fixes #18895, Prevent changedTouches from being dereferenced on non-T…

…ouchEvent instances

on.js

@@ -581,11 +581,13 @@ define(["./has!dom-addeventlistener?:./aspect", "./_base/kernel", "./sniff"], fu
 						event.rotation = 0;
 						event.scale = 1;
 					}
-					//use event.changedTouches[0].pageX|pageY|screenX|screenY|clientX|clientY|target
-					var firstChangeTouch = event.changedTouches[0];
-					for(var i in firstChangeTouch){ // use for-in, we don't need to have dependency on dojo/_base/lang here
-						delete event[i]; // delete it first to make it mutable
-						event[i] = firstChangeTouch[i];
+					if (window.TouchEvent && originalEvent instanceof TouchEvent) {
+						// use event.changedTouches[0].pageX|pageY|screenX|screenY|clientX|clientY|target
+						var firstChangeTouch = event.changedTouches[0];
+						for(var i in firstChangeTouch){ // use for-in, we don't need to have dependency on dojo/_base/lang here
+							delete event[i]; // delete it first to make it mutable
+							event[i] = firstChangeTouch[i];
+						}
 					}
 				}
 				return listener.call(this, event);

tests/unit/on.js

@@ -597,11 +597,31 @@ define([
 				// threw insecure operation errors when saving an event to a closure-bound variable.
 				lastEvent = lang.mixin({}, event);
 			});
+			// Since we can't simulate invoking TouchEvents (with current browsers initTouchEvent isn't available)
+			// we will make TouchEvent be an Event temporarily so the `on` implementation
+			// thinks that it is one for this test.
+			var originalTouchEvent = window.TouchEvent;
+			window.TouchEvent = Event;
 			on.emit(div, 'touchstart', { changedTouches: [{ pageX: 100 }] });
+			window.TouchEvent = originalTouchEvent;
 
 			assert.property(lastEvent, 'rotation');
 			assert.property(lastEvent, 'pageX');
 		});
+
+		has('touch') && (suite['DOM-specific']['touch event normalization doesn\'t happen to non-TouchEvent'] = function () {
+			var div = document.body.appendChild(document.createElement('div'));
+
+			var lastEvent;
+			on(div, 'touchstart', function (event) {
+				// Copying event properties to an object because certain versions of Firefox
+				// threw insecure operation errors when saving an event to a closure-bound variable.
+				lastEvent = lang.mixin({}, event);
+			});
+			on.emit(div, 'touchstart', { changedTouches: [{ pageX: 100 }] });
+
+			assert.isFalse(lastEvent.pageX === 100);
+		});
 	}
 
 	registerSuite(suite);