Window and WorkerGlobalScope should inherit EventTarget

https://bugs.webkit.org/show_bug.cgi?id=154170 <rdar://problem/24642377> Reviewed by Darin Adler. LayoutTests/imported/w3c: Rebaseline now that a couple of checks are passing. * web-platform-tests/html/dom/interfaces-expected.txt: Source/WebCore: Window and WorkerGlobalScope should inherit EventTarget instead of duplicating the EventTarget API in their IDL. These were the last interfaces that needed fixing. The next step will be to get rid of the [EventTarget] IDL extended attribute and rely entirely on the EventTarget inheritance. Test: - fast/frames/detached-frame-eventListener.html - Covered by existing tests. * WebCore.xcodeproj/project.pbxproj: Add JSEventTargetCustom.h header to the project. * bindings/js/JSDOMWindowCustom.cpp: Drop custom bindings for Window's addEventListener() and removeEventListener(). The only reason these needed custom code was to add a check for frameless windows. The frameless Window checks was moved to the respective methods in the JSEventTarget generated bindings. * bindings/js/JSDOMWindowShell.cpp: (WebCore::JSDOMWindowShell::setWindow): Set WindowPrototype's prototype to EventTarget's prototype. * bindings/js/JSDOMWindowShell.h: * bindings/js/JSDictionary.cpp: Include "DOMWindow.h" to fix the build. * bindings/js/JSEventTargetCustom.cpp: (WebCore::JSEventTarget::toWrapped): Handle DOMWindow and WorkerGlobalScope explicitely in toWrapped() and get rid of the DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE) now that all interfaces inherit EventTarget when they should. The reason DOMWindow and WorkerGlobalScope still need special handling is because their wrappers (JSDOMWindow / JSWorkerGlobalScope) do not subclass JSEventTarget. (WebCore::JSEventTargetOrGlobalScope::create): * bindings/js/JSEventTargetCustom.h: Added. (WebCore::JSEventTargetOrGlobalScope::wrapped): (WebCore::JSEventTargetOrGlobalScope::operator JSC::JSObject&): (WebCore::JSEventTargetOrGlobalScope::JSEventTargetOrGlobalScope): Add a wrapper type for JSEventTarget / JSDOMWindow and JSWorkerGlobalScope for use in the generated bindings. This is needed because JSDOMWindow and JSWorkerGlobalScope do not subclass JSEventTarget. Subclassing JSEventTarget would be complicated for them because they already subclass JSDOMWindowBase / JSWorkerGlobalScopeBase, which subclasses JSDOMGlobalObject. * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::initScript): Set WorkerGlobalScopePrototype's prototype to EventTarget's prototype. * bindings/scripts/CodeGeneratorJS.pm: (ShouldGenerateToJSDeclaration): Do not generate to toJS() implementation for interfaces that use the [CustomProxyToJSObject] IDL extended attribute, even if they inherit EventTarget. (GetCastingHelperForThisObject): To initialize castedThis from thisValue JSValue, we now use the JSEventTargetOrGlobalScope wrapper for the EventTarget implementation. This is to work around the fact that JSDOMWindow and JSWorkerGlobalScope do not subclass JSEventTarget. (GenerateFunctionCastedThis): - Drop code handling [WorkerGlobalScope] IDL extended attribute as there is no such attribute. - Use auto instead of auto* type for castedThis because JSEventTargetOrGlobalScope::create() returns a unique_ptr. - Do not check that castedThis inherits JSEventTarget in the EventTarget bindings code as this no longer holds true. (GenerateImplementation): Generate frameless window() and security checks for EventTarget methods when thisValue is a JSDOMWindow. * dom/EventTarget.idl: Add [JSCustomHeader] IDL Extended attribute as we need a header to expose JSEventTargetOrGlobalScope class. * page/DOMWindow.idl: * workers/WorkerGlobalScope.idl: Inherit EventTarget and stop duplicating the EventTarget API. This matches the HTML specification. LayoutTests: * fast/frames/detached-frame-eventListener-expected.txt: Added. * fast/frames/detached-frame-eventListener.html: Added. Add test case to cover the use of the EventListener API on a detached frame. * fast/loader/window-clearing-expected.txt: Rebaseline now that window has one more object in its prototype chain. * http/tests/security/cross-frame-access-call-expected.txt: * http/tests/security/cross-frame-access-call.html: Add test coverage for cross-origin access to window.dispatchEvent() which should not be allowed, in addition to window.addEventListener() and window.removeEventListener() which were already tested. Canonical link: https://commits.webkit.org/172339@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@196563 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Feb 15, 2016 · 2e8bb8d · 2e8bb8d
1 parent 1be2297
commit 2e8bb8d
Show file tree

Hide file tree

Showing 32 changed files with 387 additions and 184 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,25 @@
+2016-02-14  Chris Dumez  <cdumez@apple.com>
+
+        Window and WorkerGlobalScope should inherit EventTarget
+        https://bugs.webkit.org/show_bug.cgi?id=154170
+        <rdar://problem/24642377>
+
+        Reviewed by Darin Adler.
+
+        * fast/frames/detached-frame-eventListener-expected.txt: Added.
+        * fast/frames/detached-frame-eventListener.html: Added.
+        Add test case to cover the use of the EventListener API on a detached
+        frame.
+
+        * fast/loader/window-clearing-expected.txt:
+        Rebaseline now that window has one more object in its prototype chain.
+
+        * http/tests/security/cross-frame-access-call-expected.txt:
+        * http/tests/security/cross-frame-access-call.html:
+        Add test coverage for cross-origin access to window.dispatchEvent() which
+        should not be allowed, in addition to window.addEventListener() and
+        window.removeEventListener() which were already tested.
+
 2016-02-12  Nan Wang  <n_wang@apple.com>
 
         AX: Implement paragraph related text marker functions using TextIterator

diff --git a/LayoutTests/fast/frames/detached-frame-eventListener-expected.txt b/LayoutTests/fast/frames/detached-frame-eventListener-expected.txt
@@ -0,0 +1,12 @@
+Tests that the EventTarget API is no longer working on detached frames.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+addEventListenerFunction.call(childWindow, 'myevent', function() { callbackCalled = true; });
+PASS dispatchEventFunc.call(childWindow, new Event('myevent')) is undefined.
+PASS callbackCalled is false
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/frames/detached-frame-eventListener.html b/LayoutTests/fast/frames/detached-frame-eventListener.html
@@ -0,0 +1,20 @@
+<script src="../../resources/js-test-pre.js"></script>
+<script>
+description("Tests that the EventTarget API is no longer working on detached frames.");
+jsTestIsAsync = true;
+
+onload = function()
+{
+    childWindow = frames[0];
+    addEventListenerFunction = childWindow.addEventListener;
+    dispatchEventFunc = childWindow.dispatchEvent;
+    document.body.removeChild(document.getElementsByTagName("iframe")[0]);
+    callbackCalled = false;
+    evalAndLog("addEventListenerFunction.call(childWindow, 'myevent', function() { callbackCalled = true; });");
+    shouldBeUndefined("dispatchEventFunc.call(childWindow, new Event('myevent'))");
+    shouldBeFalse("callbackCalled");
+    finishJSTest();
+}
+</script>
+<iframe src="about:blank"></iframe>
+<script src="../../resources/js-test-post.js"></script>
diff --git a/LayoutTests/fast/loader/window-clearing-expected.txt b/LayoutTests/fast/loader/window-clearing-expected.txt
@@ -7,3 +7,5 @@ PASS: element 0 in the window's prototype chain was cleared
 PASS: element 1 in the window's prototype chain was cleared
 
 PASS: element 2 in the window's prototype chain was cleared
+
+PASS: element 3 in the window's prototype chain was cleared
diff --git a/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt b/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt
@@ -26,6 +26,7 @@ CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" fro
 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
+CONSOLE MESSAGE: line 1: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 CONSOLE MESSAGE: line 10: Blocked a frame with origin "http://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.
 
 
@@ -45,6 +46,7 @@ PASS: window.btoa.call(targetWindow, 'string') should be 'undefined' and is.
 PASS: window.open.call(targetWindow, '') should be 'undefined' and is.
 PASS: window.addEventListener.call(targetWindow, 'load', null, false); should be 'undefined' and is.
 PASS: window.removeEventListener.call(targetWindow, 'load', null, false); should be 'undefined' and is.
+PASS: window.dispatchEvent.call(targetWindow, new Event('click')); should be 'undefined' and is.
 PASS: window.clearTimeout.call(targetWindow, 0); should be 'undefined' and is.
 PASS: window.clearInterval.call(targetWindow, 0); should be 'undefined' and is.
 PASS: window.print.call(targetWindow); should be 'undefined' and is.

diff --git a/LayoutTests/http/tests/security/cross-frame-access-call.html b/LayoutTests/http/tests/security/cross-frame-access-call.html
@@ -42,6 +42,7 @@
     // These always return undefined so we use the error console to detect failure
     shouldBe("window.addEventListener.call(targetWindow, 'load', null, false);", "undefined");
     shouldBe("window.removeEventListener.call(targetWindow, 'load', null, false);", "undefined");
+    shouldBe("window.dispatchEvent.call(targetWindow, new Event('click'));", "undefined");
     shouldBe("window.clearTimeout.call(targetWindow, 0);", "undefined");
     shouldBe("window.clearInterval.call(targetWindow, 0);", "undefined");
     shouldBe("window.print.call(targetWindow);", "undefined");

diff --git a/LayoutTests/imported/w3c/ChangeLog b/LayoutTests/imported/w3c/ChangeLog
@@ -1,3 +1,15 @@
+2016-02-14  Chris Dumez  <cdumez@apple.com>
+
+        Window and WorkerGlobalScope should inherit EventTarget
+        https://bugs.webkit.org/show_bug.cgi?id=154170
+        <rdar://problem/24642377>
+
+        Reviewed by Darin Adler.
+
+        Rebaseline now that a couple of checks are passing.
+
+        * web-platform-tests/html/dom/interfaces-expected.txt:
+
 2016-02-12  Jiewen Tan  <jiewen_tan@apple.com>
 
         WebKit should expose the DOM 4 Event.isTrusted property

diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt
@@ -3799,14 +3799,10 @@ FAIL DragEvent interface object name assert_own_property: self does not have own
 FAIL DragEvent interface: existence and properties of interface prototype object assert_own_property: self does not have own property "DragEvent" expected property "DragEvent" missing
 FAIL DragEvent interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "DragEvent" expected property "DragEvent" missing
 FAIL DragEvent interface: attribute dataTransfer assert_own_property: self does not have own property "DragEvent" expected property "DragEvent" missing
-FAIL Window interface: existence and properties of interface object assert_equals: prototype of Window is not EventTarget expected function "function EventTarget() {
-    [native code]
-}" but got function "function () {
-    [native code]
-}"
+PASS Window interface: existence and properties of interface object 
 PASS Window interface object length 
 PASS Window interface object name 
-FAIL Window interface: existence and properties of interface prototype object assert_equals: Class name for prototype of Window.prototype is not "WindowProperties" expected "[object WindowProperties]" but got "[object Object]"
+FAIL Window interface: existence and properties of interface prototype object assert_equals: Class name for prototype of Window.prototype is not "WindowProperties" expected "[object WindowProperties]" but got "[object EventTargetPrototype]"
 FAIL Window interface: existence and properties of interface prototype object's "constructor" property assert_own_property: Window.prototype does not have own property "constructor" expected property "constructor" missing
 PASS Window interface: attribute self 
 PASS Window interface: attribute name 

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,98 @@
+2016-02-14  Chris Dumez  <cdumez@apple.com>
+
+        Window and WorkerGlobalScope should inherit EventTarget
+        https://bugs.webkit.org/show_bug.cgi?id=154170
+        <rdar://problem/24642377>
+
+        Reviewed by Darin Adler.
+
+        Window and WorkerGlobalScope should inherit EventTarget instead of
+        duplicating the EventTarget API in their IDL. These were the last
+        interfaces that needed fixing. The next step will be to get rid
+        of the [EventTarget] IDL extended attribute and rely entirely
+        on the EventTarget inheritance.
+
+        Test:
+        - fast/frames/detached-frame-eventListener.html
+        - Covered by existing tests.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add JSEventTargetCustom.h header to the project.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        Drop custom bindings for Window's addEventListener() and
+        removeEventListener(). The only reason these needed custom
+        code was to add a check for frameless windows. The frameless
+        Window checks was moved to the respective methods in the
+        JSEventTarget generated bindings.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        Set WindowPrototype's prototype to EventTarget's prototype.
+
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDictionary.cpp:
+        Include "DOMWindow.h" to fix the build.
+
+        * bindings/js/JSEventTargetCustom.cpp:
+        (WebCore::JSEventTarget::toWrapped):
+        Handle DOMWindow and WorkerGlobalScope explicitely in toWrapped()
+        and get rid of the DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE)
+        now that all interfaces inherit EventTarget when they should.
+        The reason DOMWindow and WorkerGlobalScope still need special
+        handling is because their wrappers (JSDOMWindow /
+        JSWorkerGlobalScope) do not subclass JSEventTarget.
+
+        (WebCore::JSEventTargetOrGlobalScope::create):
+        * bindings/js/JSEventTargetCustom.h: Added.
+        (WebCore::JSEventTargetOrGlobalScope::wrapped):
+        (WebCore::JSEventTargetOrGlobalScope::operator JSC::JSObject&):
+        (WebCore::JSEventTargetOrGlobalScope::JSEventTargetOrGlobalScope):
+        Add a wrapper type for JSEventTarget / JSDOMWindow and
+        JSWorkerGlobalScope for use in the generated bindings. This is
+        needed because JSDOMWindow and JSWorkerGlobalScope do not
+        subclass JSEventTarget. Subclassing JSEventTarget would be
+        complicated for them because they already subclass
+        JSDOMWindowBase / JSWorkerGlobalScopeBase, which subclasses
+        JSDOMGlobalObject.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        Set WorkerGlobalScopePrototype's prototype to EventTarget's prototype.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (ShouldGenerateToJSDeclaration):
+        Do not generate to toJS() implementation for interfaces that use
+        the [CustomProxyToJSObject] IDL extended attribute, even if they
+        inherit EventTarget.
+
+        (GetCastingHelperForThisObject):
+        To initialize castedThis from thisValue JSValue, we now use the
+        JSEventTargetOrGlobalScope wrapper for the EventTarget
+        implementation. This is to work around the fact that JSDOMWindow
+        and JSWorkerGlobalScope do not subclass JSEventTarget.
+
+        (GenerateFunctionCastedThis):
+        - Drop code handling [WorkerGlobalScope] IDL extended attribute
+          as there is no such attribute.
+        - Use auto instead of auto* type for castedThis because
+          JSEventTargetOrGlobalScope::create() returns a unique_ptr.
+        - Do not check that castedThis inherits JSEventTarget in the
+          EventTarget bindings code as this no longer holds true.
+
+        (GenerateImplementation):
+        Generate frameless window() and security checks for EventTarget
+        methods when thisValue is a JSDOMWindow.
+
+        * dom/EventTarget.idl:
+        Add [JSCustomHeader] IDL Extended attribute as we need a header
+        to expose JSEventTargetOrGlobalScope class.
+
+        * page/DOMWindow.idl:
+        * workers/WorkerGlobalScope.idl:
+        Inherit EventTarget and stop duplicating the EventTarget API.
+        This matches the HTML specification.
+
 2016-02-14  Darin Adler  <darin@apple.com>
 
         Small tweaks to some SimpleLineLayout code

diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -1709,6 +1709,7 @@
 		4669B2871B852A0B000F905F /* JSDOMNamedFlowCollectionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46F2768E1B85297F005C2556 /* JSDOMNamedFlowCollectionCustom.cpp */; };
 		467302021C4EFE7800BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 467302011C4EFE6600BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h */; };
 		4689F1AF1267BAE100E8D380 /* FileMetadata.h in Headers */ = {isa = PBXBuildFile; fileRef = 4689F1AE1267BAE100E8D380 /* FileMetadata.h */; };
+		46B63F6C1C6E8D19002E914B /* JSEventTargetCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 46B63F6B1C6E8CDF002E914B /* JSEventTargetCustom.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		46C83EFD1A9BBE2900A79A41 /* GeoNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46C83EFB1A9BBE2900A79A41 /* GeoNotifier.cpp */; };
 		46C83EFE1A9BBE2900A79A41 /* GeoNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 46C83EFC1A9BBE2900A79A41 /* GeoNotifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		46DB7D571B20FE46005651B2 /* VNodeTrackerCocoa.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46DB7D561B20FE3C005651B2 /* VNodeTrackerCocoa.cpp */; };
@@ -9192,6 +9193,7 @@
 		463EB6211B8789CB0096ED51 /* TagCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TagCollection.h; sourceTree = "<group>"; };
 		467302011C4EFE6600BCB357 /* IgnoreOpensDuringUnloadCountIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IgnoreOpensDuringUnloadCountIncrementer.h; sourceTree = "<group>"; };
 		4689F1AE1267BAE100E8D380 /* FileMetadata.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileMetadata.h; sourceTree = "<group>"; };
+		46B63F6B1C6E8CDF002E914B /* JSEventTargetCustom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEventTargetCustom.h; sourceTree = "<group>"; };
 		46C83EFB1A9BBE2900A79A41 /* GeoNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeoNotifier.cpp; sourceTree = "<group>"; };
 		46C83EFC1A9BBE2900A79A41 /* GeoNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeoNotifier.h; sourceTree = "<group>"; };
 		46DB7D561B20FE3C005651B2 /* VNodeTrackerCocoa.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VNodeTrackerCocoa.cpp; sourceTree = "<group>"; };
@@ -22197,6 +22199,7 @@
 				F3D461461161D53200CA0D09 /* JSErrorHandler.cpp */,
 				F3D461471161D53200CA0D09 /* JSErrorHandler.h */,
 				BC60901E0E91B8EC000C68B5 /* JSEventTargetCustom.cpp */,
+				46B63F6B1C6E8CDF002E914B /* JSEventTargetCustom.h */,
 				3314ACE910892086000F0E56 /* JSExceptionBase.cpp */,
 				3314ACEA10892086000F0E56 /* JSExceptionBase.h */,
 				8F934D841189F1EE00508D5D /* JSMainThreadExecState.cpp */,
@@ -24987,6 +24990,7 @@
 				2EDEF1F7121B0EFC00726DB2 /* BlobRegistryImpl.h in Headers */,
 				2EB4BCD3121F03E300EC4885 /* BlobResourceHandle.h in Headers */,
 				976D6C7F122B8A3D001FD1F7 /* BlobURL.h in Headers */,
+				46B63F6C1C6E8D19002E914B /* JSEventTargetCustom.h in Headers */,
 				93F199BE08245E59001E9ABC /* BlockExceptions.h in Headers */,
 				BC5EB5E10E81BE8700B25965 /* BorderData.h in Headers */,
 				589556ED18D4A44000764B03 /* BorderEdge.h in Headers */,

diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -751,34 +751,6 @@ JSValue JSDOMWindow::setInterval(ExecState& state)
     return jsNumber(result);
 }
 
-JSValue JSDOMWindow::addEventListener(ExecState& state)
-{
-    Frame* frame = wrapped().frame();
-    if (!frame)
-        return jsUndefined();
-
-    JSValue listener = state.argument(1);
-    if (!listener.isObject())
-        return jsUndefined();
-
-    wrapped().addEventListener(state.argument(0).toString(&state)->toAtomicString(&state), JSEventListener::create(asObject(listener), this, false, globalObject()->world()), state.argument(2).toBoolean(&state));
-    return jsUndefined();
-}
-
-JSValue JSDOMWindow::removeEventListener(ExecState& state)
-{
-    Frame* frame = wrapped().frame();
-    if (!frame)
-        return jsUndefined();
-
-    JSValue listener = state.argument(1);
-    if (!listener.isObject())
-        return jsUndefined();
-
-    wrapped().removeEventListener(state.argument(0).toString(&state)->toAtomicString(&state), JSEventListener::create(asObject(listener), this, false, globalObject()->world()).ptr(), state.argument(2).toBoolean(&state));
-    return jsUndefined();
-}
-
 DOMWindow* JSDOMWindow::toWrapped(JSValue value)
 {
     if (!value.isObject())

diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -32,7 +32,7 @@
 #include "Frame.h"
 #include "GCController.h"
 #include "JSDOMWindow.h"
-#include "DOMWindow.h"
+#include "JSEventTarget.h"
 #include "ScriptController.h"
 #include <heap/StrongInlines.h>
 #include <runtime/JSObject.h>
@@ -85,6 +85,7 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
     Structure* structure = JSDOMWindow::createStructure(vm, 0, prototype.get());
     JSDOMWindow* jsDOMWindow = JSDOMWindow::create(vm, structure, *domWindow, this);
     prototype->structure()->setGlobalObject(vm, jsDOMWindow);
+    prototype->structure()->setPrototypeWithoutTransition(vm, JSEventTarget::getPrototype(vm, jsDOMWindow));
     setWindow(vm, jsDOMWindow);
     ASSERT(jsDOMWindow->globalObject() == jsDOMWindow);
     ASSERT(prototype->globalObject() == jsDOMWindow);

diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -29,12 +29,12 @@
 #ifndef JSDOMWindowShell_h
 #define JSDOMWindowShell_h
 
+#include "DOMWindow.h"
 #include "JSDOMWindow.h"
 #include <runtime/JSProxy.h>
 
 namespace WebCore {
 
-    class DOMWindow;
     class Frame;
 
     class JSDOMWindowShell : public JSC::JSProxy {

diff --git a/Source/WebCore/bindings/js/JSDictionary.cpp b/Source/WebCore/bindings/js/JSDictionary.cpp
@@ -27,6 +27,7 @@
 #include "JSDictionary.h"
 
 #include "ArrayValue.h"
+#include "DOMWindow.h"
 #include "Dictionary.h"
 #include "JSCSSFontFaceRule.h"
 #include "JSDOMError.h"

diff --git a/Source/WebCore/bindings/js/JSEventTargetCustom.cpp b/Source/WebCore/bindings/js/JSEventTargetCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,15 @@
 #include "config.h"
 #include "JSEventTarget.h"
 
+#include "DOMWindow.h"
+#include "EventTarget.h"
 #include "EventTargetHeaders.h"
 #include "EventTargetInterfaces.h"
+#include "JSDOMWindow.h"
 #include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
+#include "JSWorkerGlobalScope.h"
+#include "WorkerGlobalScope.h"
 
 using namespace JSC;
 
@@ -61,12 +66,23 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 EventTarget* JSEventTarget::toWrapped(JSC::JSValue value)
 {
     TRY_TO_UNWRAP_WITH_INTERFACE(DOMWindowShell)
+    TRY_TO_UNWRAP_WITH_INTERFACE(DOMWindow)
+    TRY_TO_UNWRAP_WITH_INTERFACE(WorkerGlobalScope)
     TRY_TO_UNWRAP_WITH_INTERFACE(EventTarget)
-    // FIXME: Remove this once all event targets extend EventTarget
-    DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE)
-    return 0;
+    return nullptr;
 }
 
 #undef TRY_TO_UNWRAP_WITH_INTERFACE
 
+std::unique_ptr<JSEventTargetWrapper> jsEventTargetCast(JSC::JSValue thisValue)
+{
+    if (auto* target = JSC::jsDynamicCast<JSEventTarget*>(thisValue))
+        return std::make_unique<JSEventTargetWrapper>(target->wrapped(), *target);
+    if (auto* window = toJSDOMWindow(thisValue))
+        return std::make_unique<JSEventTargetWrapper>(window->wrapped(), *window);
+    if (auto* scope = toJSWorkerGlobalScope(thisValue))
+        return std::make_unique<JSEventTargetWrapper>(scope->wrapped(), *scope);
+    return nullptr;
+}
+
 } // namespace WebCore