Remove window.event support for V1 ShadowDOM

window.event should be undefined if an Event's target is in a shadow tree, because it is leaking information from inside the shadow tree. This change will remove window.event support for events targeted to nodes within a V1 shadow tree. Discussion link: https://github.com/whatwg/dom/issues/334 Bug: 779461 Change-Id: I310bc72463369befd693de9321a9949a97e83f5e Reviewed-on: https://chromium-review.googlesource.com/773922 Commit-Queue: Rakina Zata Amni <rakina@chromium.org> Reviewed-by: Takayoshi Kochi <kochi@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Reviewed-by: Yuki Shiino <yukishiino@chromium.org> Cr-Commit-Position: refs/heads/master@{#518317}

Remove window.event support for V1 ShadowDOM
window.event should be undefined if an Event's target is in a shadow tree, because it is leaking information from inside the shadow tree. This change will remove window.event support for events targeted to nodes within a V1 shadow tree. Discussion link: https://github.com/whatwg/dom/issues/334 Bug: 779461 Change-Id: I310bc72463369befd693de9321a9949a97e83f5e Reviewed-on: https://chromium-review.googlesource.com/773922 Commit-Queue: Rakina Zata Amni <rakina@chromium.org> Reviewed-by: Takayoshi Kochi <kochi@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Reviewed-by: Yuki Shiino <yukishiino@chromium.org> Cr-Commit-Position: refs/heads/master@{#518317}
7997dbe6 · Rakina Zata Amni · Commit Bot · 977673c3 · 7997dbe6 · 7997dbe6
Commit 7997dbe6 authored Nov 21, 2017 by Rakina Zata Amni Committed by Commit Bot Nov 21, 2017
3 changed files
--- a/third_party/WebKit/LayoutTests/shadow-dom/slotchange.html
+++ b/third_party/WebKit/LayoutTests/shadow-dom/slotchange.html
@@ -31,9 +31,9 @@ async_test((test) => {
  removeWhiteSpaceOnlyTextNodes(n.test1);

  n.shadowroot.addEventListener('slotchange', test.step_func_done((e) => {
-    assert_true(event.bubbles, 'A slotchange should be a bubbling event');
-    assert_false(event.composed, 'A slotchange should be a non-composed event')
-    assert_equals(event.target, n.s1);
+    assert_true(e.bubbles, 'A slotchange should be a bubbling event');
+    assert_false(e.composed, 'A slotchange should be a non-composed event')
+    assert_equals(e.target, n.s1);
  }))

  let d1 = document.createElement('div');

--- a/third_party/WebKit/LayoutTests/shadow-dom/window-event.html
+++ b/third_party/WebKit/LayoutTests/shadow-dom/window-event.html
+<!DOCTYPE html>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+
+<div id="test">
+  <div id="normal-div"></div>
+  <div id="shadow-host-v0"></div>
+  <div id="shadow-host-v1"></div>
+</div>
+
+<script>
+const normalDiv = document.querySelector('#normal-div');
+const shadowHostV0 = document.querySelector('#shadow-host-v0');
+shadowHostV0.createShadowRoot();
+const shadowHostV1 = document.querySelector('#shadow-host-v1');
+shadowHostV1.attachShadow({mode : 'open'});
+const test_event = new Event('test_event');
+
+async_test((test) => {
+  normalDiv.addEventListener('test_event', test.step_func_done((e) => {
+    assert_not_equals(event, null);
+    assert_equals(event, e);
+    assert_equals(event, test_event);
+  }));
+  normalDiv.dispatchEvent(test_event);
+}, 'window.event should contain the current event being handled when the target is a normal DOM node');
+
+async_test((test) => {
+  shadowHostV0.shadowRoot.addEventListener('test_event', test.step_func_done((e) => {
+    assert_not_equals(event, null);
+    assert_equals(event, e);
+    assert_equals(event, test_event);
+  }));
+  shadowHostV0.shadowRoot.dispatchEvent(test_event);
+}, 'window.event should contain the current event being handled when the target is a V0 Shadow DOM node');
+
+async_test((test) => {
+  shadowHostV1.shadowRoot.addEventListener('test_event', test.step_func_done((e) => {
+    assert_equals(event, undefined);
+    assert_not_equals(event, e);
+  }));
+  shadowHostV1.shadowRoot.dispatchEvent(test_event);
+}, 'window.event should be undefined when the target of the current event being handled is a V1 Shadow DOM node');
+
+</script>
--- a/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
@@ -139,9 +139,15 @@ void V8AbstractEventListener::InvokeEventHandler(
    v8::Local<v8::Value> saved_event = event_symbol.GetOrUndefined(global);
    try_catch.Reset();

-    // Make the event available in the global object, so LocalDOMWindow can
-    // expose it.
-    event_symbol.Set(global, js_event);
+    // Expose the event object as |window.event|, except when the event's target
+    // is in a V1 shadow tree, in which case |window.event| should be
+    // |undefined|.
+    Node* target_node = event->target()->ToNode();
+    if (target_node && target_node->IsInV1ShadowTree()) {
+      event_symbol.Set(global, v8::Undefined(GetIsolate()));
+    } else {
+      event_symbol.Set(global, js_event);
+    }
    try_catch.Reset();

    return_value = CallListenerFunction(script_state, js_event, event);