From 4e91e28a6272b7da51843a091dfea3992f6516fe Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 20 Aug 2013 00:12:56 +0300
Subject: [PATCH] Bug 906684, make sure to access the right
 EventTargetChainItem when forwarding events to chrome, r=jst

--HG--
extra : rebase_source : afb2b457c422585e85d7abccfd76f0b6f85315a4
---
 content/events/src/nsEventDispatcher.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
index 462c63bcc7bb..b5254aa188be 100644
--- a/content/events/src/nsEventDispatcher.cpp
+++ b/content/events/src/nsEventDispatcher.cpp
@@ -461,6 +461,7 @@ nsEventDispatcher::Dispatch(nsISupports* aTarget,
   // Create the event target chain item for the event target.
   nsEventTargetChainItem* targetEtci =
     nsEventTargetChainItem::Create(chain, target->GetTargetForEventTargetChain());
+  MOZ_ASSERT(&chain[0] == targetEtci);
   if (!targetEtci->IsValid()) {
     nsEventTargetChainItem::DestroyLast(chain, targetEtci);
     return NS_ERROR_FAILURE;
@@ -508,6 +509,7 @@ nsEventDispatcher::Dispatch(nsISupports* aTarget,
     nsEventTargetChainItem::DestroyLast(chain, targetEtci);
     targetEtci = EventTargetChainItemForChromeTarget(chain, content);
     NS_ENSURE_STATE(targetEtci);
+    MOZ_ASSERT(&chain[0] == targetEtci);
     targetEtci->PreHandleEvent(preVisitor);
   }
   if (preVisitor.mCanHandle) {
@@ -516,6 +518,7 @@ nsEventDispatcher::Dispatch(nsISupports* aTarget,
     nsCOMPtr<EventTarget> t = do_QueryInterface(aEvent->target);
     targetEtci->SetNewTarget(t);
     nsEventTargetChainItem* topEtci = targetEtci;
+    targetEtci = nullptr;
     while (preVisitor.mParentTarget) {
       EventTarget* parentTarget = preVisitor.mParentTarget;
       nsEventTargetChainItem* parentEtci =
@@ -551,7 +554,7 @@ nsEventDispatcher::Dispatch(nsISupports* aTarget,
             if (parentEtci) {
               parentEtci->PreHandleEvent(preVisitor);
               if (preVisitor.mCanHandle) {
-                targetEtci->SetNewTarget(parentTarget);
+                chain[0].SetNewTarget(parentTarget);
                 topEtci = parentEtci;
                 continue;
               }
@@ -591,8 +594,6 @@ nsEventDispatcher::Dispatch(nsISupports* aTarget,
   // Note, nsEventTargetChainItem objects are deleted when the chain goes out of
   // the scope.
 
-  targetEtci = nullptr;
-
   aEvent->mFlags.mIsBeingDispatched = false;
   aEvent->mFlags.mDispatchedAtLeastOnce = true;