When a function handling an event doesn't return a value, it leaves

the "event" object on the global context. This namespace pollution
was causing some functionality that was trying to detect if we were
in an event, such as popup blocking, to go wrong.

BUG=6367
Review URL: http://codereview.chromium.org/18013

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@8050 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 12 insertions, 7 deletions

diff --git a/webkit/port/bindings/v8/v8_events.cpp b/webkit/port/bindings/v8/v8_events.cpp
index d0ff3ba..7aecbb1 100644
--- a/webkit/port/bindings/v8/v8_events.cpp
+++ b/webkit/port/bindings/v8/v8_events.cpp
@@ -1,10 +1,10 @@
 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
-// 
+//
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
-// 
+//
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
 //     * Neither the name of Google Inc. nor the names of its
 // contributors may be used to endorse or promote products derived from
 // this software without specific prior written permission.
-// 
+//
 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -84,6 +84,10 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent) {
 
   v8::Handle<v8::Value> jsevent = V8Proxy::EventToV8Object(event);
 
+  // For compatibility, we store the event object as a property on the window
+  // called "event".  Because this is the global namespace, we save away any
+  // existing "event" property, and then restore it after executing the
+  // javascript handler.
   v8::Local<v8::String> event_symbol = v8::String::NewSymbol("event");
 
   // Save the old 'event' property.
@@ -107,6 +111,10 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent) {
     ret = CallListenerFunction(jsevent, event, isWindowEvent);
   }
 
+  // Restore the old event. This must be done for all exit paths through
+  // this method.
+  context->Global()->Set(event_symbol, saved_evt);
+
   if (V8Proxy::HandleOutOfMemory())
     ASSERT(ret.IsEmpty());
 
@@ -128,9 +136,6 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent) {
     }
   }
 
-  // Restore the old event.
-  context->Global()->Set(event_symbol, saved_evt);
-
   Document::updateDocumentsRendering();
 }
 
@@ -152,7 +157,7 @@ v8::Local<v8::Object> V8AbstractEventListener::GetReceiverObject(
   if (!m_listener.IsEmpty() && !m_listener->IsFunction()) {
     return v8::Local<v8::Object>::New(m_listener);
   }
-  
+
   if (isWindowEvent) {
     return v8::Context::GetCurrent()->Global();
   }