1 files changed, 24 insertions, 7 deletions
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
index 8399c7a..afa8784 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -37,6 +37,7 @@
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
+#include <runtime/JSLock.h>
 
 using namespace JSC;
 
@@ -52,14 +53,18 @@ static const String& eventParameterName(bool isSVGEvent)
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
 
     int lineNumber = 1;
     String sourceURL;
+    JSObject* wrapper = 0;
     
     // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
     if (Frame* frame = node->document()->frame()) {
         ScriptController* scriptController = frame->script();
-        if (!scriptController->isEnabled())
+        if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
         if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -69,9 +74,13 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 
         lineNumber = scriptController->eventHandlerLineNumber();
         sourceURL = node->document()->url().string();
+
+        JSC::JSLock lock(SilenceAssertionsOnly);
+        JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(node->document(), mainThreadNormalWorld());
+        wrapper = asObject(toJS(globalObject->globalExec(), globalObject, node));
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -79,11 +88,15 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    ASSERT(attr);
+    if (attr->isNull())
+        return 0;
+
     int lineNumber = 1;
     String sourceURL;
     
     ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
+    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
@@ -93,15 +106,19 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, mainThreadNormalWorld());
+    JSObject* wrapper = toJSDOMWindow(frame, mainThreadNormalWorld());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, wrapper, mainThreadNormalWorld());
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
 {
-    JSC::JSObject* functionObject = eventListener->jsFunction(context);
-    if (!functionObject)
+    const JSEventListener* jsListener = JSEventListener::cast(eventListener);
+    if (!jsListener)
+        return "";
+    JSC::JSObject* jsFunction = jsListener->jsFunction(context);
+    if (!jsFunction)
         return "";
-    return functionObject->toString(scriptState);
+    return jsFunction->toString(scriptState);
 }
 
 } // namespace WebCore