Chromium Code Reviews Chromium Code Reviews
Issue
10532125:
Merge 117928 - REGRESSION r110315: Event handler throws TypeError for an input element with name="a… (Closed)
DescriptionMerge 117928 - REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments"
https://bugs.webkit.org/show_bug.cgi?id=86991
Reviewed by Ojan Vafai.
Source/WebCore:
Original Chromium bug: http://code.google.com/p/chromium/issues/detail?id=128723
Consider the following html:
<html><body><form>
<input type="hidden" name="arguments"></input>
<div onclick="onclicked()" id="divInsideForm">Click here</div>
</form></body>
<script>
function onclicked() {
alert("onclicked");
}
</script>
</html>
If we click "Click here", JavaScript throws "Uncaught TypeError: undefined has no properties".
This is a regression caused by r110315. V8LazyEventListener should not use
'arguments' to retrieve the execution contexts, since 'arguments' can be
shadowed by JavaScript.
This patch changes V8LazyEventListener so that it retrieves contexts
by this[2], this[1] and this[0].
Test: fast/forms/form-input-named-arguments.html
* bindings/v8/V8LazyEventListener.cpp:
(WebCore::V8LazyEventListener::prepareListenerObject):
LayoutTests:
The added test checks whether an event handler is successfully invoked
for an input element with name="arguments".
* fast/forms/form-input-named-arguments-expected.txt: Added.
* fast/forms/form-input-named-arguments.html: Added.
TBR=haraken@chromium.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=120197
Patch Set 1 #
Messages
Total messages: 1 (0 generated)
|
||||||||||||||||||||||||||||||||||||||||||||||
