Bug 798565 - touch.target may point to native anonymous content, r=jst,wesj

--HG--
extra : rebase_source : 675d640553e802b7c1e35143504d88ccb77585da

content/events/src/nsDOMTouchEvent.cpp

@@ -37,6 +37,13 @@ nsDOMTouch::GetIdentifier(int32_t* aIdentifier)
 NS_IMETHODIMP
 nsDOMTouch::GetTarget(nsIDOMEventTarget** aTarget)
 {
+  nsCOMPtr<nsIContent> content = do_QueryInterface(mTarget);
+  if (content && content->ChromeOnlyAccess() &&
+      !nsContentUtils::CanAccessNativeAnon()) {
+    content = content->FindFirstNonChromeOnlyAccessContent();
+    *aTarget = content.forget().get();
+    return NS_OK;
+  }
   NS_IF_ADDREF(*aTarget = mTarget);
   return NS_OK;
 }
@@ -314,7 +321,7 @@ nsDOMTouchEvent::GetTargetTouches(nsIDOMTouchList** aTargetTouches)
     if ((mEvent->message != NS_TOUCH_END &&
          mEvent->message != NS_TOUCH_CANCEL) || !touches[i]->mChanged) {
       nsIDOMEventTarget* targetPtr = touches[i]->GetTarget();
-      if (targetPtr == mEvent->target) {
+      if (targetPtr == mEvent->originalTarget) {
         targetTouches.AppendElement(touches[i]);
       }
     }

content/events/test/test_bug603008.html

@@ -496,6 +496,33 @@ function testRemovingElement() {
   nextTest();
 }
 
+function testNAC() {
+  let cwu = SpecialPowers.getDOMWindowUtils(window);
+  let target = document.getElementById("testTarget3");
+  let bcr = target.getBoundingClientRect();
+
+  let touch1 = new testtouch({
+    page: {x: Math.round(bcr.left + bcr.width/2),
+           y: Math.round(bcr.top  + bcr.height/2)},
+    target: target
+  });
+  let event = new touchEvent({
+    touches: [touch1],
+    targetTouches: [touch1],
+    changedTouches: [touch1]
+  });
+
+  // test touchstart event fires correctly
+  var checkFunction = checkEvent(event);
+  window.addEventListener("touchstart", checkFunction, false);
+  sendTouchEvent(cwu, "touchstart", event, 0);
+  window.removeEventListener("touchstart", checkFunction, false);
+
+  sendTouchEvent(cwu, "touchend", event, 0);
+
+  nextTest();
+}
+
 function doTest() {
   tests.push(testSingleTouch);
   tests.push(testSingleTouch2);
@@ -503,6 +530,7 @@ function doTest() {
   tests.push(testPreventDefault);
   tests.push(testTouchChanged);
   tests.push(testRemovingElement);
+  tests.push(testNAC);
 
   tests.push(function() {
     SimpleTest.finish();
@@ -519,6 +547,7 @@ addLoadEvent(doTest);
 <div id="parent">
   <span id="testTarget" style="padding: 5px; border: 1px solid black;">testTarget</span>
   <span id="testTarget2" style="padding: 5px; border: 1px solid blue;">testTarget</span>
+  <input type="text" id="testTarget3">
 </div>
 </body>
 </html>