Merge 117928 - REGRESSION r110315: Event handler throws TypeError for an input element with name="a…

Source/WebCore/bindings/v8/V8LazyEventListener.cpp

Index: Source/WebCore/bindings/v8/V8LazyEventListener.cpp
===================================================================
--- Source/WebCore/bindings/v8/V8LazyEventListener.cpp	(revision 120196)
+++ Source/WebCore/bindings/v8/V8LazyEventListener.cpp	(working copy)
@@ -137,16 +137,21 @@
     // FIXME: V8 does not allow us to programmatically create object environments so
     //        we have to do this hack! What if m_code escapes to run arbitrary script?
     //
+    // Call with 4 arguments instead of 3, pass additional null as the last parameter.
+    // By calling the function with 4 arguments, we create a setter on arguments object
+    // which would shadow property "3" on the prototype.
     String code = "(function() {" \
-        "with (arguments[2]) {" \
-        "with (arguments[1]) {" \
-        "with (arguments[0]) {";
+        "arguments[3] = function() {" \
+        "with (this[2]) {" \
+        "with (this[1]) {" \
+        "with (this[0]) {";
     code.append("return function(");
     code.append(m_eventParameterName);
     code.append(") {");
     code.append(m_code);
     // Insert '\n' otherwise //-style comments could break the handler.
-    code.append("\n};}}}})");
+    code.append("\n};}}}};");
+    code.append("return arguments[3]();})");
     v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
 
     v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);
@@ -174,7 +179,7 @@
     v8::Handle<v8::Object> formWrapper = toObjectWrapper<HTMLFormElement>(formElement);
     v8::Handle<v8::Object> documentWrapper = toObjectWrapper<Document>(m_node ? m_node->ownerDocument() : 0);
 
-    v8::Handle<v8::Value> parameters[3] = { nodeWrapper, formWrapper, documentWrapper };
+    v8::Handle<v8::Value> parameters[4] = { nodeWrapper, formWrapper, documentWrapper, v8::Handle<v8::Value>(v8::Null()) };
 
     // FIXME: Remove this code when we stop doing the 'with' hack above.
     v8::Local<v8::Value> innerValue;