<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[204459] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/204459">204459</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-08-14 17:48:16 -0700 (Sun, 14 Aug 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Align the event listener firing code with the latest DOM Specification and simplify it
https://bugs.webkit.org/show_bug.cgi?id=160828

Reviewed by Darin Adler.

Align the event listener firing code with the latest DOM specification:
- https://dom.spec.whatwg.org/#concept-event-listener-invoke
- https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke
- https://dom.spec.whatwg.org/#concept-event-listener

The following changes were made:
1. RegisteredEventListener (equivalent to &quot;event listener&quot; in the spec)
   is now RefCounted
2. RegisteredEventListener now has a wasRemoved flag as in specification.
3. fireEventListeners() is now iterating over a copy of the event
   listeners, as in the specification. We rely on the wasRemoved removed
   flag to avoid executing event listeners that were removed while we
   iterate.

Previously, the code was modifying the event listeners vector we were
iterating on. Doing so safely lead to complicated and error prone code.
The new code is much simpler and easier to reason about.

This change seems to be perf-neutral on Speedometer.

No new tests, no web-exposed behavior change.

* CMakeLists.txt:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSCommandLineAPIHostCustom.cpp:
(WebCore::getJSListenerFunctions):
* dom/DOMAllInOne.cpp:
* dom/EventListenerMap.cpp:
(WebCore::EventListenerMap::assertNoActiveIterators):
(WebCore::EventListenerMap::containsCapturing):
(WebCore::EventListenerMap::containsActive):
(WebCore::findListener):
(WebCore::EventListenerMap::add):
(WebCore::removeListenerFromVector):
(WebCore::EventListenerMap::remove):
(WebCore::EventListenerMap::find):
(WebCore::removeFirstListenerCreatedFromMarkup):
(WebCore::copyListenersNotCreatedFromMarkupToTarget):
(WebCore::EventListenerMap::copyEventListenersNotCreatedFromMarkupToTarget):
(WebCore::EventListenerIterator::nextListener):
(WebCore::EventListenerMap::clear): Deleted.
* dom/EventListenerMap.h:
(WebCore::EventListenerMap::contains):
(WebCore::EventListenerMap::assertNoActiveIterators):
* dom/EventTarget.cpp:
(WebCore::EventTarget::removeEventListener):
(WebCore::EventTarget::getAttributeEventListener):
(WebCore::FiringEventListenersScope::FiringEventListenersScope):
(WebCore::FiringEventListenersScope::~FiringEventListenersScope):
(WebCore::EventTarget::fireEventListeners):
(WebCore::EventTarget::setAttributeEventListener): Deleted.
(WebCore::EventTarget::hasActiveEventListeners): Deleted.
(WebCore::EventTarget::dispatchEventForBindings): Deleted.
(WebCore::EventTarget::getEventListeners): Deleted.
* dom/EventTarget.h:
(WebCore::EventTarget::isFiringEventListeners):
* dom/RegisteredEventListener.cpp: Removed.
* dom/RegisteredEventListener.h:
(WebCore::RegisteredEventListener::Options::Options):
(WebCore::RegisteredEventListener::create):
(WebCore::RegisteredEventListener::listener):
(WebCore::RegisteredEventListener::useCapture):
(WebCore::RegisteredEventListener::isPassive):
(WebCore::RegisteredEventListener::isOnce):
(WebCore::RegisteredEventListener::wasRemoved):
(WebCore::RegisteredEventListener::markAsRemoved):
(WebCore::RegisteredEventListener::RegisteredEventListener):
* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::getEventListenersForNode):
(WebCore::InspectorDOMAgent::getEventListeners):
(WebCore::InspectorDOMAgent::buildObjectForEventListener):
* inspector/InspectorDOMAgent.h:
(WebCore::EventListenerInfo::EventListenerInfo):
* svg/SVGElement.cpp:
(WebCore::hasLoadListener):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreCMakeListstxt">trunk/Source/WebCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreWebCorexcodeprojprojectpbxproj">trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSCommandLineAPIHostCustomcpp">trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDOMAllInOnecpp">trunk/Source/WebCore/dom/DOMAllInOne.cpp</a></li>
<li><a href="#trunkSourceWebCoredomEventListenerMapcpp">trunk/Source/WebCore/dom/EventListenerMap.cpp</a></li>
<li><a href="#trunkSourceWebCoredomEventListenerMaph">trunk/Source/WebCore/dom/EventListenerMap.h</a></li>
<li><a href="#trunkSourceWebCoredomEventTargetcpp">trunk/Source/WebCore/dom/EventTarget.cpp</a></li>
<li><a href="#trunkSourceWebCoredomEventTargeth">trunk/Source/WebCore/dom/EventTarget.h</a></li>
<li><a href="#trunkSourceWebCoredomRegisteredEventListenerh">trunk/Source/WebCore/dom/RegisteredEventListener.h</a></li>
<li><a href="#trunkSourceWebCoreinspectorInspectorDOMAgentcpp">trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp</a></li>
<li><a href="#trunkSourceWebCoreinspectorInspectorDOMAgenth">trunk/Source/WebCore/inspector/InspectorDOMAgent.h</a></li>
<li><a href="#trunkSourceWebCoresvgSVGElementcpp">trunk/Source/WebCore/svg/SVGElement.cpp</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoredomRegisteredEventListenercpp">trunk/Source/WebCore/dom/RegisteredEventListener.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/CMakeLists.txt (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/CMakeLists.txt        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/CMakeLists.txt        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -1503,7 +1503,6 @@
</span><span class="cx">     dom/QualifiedName.cpp
</span><span class="cx">     dom/RadioButtonGroups.cpp
</span><span class="cx">     dom/Range.cpp
</span><del>-    dom/RegisteredEventListener.cpp
</del><span class="cx">     dom/ScopedEventQueue.cpp
</span><span class="cx">     dom/ScriptElement.cpp
</span><span class="cx">     dom/ScriptExecutionContext.cpp
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/ChangeLog        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -1,3 +1,86 @@
</span><ins>+2016-08-14  Chris Dumez  &lt;cdumez@apple.com&gt;
+
+        Align the event listener firing code with the latest DOM Specification and simplify it
+        https://bugs.webkit.org/show_bug.cgi?id=160828
+
+        Reviewed by Darin Adler.
+
+        Align the event listener firing code with the latest DOM specification:
+        - https://dom.spec.whatwg.org/#concept-event-listener-invoke
+        - https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke
+        - https://dom.spec.whatwg.org/#concept-event-listener
+
+        The following changes were made:
+        1. RegisteredEventListener (equivalent to &quot;event listener&quot; in the spec)
+           is now RefCounted
+        2. RegisteredEventListener now has a wasRemoved flag as in specification.
+        3. fireEventListeners() is now iterating over a copy of the event
+           listeners, as in the specification. We rely on the wasRemoved removed
+           flag to avoid executing event listeners that were removed while we
+           iterate.
+
+        Previously, the code was modifying the event listeners vector we were
+        iterating on. Doing so safely lead to complicated and error prone code.
+        The new code is much simpler and easier to reason about.
+
+        This change seems to be perf-neutral on Speedometer.
+
+        No new tests, no web-exposed behavior change.
+
+        * CMakeLists.txt:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCommandLineAPIHostCustom.cpp:
+        (WebCore::getJSListenerFunctions):
+        * dom/DOMAllInOne.cpp:
+        * dom/EventListenerMap.cpp:
+        (WebCore::EventListenerMap::assertNoActiveIterators):
+        (WebCore::EventListenerMap::containsCapturing):
+        (WebCore::EventListenerMap::containsActive):
+        (WebCore::findListener):
+        (WebCore::EventListenerMap::add):
+        (WebCore::removeListenerFromVector):
+        (WebCore::EventListenerMap::remove):
+        (WebCore::EventListenerMap::find):
+        (WebCore::removeFirstListenerCreatedFromMarkup):
+        (WebCore::copyListenersNotCreatedFromMarkupToTarget):
+        (WebCore::EventListenerMap::copyEventListenersNotCreatedFromMarkupToTarget):
+        (WebCore::EventListenerIterator::nextListener):
+        (WebCore::EventListenerMap::clear): Deleted.
+        * dom/EventListenerMap.h:
+        (WebCore::EventListenerMap::contains):
+        (WebCore::EventListenerMap::assertNoActiveIterators):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::FiringEventListenersScope::FiringEventListenersScope):
+        (WebCore::FiringEventListenersScope::~FiringEventListenersScope):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::setAttributeEventListener): Deleted.
+        (WebCore::EventTarget::hasActiveEventListeners): Deleted.
+        (WebCore::EventTarget::dispatchEventForBindings): Deleted.
+        (WebCore::EventTarget::getEventListeners): Deleted.
+        * dom/EventTarget.h:
+        (WebCore::EventTarget::isFiringEventListeners):
+        * dom/RegisteredEventListener.cpp: Removed.
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::Options::Options):
+        (WebCore::RegisteredEventListener::create):
+        (WebCore::RegisteredEventListener::listener):
+        (WebCore::RegisteredEventListener::useCapture):
+        (WebCore::RegisteredEventListener::isPassive):
+        (WebCore::RegisteredEventListener::isOnce):
+        (WebCore::RegisteredEventListener::wasRemoved):
+        (WebCore::RegisteredEventListener::markAsRemoved):
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::getEventListeners):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::EventListenerInfo::EventListenerInfo):
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener):
+
</ins><span class="cx"> 2016-08-14  Daniel Bates  &lt;dabates@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Fix compiler errors when building iOS WebKit using the iOS 10 beta SDK
</span></span></pre></div>
<a id="trunkSourceWebCoreWebCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -3066,7 +3066,6 @@
</span><span class="cx">                 85031B480A44EFC700F992E0 /* MouseRelatedEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B320A44EFC700F992E0 /* MouseRelatedEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 85031B490A44EFC700F992E0 /* MutationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 85031B330A44EFC700F992E0 /* MutationEvent.cpp */; };
</span><span class="cx">                 85031B4A0A44EFC700F992E0 /* MutationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B340A44EFC700F992E0 /* MutationEvent.h */; };
</span><del>-                85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */; };
</del><span class="cx">                 85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B360A44EFC700F992E0 /* RegisteredEventListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 85031B4D0A44EFC700F992E0 /* UIEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 85031B370A44EFC700F992E0 /* UIEvent.cpp */; };
</span><span class="cx">                 85031B4E0A44EFC700F992E0 /* UIEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85031B380A44EFC700F992E0 /* UIEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -10507,7 +10506,6 @@
</span><span class="cx">                 85031B320A44EFC700F992E0 /* MouseRelatedEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MouseRelatedEvent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 85031B330A44EFC700F992E0 /* MutationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MutationEvent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 85031B340A44EFC700F992E0 /* MutationEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MutationEvent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RegisteredEventListener.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 85031B360A44EFC700F992E0 /* RegisteredEventListener.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RegisteredEventListener.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 85031B370A44EFC700F992E0 /* UIEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = UIEvent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 85031B380A44EFC700F992E0 /* UIEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = UIEvent.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -24195,7 +24193,6 @@
</span><span class="cx">                                 936DD03A09CEAC270056AE8C /* Range.idl */,
</span><span class="cx">                                 93D9D53B0DA27E180077216C /* RangeBoundaryPoint.h */,
</span><span class="cx">                                 A84D827B11D333ED00972990 /* RawDataDocumentParser.h */,
</span><del>-                                85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */,
</del><span class="cx">                                 85031B360A44EFC700F992E0 /* RegisteredEventListener.h */,
</span><span class="cx">                                 A76E5F7E135E0DCF00A69837 /* RenderedDocumentMarker.h */,
</span><span class="cx">                                 4998AEC413F9D0EA0090B1AA /* RequestAnimationFrameCallback.h */,
</span><span class="lines">@@ -30879,7 +30876,6 @@
</span><span class="cx">                                 2EC41DE41C0410A300D294FE /* RealtimeMediaSourceSupportedConstraints.cpp in Sources */,
</span><span class="cx">                                 FD45A95A175D417100C21EC8 /* RectangleShape.cpp in Sources */,
</span><span class="cx">                                 BCAB418113E356E800D8AAF3 /* Region.cpp in Sources */,
</span><del>-                                85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */,
</del><span class="cx">                                 CDFC360518CA61C20026E56F /* RemoteCommandListener.cpp in Sources */,
</span><span class="cx">                                 CDFC360718CA696C0026E56F /* RemoteCommandListenerIOS.mm in Sources */,
</span><span class="cx">                                 CD8ACA881D237AA200ECC59E /* RemoteCommandListenerMac.mm in Sources */,
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSCommandLineAPIHostCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     size_t handlersCount = listenerInfo.eventListenerVector.size();
</span><span class="cx">     for (size_t i = 0, outputIndex = 0; i &lt; handlersCount; ++i) {
</span><del>-        const JSEventListener* jsListener = JSEventListener::cast(listenerInfo.eventListenerVector[i].listener.get());
</del><ins>+        const JSEventListener* jsListener = JSEventListener::cast(&amp;listenerInfo.eventListenerVector[i]-&gt;listener());
</ins><span class="cx">         if (!jsListener) {
</span><span class="cx">             ASSERT_NOT_REACHED();
</span><span class="cx">             continue;
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx"> 
</span><span class="cx">         JSObject* listenerEntry = constructEmptyObject(&amp;state);
</span><span class="cx">         listenerEntry-&gt;putDirect(vm, Identifier::fromString(&amp;state, &quot;listener&quot;), function);
</span><del>-        listenerEntry-&gt;putDirect(vm, Identifier::fromString(&amp;state, &quot;useCapture&quot;), jsBoolean(listenerInfo.eventListenerVector[i].useCapture));
</del><ins>+        listenerEntry-&gt;putDirect(vm, Identifier::fromString(&amp;state, &quot;useCapture&quot;), jsBoolean(listenerInfo.eventListenerVector[i]-&gt;useCapture()));
</ins><span class="cx">         result-&gt;putDirectIndex(&amp;state, outputIndex++, JSValue(listenerEntry));
</span><span class="cx">     }
</span><span class="cx">     return result;
</span></span></pre></div>
<a id="trunkSourceWebCoredomDOMAllInOnecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/DOMAllInOne.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/DOMAllInOne.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/DOMAllInOne.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -128,7 +128,6 @@
</span><span class="cx"> // #include &quot;QualifiedName.cpp&quot;
</span><span class="cx"> #include &quot;RadioButtonGroups.cpp&quot;
</span><span class="cx"> #include &quot;Range.cpp&quot;
</span><del>-#include &quot;RegisteredEventListener.cpp&quot;
</del><span class="cx"> #include &quot;ScopedEventQueue.cpp&quot;
</span><span class="cx"> #include &quot;ScriptElement.cpp&quot;
</span><span class="cx"> #include &quot;ScriptExecutionContext.cpp&quot;
</span></span></pre></div>
<a id="trunkSourceWebCoredomEventListenerMapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/EventListenerMap.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/EventListenerMap.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/EventListenerMap.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><del>-void EventListenerMap::assertNoActiveIterators()
</del><ins>+void EventListenerMap::assertNoActiveIterators() const
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(!m_activeIteratorCount);
</span><span class="cx"> }
</span><span class="lines">@@ -55,37 +55,28 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool EventListenerMap::contains(const AtomicString&amp; eventType) const
</del><ins>+bool EventListenerMap::containsCapturing(const AtomicString&amp; eventType) const
</ins><span class="cx"> {
</span><del>-    for (auto&amp; entry : m_entries) {
-        if (entry.first == eventType)
</del><ins>+    auto* listeners = find(eventType);
+    if (!listeners)
+        return false;
+
+    for (auto&amp; eventListener : *listeners) {
+        if (eventListener-&gt;useCapture())
</ins><span class="cx">             return true;
</span><span class="cx">     }
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool EventListenerMap::containsCapturing(const AtomicString&amp; eventType) const
</del><ins>+bool EventListenerMap::containsActive(const AtomicString&amp; eventType) const
</ins><span class="cx"> {
</span><del>-    for (auto&amp; entry : m_entries) {
-        if (entry.first == eventType) {
-            for (auto&amp; eventListener : *entry.second) {
-                if (eventListener.useCapture)
-                    return true;
-            }
-        }
-    }
-    return false;
-}
</del><ins>+    auto* listeners = find(eventType);
+    if (!listeners)
+        return false;
</ins><span class="cx"> 
</span><del>-bool EventListenerMap::containsActive(const AtomicString&amp; eventType) const
-{
-    for (auto&amp; entry : m_entries) {
-        if (entry.first == eventType) {
-            for (auto&amp; eventListener : *entry.second) {
-                if (!eventListener.isPassive)
-                    return true;
-            }
-        }
</del><ins>+    for (auto&amp; eventListener : *listeners) {
+        if (!eventListener-&gt;isPassive())
+            return true;
</ins><span class="cx">     }
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="lines">@@ -108,15 +99,14 @@
</span><span class="cx">     return types;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static bool addListenerToVector(EventListenerVector* vector, Ref&lt;EventListener&gt;&amp;&amp; listener, const RegisteredEventListener::Options&amp; options)
</del><ins>+static inline size_t findListener(const EventListenerVector&amp; listeners, EventListener&amp; listener, bool useCapture)
</ins><span class="cx"> {
</span><del>-    RegisteredEventListener registeredListener(WTFMove(listener), options);
-
-    if (vector-&gt;find(registeredListener) != notFound)
-        return false; // Duplicate listener.
-
-    vector-&gt;append(registeredListener);
-    return true;
</del><ins>+    for (size_t i = 0; i &lt; listeners.size(); ++i) {
+        auto&amp; registeredListener = listeners[i];
+        if (registeredListener-&gt;listener() == listener &amp;&amp; registeredListener-&gt;useCapture() == useCapture)
+            return i;
+    }
+    return notFound;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool EventListenerMap::add(const AtomicString&amp; eventType, Ref&lt;EventListener&gt;&amp;&amp; listener, const RegisteredEventListener::Options&amp; options)
</span><span class="lines">@@ -123,32 +113,37 @@
</span><span class="cx"> {
</span><span class="cx">     assertNoActiveIterators();
</span><span class="cx"> 
</span><del>-    for (auto&amp; entry : m_entries) {
-        if (entry.first == eventType)
-            return addListenerToVector(entry.second.get(), WTFMove(listener), options);
</del><ins>+    if (auto* listeners = find(eventType)) {
+        if (findListener(*listeners, listener, options.capture) != notFound)
+            return false; // Duplicate listener.
+        listeners-&gt;append(RegisteredEventListener::create(WTFMove(listener), options));
+        return true;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_entries.append(std::make_pair(eventType, std::make_unique&lt;EventListenerVector&gt;()));
-    return addListenerToVector(m_entries.last().second.get(), WTFMove(listener), options);
</del><ins>+    auto listeners = std::make_unique&lt;EventListenerVector&gt;();
+    listeners-&gt;uncheckedAppend(RegisteredEventListener::create(WTFMove(listener), options));
+    m_entries.append({ eventType, WTFMove(listeners) });
+    return true;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-static bool removeListenerFromVector(EventListenerVector* listenerVector, EventListener&amp; listener, bool useCapture, size_t&amp; indexOfRemovedListener)
</del><ins>+static bool removeListenerFromVector(EventListenerVector&amp; listeners, EventListener&amp; listener, bool useCapture)
</ins><span class="cx"> {
</span><del>-    RegisteredEventListener registeredListener(listener, useCapture);
-    indexOfRemovedListener = listenerVector-&gt;find(registeredListener);
-    if (indexOfRemovedListener == notFound)
</del><ins>+    size_t indexOfRemovedListener = findListener(listeners, listener, useCapture);
+    if (UNLIKELY(indexOfRemovedListener == notFound))
</ins><span class="cx">         return false;
</span><del>-    listenerVector-&gt;remove(indexOfRemovedListener);
</del><ins>+
+    listeners[indexOfRemovedListener]-&gt;markAsRemoved();
+    listeners.remove(indexOfRemovedListener);
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool EventListenerMap::remove(const AtomicString&amp; eventType, EventListener&amp; listener, bool useCapture, size_t&amp; indexOfRemovedListener)
</del><ins>+bool EventListenerMap::remove(const AtomicString&amp; eventType, EventListener&amp; listener, bool useCapture)
</ins><span class="cx"> {
</span><span class="cx">     assertNoActiveIterators();
</span><span class="cx"> 
</span><span class="cx">     for (unsigned i = 0; i &lt; m_entries.size(); ++i) {
</span><span class="cx">         if (m_entries[i].first == eventType) {
</span><del>-            bool wasRemoved = removeListenerFromVector(m_entries[i].second.get(), listener, useCapture, indexOfRemovedListener);
</del><ins>+            bool wasRemoved = removeListenerFromVector(*m_entries[i].second, listener, useCapture);
</ins><span class="cx">             if (m_entries[i].second-&gt;isEmpty())
</span><span class="cx">                 m_entries.remove(i);
</span><span class="cx">             return wasRemoved;
</span><span class="lines">@@ -158,7 +153,7 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EventListenerVector* EventListenerMap::find(const AtomicString&amp; eventType)
</del><ins>+EventListenerVector* EventListenerMap::find(const AtomicString&amp; eventType) const
</ins><span class="cx"> {
</span><span class="cx">     assertNoActiveIterators();
</span><span class="cx"> 
</span><span class="lines">@@ -172,8 +167,12 @@
</span><span class="cx"> 
</span><span class="cx"> static void removeFirstListenerCreatedFromMarkup(EventListenerVector&amp; listenerVector)
</span><span class="cx"> {
</span><del>-    bool foundListener = listenerVector.removeFirstMatching([] (const RegisteredEventListener&amp; listener) {
-        return listener.listener-&gt;wasCreatedFromMarkup();
</del><ins>+    bool foundListener = listenerVector.removeFirstMatching([] (const auto&amp; registeredListener) {
+        if (registeredListener-&gt;listener().wasCreatedFromMarkup()) {
+            registeredListener-&gt;markAsRemoved();
+            return true;
+        }
+        return false;
</ins><span class="cx">     });
</span><span class="cx">     ASSERT_UNUSED(foundListener, foundListener);
</span><span class="cx"> }
</span><span class="lines">@@ -192,13 +191,13 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static void copyListenersNotCreatedFromMarkupToTarget(const AtomicString&amp; eventType, EventListenerVector* listenerVector, EventTarget* target)
</del><ins>+static void copyListenersNotCreatedFromMarkupToTarget(const AtomicString&amp; eventType, EventListenerVector&amp; listenerVector, EventTarget* target)
</ins><span class="cx"> {
</span><del>-    for (auto&amp; listener : *listenerVector) {
</del><ins>+    for (auto&amp; registeredListener : listenerVector) {
</ins><span class="cx">         // Event listeners created from markup have already been transfered to the shadow tree during cloning.
</span><del>-        if (listener.listener-&gt;wasCreatedFromMarkup())
</del><ins>+        if (registeredListener-&gt;listener().wasCreatedFromMarkup())
</ins><span class="cx">             continue;
</span><del>-        target-&gt;addEventListener(eventType, *listener.listener, listener.useCapture);
</del><ins>+        target-&gt;addEventListener(eventType, registeredListener-&gt;listener(), registeredListener-&gt;useCapture());
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -207,7 +206,7 @@
</span><span class="cx">     assertNoActiveIterators();
</span><span class="cx"> 
</span><span class="cx">     for (auto&amp; entry : m_entries)
</span><del>-        copyListenersNotCreatedFromMarkupToTarget(entry.first, entry.second.get(), target);
</del><ins>+        copyListenersNotCreatedFromMarkupToTarget(entry.first, *entry.second, target);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EventListenerIterator::EventListenerIterator(EventTarget* target)
</span><span class="lines">@@ -236,16 +235,16 @@
</span><span class="cx"> EventListener* EventListenerIterator::nextListener()
</span><span class="cx"> {
</span><span class="cx">     if (!m_map)
</span><del>-        return 0;
</del><ins>+        return nullptr;
</ins><span class="cx"> 
</span><span class="cx">     for (; m_entryIndex &lt; m_map-&gt;m_entries.size(); ++m_entryIndex) {
</span><span class="cx">         EventListenerVector&amp; listeners = *m_map-&gt;m_entries[m_entryIndex].second;
</span><span class="cx">         if (m_index &lt; listeners.size())
</span><del>-            return listeners[m_index++].listener.get();
</del><ins>+            return &amp;listeners[m_index++]-&gt;listener();
</ins><span class="cx">         m_index = 0;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return 0;
</del><ins>+    return nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCoredomEventListenerMaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/EventListenerMap.h (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/EventListenerMap.h        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/EventListenerMap.h        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -30,8 +30,7 @@
</span><span class="cx">  *
</span><span class="cx">  */
</span><span class="cx"> 
</span><del>-#ifndef EventListenerMap_h
-#define EventListenerMap_h
</del><ins>+#pragma once
</ins><span class="cx"> 
</span><span class="cx"> #include &quot;RegisteredEventListener.h&quot;
</span><span class="cx"> #include &lt;atomic&gt;
</span><span class="lines">@@ -43,7 +42,7 @@
</span><span class="cx"> 
</span><span class="cx"> class EventTarget;
</span><span class="cx"> 
</span><del>-typedef Vector&lt;RegisteredEventListener, 1&gt; EventListenerVector;
</del><ins>+using EventListenerVector = Vector&lt;RefPtr&lt;RegisteredEventListener&gt;, 1&gt;;
</ins><span class="cx"> 
</span><span class="cx"> class EventListenerMap {
</span><span class="cx"> public:
</span><span class="lines">@@ -50,7 +49,7 @@
</span><span class="cx">     EventListenerMap();
</span><span class="cx"> 
</span><span class="cx">     bool isEmpty() const { return m_entries.isEmpty(); }
</span><del>-    WEBCORE_EXPORT bool contains(const AtomicString&amp; eventType) const;
</del><ins>+    bool contains(const AtomicString&amp; eventType) const { return find(eventType); }
</ins><span class="cx">     bool containsCapturing(const AtomicString&amp; eventType) const;
</span><span class="cx">     bool containsActive(const AtomicString&amp; eventType) const;
</span><span class="cx"> 
</span><span class="lines">@@ -57,8 +56,8 @@
</span><span class="cx">     void clear();
</span><span class="cx"> 
</span><span class="cx">     bool add(const AtomicString&amp; eventType, Ref&lt;EventListener&gt;&amp;&amp;, const RegisteredEventListener::Options&amp;);
</span><del>-    bool remove(const AtomicString&amp; eventType, EventListener&amp;, bool useCapture, size_t&amp; indexOfRemovedListener);
-    EventListenerVector* find(const AtomicString&amp; eventType);
</del><ins>+    bool remove(const AtomicString&amp; eventType, EventListener&amp;, bool useCapture);
+    WEBCORE_EXPORT EventListenerVector* find(const AtomicString&amp; eventType) const;
</ins><span class="cx">     Vector&lt;AtomicString&gt; eventTypes() const;
</span><span class="cx"> 
</span><span class="cx">     void removeFirstEventListenerCreatedFromMarkup(const AtomicString&amp; eventType);
</span><span class="lines">@@ -67,7 +66,7 @@
</span><span class="cx"> private:
</span><span class="cx">     friend class EventListenerIterator;
</span><span class="cx"> 
</span><del>-    void assertNoActiveIterators();
</del><ins>+    void assertNoActiveIterators() const;
</ins><span class="cx"> 
</span><span class="cx">     Vector&lt;std::pair&lt;AtomicString, std::unique_ptr&lt;EventListenerVector&gt;&gt;, 2&gt; m_entries;
</span><span class="cx"> 
</span><span class="lines">@@ -79,7 +78,6 @@
</span><span class="cx"> class EventListenerIterator {
</span><span class="cx">     WTF_MAKE_NONCOPYABLE(EventListenerIterator);
</span><span class="cx"> public:
</span><del>-    EventListenerIterator();
</del><span class="cx">     explicit EventListenerIterator(EventTarget*);
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx">     ~EventListenerIterator();
</span><span class="lines">@@ -94,9 +92,7 @@
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> #ifdef NDEBUG
</span><del>-inline void EventListenerMap::assertNoActiveIterators() { }
</del><ins>+inline void EventListenerMap::assertNoActiveIterators() const { }
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span><del>-
-#endif // EventListenerMap_h
</del></span></pre></div>
<a id="trunkSourceWebCoredomEventTargetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/EventTarget.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/EventTarget.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/EventTarget.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -43,6 +43,7 @@
</span><span class="cx"> #include &lt;wtf/NeverDestroyed.h&gt;
</span><span class="cx"> #include &lt;wtf/Ref.h&gt;
</span><span class="cx"> #include &lt;wtf/StdLibExtras.h&gt;
</span><ins>+#include &lt;wtf/TemporaryChange.h&gt;
</ins><span class="cx"> #include &lt;wtf/Vector.h&gt;
</span><span class="cx"> 
</span><span class="cx"> using namespace WTF;
</span><span class="lines">@@ -101,28 +102,7 @@
</span><span class="cx">     if (!d)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    size_t indexOfRemovedListener;
-
-    if (!d-&gt;eventListenerMap.remove(eventType, listener, options.capture, indexOfRemovedListener))
-        return false;
-
-    // Notify firing events planning to invoke the listener at 'index' that
-    // they have one less listener to invoke.
-    if (!d-&gt;firingEventIterators)
-        return true;
-    for (auto&amp; firingIterator : *d-&gt;firingEventIterators) {
-        if (eventType != firingIterator.eventType)
-            continue;
-
-        if (indexOfRemovedListener &gt;= firingIterator.size)
-            continue;
-
-        --firingIterator.size;
-        if (indexOfRemovedListener &lt;= firingIterator.iterator)
-            --firingIterator.iterator;
-    }
-
-    return true;
</del><ins>+    return d-&gt;eventListenerMap.remove(eventType, listener, options.capture);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool EventTarget::setAttributeEventListener(const AtomicString&amp; eventType, RefPtr&lt;EventListener&gt;&amp;&amp; listener)
</span><span class="lines">@@ -136,10 +116,10 @@
</span><span class="cx"> EventListener* EventTarget::getAttributeEventListener(const AtomicString&amp; eventType)
</span><span class="cx"> {
</span><span class="cx">     for (auto&amp; eventListener : getEventListeners(eventType)) {
</span><del>-        if (eventListener.listener-&gt;isAttribute())
-            return eventListener.listener.get();
</del><ins>+        if (eventListener-&gt;listener().isAttribute())
+            return &amp;eventListener-&gt;listener();
</ins><span class="cx">     }
</span><del>-    return 0;
</del><ins>+    return nullptr;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool EventTarget::hasActiveEventListeners(const AtomicString&amp; eventType) const
</span><span class="lines">@@ -215,57 +195,51 @@
</span><span class="cx">     ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
</span><span class="cx">     ASSERT(event.isInitialized());
</span><span class="cx"> 
</span><del>-    EventTargetData* d = eventTargetData();
-    if (!d)
</del><ins>+    EventTargetData* data = eventTargetData();
+    if (!data)
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    EventListenerVector* legacyListenersVector = nullptr;
-    const AtomicString&amp; legacyTypeName = legacyType(event);
-    if (!legacyTypeName.isEmpty())
-        legacyListenersVector = d-&gt;eventListenerMap.find(legacyTypeName);
</del><ins>+    TemporaryChange&lt;bool&gt; firingEventListenersScope(data-&gt;isFiringEventListeners, true);
</ins><span class="cx"> 
</span><del>-    EventListenerVector* listenersVector = d-&gt;eventListenerMap.find(event.type());
</del><ins>+    if (auto* listenersVector = data-&gt;eventListenerMap.find(event.type())) {
+        fireEventListeners(event, *listenersVector);
+        return !event.defaultPrevented();
+    }
</ins><span class="cx"> 
</span><del>-    if (listenersVector)
-        fireEventListeners(event, d, *listenersVector);
-    else if (legacyListenersVector) {
-        AtomicString typeName = event.type();
-        event.setType(legacyTypeName);
-        fireEventListeners(event, d, *legacyListenersVector);
-        event.setType(typeName);
</del><ins>+    const AtomicString&amp; legacyTypeName = legacyType(event);
+    if (!legacyTypeName.isEmpty()) {
+        if (auto* legacyListenersVector = data-&gt;eventListenerMap.find(legacyTypeName)) {
+            AtomicString typeName = event.type();
+            event.setType(legacyTypeName);
+            fireEventListeners(event, *legacyListenersVector);
+            event.setType(typeName);
+        }
</ins><span class="cx">     }
</span><del>-
</del><span class="cx">     return !event.defaultPrevented();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void EventTarget::fireEventListeners(Event&amp; event, EventTargetData* d, EventListenerVector&amp; entry)
</del><ins>+// Intentionally creates a copy of the listeners vector to avoid event listeners added after this point from being run.
+// Note that removal still has an effect due to the removed field in RegisteredEventListener.
+void EventTarget::fireEventListeners(Event&amp; event, EventListenerVector listeners)
</ins><span class="cx"> {
</span><span class="cx">     Ref&lt;EventTarget&gt; protectedThis(*this);
</span><ins>+    ASSERT(!listeners.isEmpty());
</ins><span class="cx"> 
</span><del>-    // Fire all listeners registered for this event. Don't fire listeners removed during event dispatch.
-    // Also, don't fire event listeners added during event dispatch. Conveniently, all new event listeners will be added
-    // after or at index |size|, so iterating up to (but not including) |size| naturally excludes new event listeners.
-
-    size_t i = 0;
-    size_t size = entry.size();
-    if (!d-&gt;firingEventIterators)
-        d-&gt;firingEventIterators = std::make_unique&lt;FiringEventIteratorVector&gt;();
-    d-&gt;firingEventIterators-&gt;append(FiringEventIterator(event.type(), i, size));
-
</del><span class="cx">     ScriptExecutionContext* context = scriptExecutionContext();
</span><span class="cx">     Document* document = nullptr;
</span><span class="cx">     InspectorInstrumentationCookie willDispatchEventCookie;
</span><span class="cx">     if (is&lt;Document&gt;(context)) {
</span><span class="cx">         document = downcast&lt;Document&gt;(context);
</span><del>-        willDispatchEventCookie = InspectorInstrumentation::willDispatchEvent(*document, event, size &gt; 0);
</del><ins>+        willDispatchEventCookie = InspectorInstrumentation::willDispatchEvent(*document, event, true);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    for (; i &lt; size; ++i) {
-        RegisteredEventListener registeredListener = entry[i];
</del><ins>+    for (auto&amp; registeredListener : listeners) {
+        if (UNLIKELY(registeredListener-&gt;wasRemoved()))
+            continue;
</ins><span class="cx"> 
</span><del>-        if (event.eventPhase() == Event::CAPTURING_PHASE &amp;&amp; !registeredListener.useCapture)
</del><ins>+        if (event.eventPhase() == Event::CAPTURING_PHASE &amp;&amp; !registeredListener-&gt;useCapture())
</ins><span class="cx">             continue;
</span><del>-        if (event.eventPhase() == Event::BUBBLING_PHASE &amp;&amp; registeredListener.useCapture)
</del><ins>+        if (event.eventPhase() == Event::BUBBLING_PHASE &amp;&amp; registeredListener-&gt;useCapture())
</ins><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="cx">         // If stopImmediatePropagation has been called, we just break out immediately, without
</span><span class="lines">@@ -274,24 +248,22 @@
</span><span class="cx">             break;
</span><span class="cx"> 
</span><span class="cx">         // Do this before invocation to avoid reentrancy issues.
</span><del>-        if (registeredListener.isOnce)
-            removeEventListener(event.type(), *registeredListener.listener, ListenerOptions(registeredListener.useCapture));
</del><ins>+        if (registeredListener-&gt;isOnce())
+            removeEventListener(event.type(), registeredListener-&gt;listener(), ListenerOptions(registeredListener-&gt;useCapture()));
</ins><span class="cx"> 
</span><del>-        if (registeredListener.isPassive)
</del><ins>+        if (registeredListener-&gt;isPassive())
</ins><span class="cx">             event.setInPassiveListener(true);
</span><span class="cx"> 
</span><span class="cx">         InspectorInstrumentationCookie cookie = InspectorInstrumentation::willHandleEvent(context, event);
</span><span class="cx">         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
</span><span class="cx">         // event listeners, even though that violates some versions of the DOM spec.
</span><del>-        registeredListener.listener-&gt;handleEvent(context, &amp;event);
</del><ins>+        registeredListener-&gt;listener().handleEvent(context, &amp;event);
</ins><span class="cx">         InspectorInstrumentation::didHandleEvent(cookie);
</span><span class="cx"> 
</span><del>-        if (registeredListener.isPassive)
</del><ins>+        if (registeredListener-&gt;isPassive())
</ins><span class="cx">             event.setInPassiveListener(false);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    d-&gt;firingEventIterators-&gt;removeLast();
-
</del><span class="cx">     if (document)
</span><span class="cx">         InspectorInstrumentation::didDispatchEvent(willDispatchEventCookie);
</span><span class="cx"> }
</span><span class="lines">@@ -310,15 +282,6 @@
</span><span class="cx">     if (!d)
</span><span class="cx">         return;
</span><span class="cx">     d-&gt;eventListenerMap.clear();
</span><del>-
-    // Notify firing events planning to invoke the listener at 'index' that
-    // they have one less listener to invoke.
-    if (d-&gt;firingEventIterators) {
-        for (auto&amp; firingEventIterator : *d-&gt;firingEventIterators) {
-            firingEventIterator.iterator = 0;
-            firingEventIterator.size = 0;
-        }
-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCoredomEventTargeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/EventTarget.h (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/EventTarget.h        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/EventTarget.h        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx">     ~EventTargetData();
</span><span class="cx"> 
</span><span class="cx">     EventListenerMap eventListenerMap;
</span><del>-    std::unique_ptr&lt;FiringEventIteratorVector&gt; firingEventIterators;
</del><ins>+    bool isFiringEventListeners { false };
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> enum EventTargetInterface {
</span><span class="lines">@@ -182,7 +182,7 @@
</span><span class="cx">     virtual void refEventTarget() = 0;
</span><span class="cx">     virtual void derefEventTarget() = 0;
</span><span class="cx">     
</span><del>-    void fireEventListeners(Event&amp;, EventTargetData*, EventListenerVector&amp;);
</del><ins>+    void fireEventListeners(Event&amp;, EventListenerVector);
</ins><span class="cx"> 
</span><span class="cx">     friend class EventListenerIterator;
</span><span class="cx"> };
</span><span class="lines">@@ -207,7 +207,7 @@
</span><span class="cx">     EventTargetData* d = eventTargetData();
</span><span class="cx">     if (!d)
</span><span class="cx">         return false;
</span><del>-    return d-&gt;firingEventIterators &amp;&amp; !d-&gt;firingEventIterators-&gt;isEmpty();
</del><ins>+    return d-&gt;isFiringEventListeners;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline bool EventTarget::hasEventListeners() const
</span></span></pre></div>
<a id="trunkSourceWebCoredomRegisteredEventListenercpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/WebCore/dom/RegisteredEventListener.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/RegisteredEventListener.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/RegisteredEventListener.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-/*
- * Copyright (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2001 Tobias Anton (anton@stud.fbi.fh-darmstadt.de)
- * Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
- * Copyright (C) 2003, 2005, 2006, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include &quot;config.h&quot;
-#include &quot;RegisteredEventListener.h&quot;
-
-
-namespace WebCore {
-
-} // namespace WebCore
</del></span></pre></div>
<a id="trunkSourceWebCoredomRegisteredEventListenerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/RegisteredEventListener.h (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/RegisteredEventListener.h        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/dom/RegisteredEventListener.h        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -29,47 +29,50 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-    class RegisteredEventListener {
-    public:
-        struct Options {
-            Options(bool capture = false, bool passive = false, bool once = false)
-                : capture(capture)
-                , passive(passive)
-                , once(once)
-            { }
</del><ins>+// https://dom.spec.whatwg.org/#concept-event-listener
+class RegisteredEventListener : public RefCounted&lt;RegisteredEventListener&gt; {
+public:
+    struct Options {
+        Options(bool capture = false, bool passive = false, bool once = false)
+            : capture(capture)
+            , passive(passive)
+            , once(once)
+        { }
</ins><span class="cx"> 
</span><del>-            bool capture;
-            bool passive;
-            bool once;
-        };
</del><ins>+        bool capture;
+        bool passive;
+        bool once;
+    };
</ins><span class="cx"> 
</span><del>-        RegisteredEventListener(Ref&lt;EventListener&gt;&amp;&amp; listener, const Options&amp; options)
-            : listener(WTFMove(listener))
-            , useCapture(options.capture)
-            , isPassive(options.passive)
-            , isOnce(options.once)
-        {
-        }
</del><ins>+    static Ref&lt;RegisteredEventListener&gt; create(Ref&lt;EventListener&gt;&amp;&amp; listener, const Options&amp; options)
+    {
+        return adoptRef(*new RegisteredEventListener(WTFMove(listener), options));
+    }
</ins><span class="cx"> 
</span><del>-        RegisteredEventListener(Ref&lt;EventListener&gt;&amp;&amp; listener, bool useCapture)
-            : listener(WTFMove(listener))
-            , useCapture(useCapture)
-        {
-        }
</del><ins>+    EventListener&amp; listener() const { return const_cast&lt;EventListener&amp;&gt;(m_listener.get()); }
+    bool useCapture() const { return m_useCapture; }
+    bool isPassive() const { return m_isPassive; }
+    bool isOnce() const { return m_isOnce; }
+    bool wasRemoved() const { return m_wasRemoved; }
</ins><span class="cx"> 
</span><del>-        RefPtr&lt;EventListener&gt; listener;
-        bool useCapture { false };
-        bool isPassive { false };
-        bool isOnce { false };
-    };
-    
-    inline bool operator==(const RegisteredEventListener&amp; a, const RegisteredEventListener&amp; b)
</del><ins>+    void markAsRemoved() { m_wasRemoved = true; }
+
+private:
+    RegisteredEventListener(Ref&lt;EventListener&gt;&amp;&amp; listener, const Options&amp; options)
+        : m_listener(WTFMove(listener))
+        , m_useCapture(options.capture)
+        , m_isPassive(options.passive)
+        , m_isOnce(options.once)
</ins><span class="cx">     {
</span><del>-        // Other data members are purposefully not checked. The DOM specification says that upon adding / removing
-        // EventListeners, we should only check the type and the capture flag.
-        return *a.listener == *b.listener &amp;&amp; a.useCapture == b.useCapture;
</del><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    Ref&lt;EventListener&gt; m_listener;
+    bool m_useCapture { false };
+    bool m_isPassive { false };
+    bool m_isOnce { false };
+    bool m_wasRemoved { false };
+};
+
</ins><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><span class="cx"> #endif // RegisteredEventListener_h
</span></span></pre></div>
<a id="trunkSourceWebCoreinspectorInspectorDOMAgentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -822,8 +822,8 @@
</span><span class="cx">     size_t eventInformationLength = eventInformation.size();
</span><span class="cx">     for (auto&amp; info : eventInformation) {
</span><span class="cx">         for (auto&amp; listener : info.eventListenerVector) {
</span><del>-            if (listener.useCapture)
-                listenersArray-&gt;addItem(buildObjectForEventListener(listener, info.eventType, info.node, objectGroup));
</del><ins>+            if (listener-&gt;useCapture())
+                listenersArray-&gt;addItem(buildObjectForEventListener(*listener, info.eventType, info.node, objectGroup));
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -831,8 +831,8 @@
</span><span class="cx">     for (size_t i = eventInformationLength; i; --i) {
</span><span class="cx">         const EventListenerInfo&amp; info = eventInformation[i - 1];
</span><span class="cx">         for (auto&amp; listener : info.eventListenerVector) {
</span><del>-            if (!listener.useCapture)
-                listenersArray-&gt;addItem(buildObjectForEventListener(listener, info.eventType, info.node, objectGroup));
</del><ins>+            if (!listener-&gt;useCapture())
+                listenersArray-&gt;addItem(buildObjectForEventListener(*listener, info.eventType, info.node, objectGroup));
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -858,13 +858,13 @@
</span><span class="cx">         for (auto&amp; type : d-&gt;eventListenerMap.eventTypes()) {
</span><span class="cx">             const EventListenerVector&amp; listeners = ancestor-&gt;getEventListeners(type);
</span><span class="cx">             EventListenerVector filteredListeners;
</span><del>-            filteredListeners.reserveCapacity(listeners.size());
</del><ins>+            filteredListeners.reserveInitialCapacity(listeners.size());
</ins><span class="cx">             for (auto&amp; listener : listeners) {
</span><del>-                if (listener.listener-&gt;type() == EventListener::JSEventListenerType)
-                    filteredListeners.append(listener);
</del><ins>+                if (listener-&gt;listener().type() == EventListener::JSEventListenerType)
+                    filteredListeners.uncheckedAppend(listener);
</ins><span class="cx">             }
</span><span class="cx">             if (!filteredListeners.isEmpty())
</span><del>-                eventInformation.append(EventListenerInfo(ancestor, type, filteredListeners));
</del><ins>+                eventInformation.append(EventListenerInfo(ancestor, type, WTFMove(filteredListeners)));
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -1477,7 +1477,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;Inspector::Protocol::DOM::EventListener&gt; InspectorDOMAgent::buildObjectForEventListener(const RegisteredEventListener&amp; registeredEventListener, const AtomicString&amp; eventType, Node* node, const String* objectGroupId)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;EventListener&gt; eventListener = registeredEventListener.listener;
</del><ins>+    Ref&lt;EventListener&gt; eventListener = registeredEventListener.listener();
</ins><span class="cx"> 
</span><span class="cx">     JSC::ExecState* state = nullptr;
</span><span class="cx">     JSC::JSObject* handler = nullptr;
</span><span class="lines">@@ -1486,7 +1486,7 @@
</span><span class="cx">     int columnNumber = 0;
</span><span class="cx">     String scriptID;
</span><span class="cx">     String sourceName;
</span><del>-    if (auto scriptListener = JSEventListener::cast(eventListener.get())) {
</del><ins>+    if (auto scriptListener = JSEventListener::cast(eventListener.ptr())) {
</ins><span class="cx">         JSC::JSLockHolder lock(scriptListener-&gt;isolatedWorld().vm());
</span><span class="cx">         state = execStateFromNode(scriptListener-&gt;isolatedWorld(), &amp;node-&gt;document());
</span><span class="cx">         handler = scriptListener-&gt;jsFunction(&amp;node-&gt;document());
</span><span class="lines">@@ -1507,7 +1507,7 @@
</span><span class="cx"> 
</span><span class="cx">     auto value = Inspector::Protocol::DOM::EventListener::create()
</span><span class="cx">         .setType(eventType)
</span><del>-        .setUseCapture(registeredEventListener.useCapture)
</del><ins>+        .setUseCapture(registeredEventListener.useCapture())
</ins><span class="cx">         .setIsAttribute(eventListener-&gt;isAttribute())
</span><span class="cx">         .setNodeId(pushNodePathToFrontend(node))
</span><span class="cx">         .setHandlerBody(body)
</span></span></pre></div>
<a id="trunkSourceWebCoreinspectorInspectorDOMAgenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorDOMAgent.h (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/inspector/InspectorDOMAgent.h        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/inspector/InspectorDOMAgent.h        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -80,10 +80,10 @@
</span><span class="cx"> typedef int BackendNodeId;
</span><span class="cx"> 
</span><span class="cx"> struct EventListenerInfo {
</span><del>-    EventListenerInfo(Node* node, const AtomicString&amp; eventType, const EventListenerVector&amp; eventListenerVector)
</del><ins>+    EventListenerInfo(Node* node, const AtomicString&amp; eventType, EventListenerVector&amp;&amp; eventListenerVector)
</ins><span class="cx">         : node(node)
</span><span class="cx">         , eventType(eventType)
</span><del>-        , eventListenerVector(eventListenerVector)
</del><ins>+        , eventListenerVector(WTFMove(eventListenerVector))
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoresvgSVGElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/svg/SVGElement.cpp (204458 => 204459)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/svg/SVGElement.cpp        2016-08-15 00:02:31 UTC (rev 204458)
+++ trunk/Source/WebCore/svg/SVGElement.cpp        2016-08-15 00:48:16 UTC (rev 204459)
</span><span class="lines">@@ -584,11 +584,8 @@
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     for (element = element-&gt;parentOrShadowHostElement(); element; element = element-&gt;parentOrShadowHostElement()) {
</span><del>-        const EventListenerVector&amp; entry = element-&gt;getEventListeners(eventNames().loadEvent);
-        for (auto&amp; listener : entry) {
-            if (listener.useCapture)
-                return true;
-        }
</del><ins>+        if (element-&gt;hasCapturingEventListeners(eventNames().loadEvent))
+            return true;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return false;
</span></span></pre>
</div>
</div>

</body>
</html>