights reserved.
    33 * Copyright (C) 2009, 2010, 2011 Google Inc. All rights reserved.
    44 *
    … …  
    3333#include "BreakBlockquoteCommand.h"
    3434#include "CSSStyleDeclaration.h"
     35#include "DOMWrapperWorld.h"
    3536#include "DataTransfer.h"
    3637#include "Document.h"
    … …  
    168169    Node* shadowAncestorNode = editableRoot->deprecatedShadowAncestorNode();
    169170   
    170     if (!editableRoot->attributeEventListener(eventNames().webkitBeforeTextInsertedEvent)
     171    if (!editableRoot->attributeEventListener(eventNames().webkitBeforeTextInsertedEvent, mainThreadNormalWorld())
    171172        && !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl())
    172173        && editableRoot->hasRichlyEditableStyle()) {

  • trunk/Source/WebCore/html/HTMLBodyElement.cpp

    r211591 r215486  
    44 *           (C) 2000 Simon Hausmann (hausmann@kde.org)
    55 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    6  * Copyright (C) 2004, 2006-2010, 2015 Apple Inc. All rights reserved.
     6 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    77 *
    88 * This library is free software; you can redistribute it and/or
    … …  
    2929#include "CSSValueKeywords.h"
    3030#include "DOMWindow.h"
     31#include "DOMWrapperWorld.h"
    3132#include "EventNames.h"
    3233#include "Frame.h"
    … …  
    174175
    175176    if (name == onselectionchangeAttr) {
    176         document().setAttributeEventListener(eventNames().selectionchangeEvent, name, value);
     177        document().setAttributeEventListener(eventNames().selectionchangeEvent, name, value, mainThreadNormalWorld());
    177178        return;
    178179    }
    … …  
    180181    auto& eventName = eventNameForWindowEventHandlerAttribute(name);
    181182    if (!eventName.isNull()) {
    182         document().setWindowAttributeEventListener(eventName, name, value);
     183        document().setWindowAttributeEventListener(eventName, name, value, mainThreadNormalWorld());
    183184        return;
    184185    }

  • trunk/Source/WebCore/html/HTMLFrameSetElement.cpp

    r214435 r215486  
    44 *           (C) 2000 Simon Hausmann (hausmann@kde.org)
    55 *           (C) 2001 Dirk Mueller (mueller@kde.org)
    6  * Copyright (C) 2004, 2006, 2009, 2010 Apple Inc. All rights reserved.
     6 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    77 *
    88 * This library is free software; you can redistribute it and/or
    … …  
    2626
    2727#include "CSSPropertyNames.h"
     28#include "DOMWrapperWorld.h"
    2829#include "Document.h"
    2930#include "ElementIterator.h"
    … …  
    143144    auto& eventName = HTMLBodyElement::eventNameForWindowEventHandlerAttribute(name);
    144145    if (!eventName.isNull()) {
    145         document().setWindowAttributeEventListener(eventName, name, value);
     146        document().setWindowAttributeEventListener(eventName, name, value, mainThreadNormalWorld());
    146147        return;
    147148    }

  • trunk/Source/WebCore/svg/SVGSVGElement.cpp

    r214503 r215486  
    22 * Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
    33 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Rob Buis <buis@kde.org>
    4  * Copyright (C) 2007, 2015 Apple Inc. All rights reserved.
     4 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    55 * Copyright (C) 2014 Adobe Systems Incorporated. All rights reserved.
    66 *
    … …  
    2525
    2626#include "CSSHelper.h"
     27#include "DOMWrapperWorld.h"
    2728#include "ElementIterator.h"
    2829#include "EventNames.h"
    … …  
    216217        // setting certain event handlers directly on the window object.
    217218        if (name == HTMLNames::onunloadAttr) {
    218             document().setWindowAttributeEventListener(eventNames().unloadEvent, name, value);
     219            document().setWindowAttributeEventListener(eventNames().unloadEvent, name, value, mainThreadNormalWorld());
    219220            return;
    220221        }
    221222        if (name == HTMLNames::onresizeAttr) {
    222             document().setWindowAttributeEventListener(eventNames().resizeEvent, name, value);
     223            document().setWindowAttributeEventListener(eventNames().resizeEvent, name, value, mainThreadNormalWorld());
    223224            return;
    224225        }
    225226        if (name == HTMLNames::onscrollAttr) {
    226             document().setWindowAttributeEventListener(eventNames().scrollEvent, name, value);
     227            document().setWindowAttributeEventListener(eventNames().scrollEvent, name, value, mainThreadNormalWorld());
    227228            return;
    228229        }
    229230        if (name == SVGNames::onzoomAttr) {
    230             document().setWindowAttributeEventListener(eventNames().zoomEvent, name, value);
     231            document().setWindowAttributeEventListener(eventNames().zoomEvent, name, value, mainThreadNormalWorld());
    231232            return;
    232233        }
    … …  
    237238    // FIXME: Why different from the events above that work only on the outermost <svg> element?
    238239    if (name == HTMLNames::onabortAttr) {
    239         document().setWindowAttributeEventListener(eventNames().abortEvent, name, value);
     240        document().setWindowAttributeEventListener(eventNames().abortEvent, name, value, mainThreadNormalWorld());
    240241        return;
    241242    }
    242243    if (name == HTMLNames::onerrorAttr) {
    243         document().setWindowAttributeEventListener(eventNames().errorEvent, name, value);
     244        document().setWindowAttributeEventListener(eventNames().errorEvent, name, value, mainThreadNormalWorld());
    244245        return;
    245246    }
Note: See TracChangeset for help on using the changeset viewer.