Don't expose the user agent shadow tree

Don't expose the user agent shadow tree used for the cloned <use> tree. Add one test for the attribute event listener code path (onclick) and one for addEventListener API. To make sure the shadow tree is not exposed, make sure we always wrap non-shadow tree SVG Elements.

BUG=313438

Review URL: https://codereview.chromium.org/312423002

git-svn-id: svn://svn.chromium.org/blink/trunk@176065 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/svg/custom/use-event-handler-on-referenced-element-addEventListener-expected.txt

+Test passed.
+

third_party/WebKit/LayoutTests/svg/custom/use-event-handler-on-referenced-element-addEventListener.svg

+<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="clickRect()">
+  <script xlink:href="../../fast/repaint/resources/text-based-repaint.js"/>
+  <defs id="hidden">
+    <g id="reference">
+      <rect id="referenceRect" x="240" y="1" width="239" height="358"/>
+    </g>
+
+   <script type="text/ecmascript">
+    <![CDATA[
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    function clickRect() {
+        if (window.eventSender) {
+            testRunner.waitUntilDone();
+            eventSender.mouseMoveTo(250, 50);
+            eventSender.mouseDown();
+            eventSender.mouseUp();
+        }
+    }
+
+    function test() {
+        var rect = this;
+        var g = document.getElementById("reference");
+        var defs = document.getElementById("hidden");
+        if (rect.parentNode == g && rect.parentNode.parentNode == defs)
+            document.getElementById("text").firstChild.nodeValue = "Test passed.";
+        if (window.testRunner)
+            testRunner.notifyDone();
+    }
+    var el = document.getElementById("referenceRect");
+    el.addEventListener("click", test, false);
+
+    var use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+    use.setAttribute("fill", "grey");
+    use.setAttributeNS('http://www.w3.org/1999/xlink', 'xlink:href', '#reference')
+    document.documentElement.appendChild(use);
+    ]]>
+    </script>
+  </defs>
+
+  <text id="text" transform="translate(5,20)">Test failed.</text>
+  <rect id="test-frame" x="1" y="1" width="478" height="358" fill="none" stroke="#000"/>
+</svg>

third_party/WebKit/LayoutTests/svg/custom/use-event-handler-on-referenced-element-hierarchy-expected.txt

+Test passed.
+

third_party/WebKit/LayoutTests/svg/custom/use-event-handler-on-referenced-element-hierarchy.svg

+<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="clickRect()">
+  <script xlink:href="../../fast/repaint/resources/text-based-repaint.js"/>
+  <defs id="hidden">
+    <g id="reference">
+      <rect onclick="test(evt)" id="referenceRect" x="240" y="1" width="239" height="358"/>
+    </g>
+
+   <script type="text/ecmascript">
+    <![CDATA[
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    function clickRect() {
+        if (window.eventSender) {
+            testRunner.waitUntilDone();
+            eventSender.mouseMoveTo(250, 50);
+            eventSender.mouseDown();
+            eventSender.mouseUp();
+        }
+    }
+
+    function test(evt) {
+        var rect = evt.currentTarget;
+        var g = document.getElementById("reference");
+        var defs = document.getElementById("hidden");
+        if (rect.parentNode == g && rect.parentNode.parentNode == defs)
+            document.getElementById("text").firstChild.nodeValue = "Test passed.";
+        if (window.testRunner)
+            testRunner.notifyDone();
+    }
+    ]]>
+    </script>
+  </defs>
+
+  <use xlink:href="#reference" fill="grey"/>
+
+  <text id="text" transform="translate(5,20)">Test failed.</text>
+  <rect id="test-frame" x="1" y="1" width="478" height="358" fill="none" stroke="#000"/>
+</svg>

third_party/WebKit/Source/core/events/Event.cpp

@@ -26,6 +26,7 @@
 #include "core/dom/StaticNodeList.h"
 #include "core/events/EventTarget.h"
 #include "core/frame/UseCounter.h"
+#include "core/svg/SVGElement.h"
 #include "wtf/CurrentTime.h"
 
 namespace WebCore {
@@ -233,6 +234,18 @@ PassRefPtrWillBeRawPtr<NodeList> Event::path() const
     return StaticNodeList::createEmpty();
 }
 
+EventTarget* Event::currentTarget() const
+{
+    if (!m_currentTarget)
+        return 0;
+    Node* node = m_currentTarget->toNode();
+    if (node && node->isSVGElement()) {
+        if (SVGElement* svgElement = toSVGElement(node)->correspondingElement())
+            return svgElement;
+    }
+    return m_currentTarget;
+}
+
 void Event::trace(Visitor* visitor)
 {
     visitor->trace(m_target);

third_party/WebKit/Source/core/events/Event.h

@@ -114,7 +114,7 @@ public:
     EventTarget* target() const { return m_target.get(); }
     void setTarget(PassRefPtrWillBeRawPtr<EventTarget>);
 
-    EventTarget* currentTarget() const { return m_currentTarget; }
+    EventTarget* currentTarget() const;
     void setCurrentTarget(EventTarget* currentTarget) { m_currentTarget = currentTarget; }
 
     unsigned short eventPhase() const { return m_eventPhase; }

third_party/WebKit/Source/core/svg/SVGUseElement.cpp

@@ -352,6 +352,8 @@ static PassRefPtrWillBeRawPtr<Node> cloneNodeAndAssociate(Node& toClone)
     SVGElement& svgElement = toSVGElement(toClone);
     ASSERT(!svgElement.correspondingElement());
     toSVGElement(clone.get())->setCorrespondingElement(&svgElement);
+    if (EventTargetData* data = toClone.eventTargetData())
+        data->eventListenerMap.copyEventListenersNotCreatedFromMarkupToTarget(clone.get());
     TrackExceptionState exceptionState;
     for (Node* node = toClone.firstChild(); node && !exceptionState.hadException(); node = node->nextSibling())
         clone->appendChild(cloneNodeAndAssociate(*node), exceptionState);
@@ -483,6 +485,8 @@ bool SVGUseElement::buildShadowTree(SVGElement* target, SVGElement* targetInstan
     }
 
     targetInstance->setCorrespondingElement(target);
+    if (EventTargetData* data = target->eventTargetData())
+        data->eventListenerMap.copyEventListenersNotCreatedFromMarkupToTarget(targetInstance);
 
     for (Node* child = target->firstChild(); child; child = child->nextSibling()) {
         // Skip any disallowed element.