Event handlers compiled from inline attributes aren't seeing properties of their current target as variables

[pshaughn]

After #25488, the first subtest in html/webappapis/scripting/events/compile-event-handler-lexical-scopes.html does what it's supposed to do far enough to find an actual problem. A more minimal case to focus on the one problem is:

    <div id="log"></div>
    <input value="4" onclick="document.getElementById('log').innerText+=value">
    <script>
      document.querySelector("input").click()
    </script>

In Firefox, this puts 4 in the div. In Servo, this logs nothing and reports an exception that value is not defined.

I need to look at specifications more to figure out what mechanism should be exposing the properties in this way and what part of it Servo is missing; prior to this test, I was unaware this behavior existed at all.

[jdm]

It's not about exposing properties; it's that the this value when dispatching the event should be the HTMLInputElement, so a bareword lookup of value should be equivalent to element['value'].

[pshaughn]

That's not what this does in a normal function call. For example:

<script>
      x={a:5, b: function() { console.log(this); console.log(this.a); console.log(a); } }
      x.b();
</script>

In firefox the above code logs the object, then logs 5 once, then reports an exception that a is not defined.

[pshaughn]

Also, the this is being defined (both on my branch for #25488 and in master); if I change my first snippet to innertext+=this, I get [object HTMLInputElement] to appear.

[pshaughn]

This is a special behavior of inline handlers defined in on* attributes, and it happens when they are compiled, as specified under "Scope" in step 3.9 of https://html.spec.whatwg.org/#internal-raw-uncompiled-handler . The same function body assigned into onclick using a Javascript function() block instead of a string does not see value in Firefox.

[pshaughn]

servo/components/script/dom/eventtarget.rs

Lines 504 to 507 in b52ddc5

	// TODO step 1.10.1-3 (document, form owner, element in scope chain)
	let scopechain = AutoObjectVectorWrapper::new(*cx);

This is the missing piece; step numbers have changed, but looking for a scope in the document, form owner, and element is what 3.9 of https://html.spec.whatwg.org/#internal-raw-uncompiled-handler is saying to do.
Someone with more Spidermonkey knowledge than I have might want to jump in here.

[pshaughn]

It looks like we need to turn the document, the form owner if it exists, and the target if it's an element into *mut JSObject, and pass them into scopechain.append. Getting those JSObject pointers is already implemented for LayoutDom, but as this is not happening during layout, I don't know what safety considerations exist here, and there is very obviously aliasing involved since we are also continuing to use the target.

[jdm]

We can get the JSObject pointer for any DOM object by calling dom_object.reflector().get_jsobject().get() on it. It should be straightforward to get the scope chain correct if we only need to append them to that vector.

[pshaughn]

Ok, I'll try it!

[pshaughn]

https://github.com/pshaughn/servo/tree/compiledeventscope fixes this, but won't pass any of the existing tests until #25488 lands because the existing tests also involve capture/bubble behavior. Pushing a new test just for this would be redundant since the larger tests are already covering it thoroughly. Is this the kind of thing that the _mozilla tests are for?

[jdm]

Yep! Those don't get upstreamed by default, so they cover browser-specific behaviour or non-standard extensions.