From 1185cfe3f0ebb99630bf47ffd026f5b6b541270e Mon Sep 17 00:00:00 2001
From: FranklinDM <mrmineshafter17@gmail.com>
Date: Fri, 3 Mar 2023 21:28:44 +0800
Subject: [PATCH] Issue #2135 - Bug 1323815: FocusEvent.relatedTarget should
 work consistently with MouseEvent.relatedTarget

* This incorporates changes from Bug 1413102.
---
 dom/events/Event.cpp               | 20 ++++++++++++
 dom/events/Event.h                 |  3 ++
 dom/events/FocusEvent.cpp          |  6 ++--
 dom/events/FocusEvent.h            |  2 +-
 dom/events/MouseEvent.cpp          | 22 +------------
 dom/html/test/mochitest.ini        |  1 +
 dom/html/test/test_bug1323815.html | 50 ++++++++++++++++++++++++++++++
 7 files changed, 79 insertions(+), 25 deletions(-)
 create mode 100644 dom/html/test/test_bug1323815.html

diff --git a/dom/events/Event.cpp b/dom/events/Event.cpp
index 7d7acb5e0a..31a39a5609 100755
--- a/dom/events/Event.cpp
+++ b/dom/events/Event.cpp
@@ -557,6 +557,26 @@ Event::SetEventType(const nsAString& aEventTypeArg)
   mEvent->SetDefaultComposedInNativeAnonymousContent();
 }
 
+already_AddRefed<EventTarget>
+Event::EnsureWebAccessibleRelatedTarget(EventTarget* aRelatedTarget)
+{
+  nsCOMPtr<EventTarget> relatedTarget = aRelatedTarget;
+  if (relatedTarget) {
+    nsCOMPtr<nsIContent> content = do_QueryInterface(relatedTarget);
+
+    if (content && content->ChromeOnlyAccess() &&
+        !nsContentUtils::CanAccessNativeAnon()) {
+      content = content->FindFirstNonChromeOnlyAccessContent();
+      relatedTarget = do_QueryInterface(content);
+    }
+
+    if (relatedTarget) {
+      relatedTarget = relatedTarget->GetTargetForDOMEvent();
+    }
+  }
+  return relatedTarget.forget();
+}
+
 void
 Event::InitEvent(const nsAString& aEventTypeArg,
                  bool aCanBubbleArg,
diff --git a/dom/events/Event.h b/dom/events/Event.h
index 5e7678b356..e48428f741 100755
--- a/dom/events/Event.h
+++ b/dom/events/Event.h
@@ -287,6 +287,9 @@ protected:
     mEvent->SetComposed(aComposed);
   }
 
+  already_AddRefed<EventTarget>
+  EnsureWebAccessibleRelatedTarget(EventTarget* aRelatedTarget);
+
   mozilla::WidgetEvent*       mEvent;
   RefPtr<nsPresContext>     mPresContext;
   nsCOMPtr<EventTarget>       mExplicitOriginalTarget;
diff --git a/dom/events/FocusEvent.cpp b/dom/events/FocusEvent.cpp
index 02fce7c939..48c22d8d23 100644
--- a/dom/events/FocusEvent.cpp
+++ b/dom/events/FocusEvent.cpp
@@ -30,14 +30,14 @@ NS_IMETHODIMP
 FocusEvent::GetRelatedTarget(nsIDOMEventTarget** aRelatedTarget)
 {
   NS_ENSURE_ARG_POINTER(aRelatedTarget);
-  NS_IF_ADDREF(*aRelatedTarget = GetRelatedTarget());
+  *aRelatedTarget = GetRelatedTarget().take();
   return NS_OK;
 }
 
-EventTarget*
+already_AddRefed<EventTarget>
 FocusEvent::GetRelatedTarget()
 {
-  return mEvent->AsFocusEvent()->mRelatedTarget;
+  return EnsureWebAccessibleRelatedTarget(mEvent->AsFocusEvent()->mRelatedTarget);
 }
 
 void
diff --git a/dom/events/FocusEvent.h b/dom/events/FocusEvent.h
index 055555716d..f2e0a6ea70 100644
--- a/dom/events/FocusEvent.h
+++ b/dom/events/FocusEvent.h
@@ -32,7 +32,7 @@ public:
              nsPresContext* aPresContext,
              InternalFocusEvent* aEvent);
 
-  EventTarget* GetRelatedTarget();
+  already_AddRefed<EventTarget> GetRelatedTarget();
 
   static already_AddRefed<FocusEvent> Constructor(const GlobalObject& aGlobal,
                                                   const nsAString& aType,
diff --git a/dom/events/MouseEvent.cpp b/dom/events/MouseEvent.cpp
index 72f0df4260..bf1423b2f4 100644
--- a/dom/events/MouseEvent.cpp
+++ b/dom/events/MouseEvent.cpp
@@ -300,27 +300,7 @@ MouseEvent::GetRelatedTarget()
       break;
   }
 
-  if (relatedTarget) {
-    nsCOMPtr<nsIContent> content = do_QueryInterface(relatedTarget);
-    nsCOMPtr<nsIContent> currentTarget =
-      do_QueryInterface(mEvent->mCurrentTarget);
-
-    nsIContent* shadowRelatedTarget = GetShadowRelatedTarget(currentTarget, content);
-    if (shadowRelatedTarget) {
-      relatedTarget = shadowRelatedTarget;
-    }
-
-    if (content && content->ChromeOnlyAccess() &&
-        !nsContentUtils::CanAccessNativeAnon()) {
-      relatedTarget = do_QueryInterface(content->FindFirstNonChromeOnlyAccessContent());
-    }
-
-    if (relatedTarget) {
-      relatedTarget = relatedTarget->GetTargetForDOMEvent();
-    }
-    return relatedTarget.forget();
-  }
-  return nullptr;
+  return EnsureWebAccessibleRelatedTarget(relatedTarget);
 }
 
 void
diff --git a/dom/html/test/mochitest.ini b/dom/html/test/mochitest.ini
index a0cc7b77f8..df5a9e3b55 100644
--- a/dom/html/test/mochitest.ini
+++ b/dom/html/test/mochitest.ini
@@ -445,6 +445,7 @@ support-files =
 [test_bug1146116.html]
 [test_bug1264157.html]
 [test_bug1287321.html]
+[test_bug1323815.html]
 [test_change_crossorigin.html]
 [test_checked.html]
 [test_dir_attributes_reflection.html]
diff --git a/dom/html/test/test_bug1323815.html b/dom/html/test/test_bug1323815.html
new file mode 100644
index 0000000000..5c54504190
--- /dev/null
+++ b/dom/html/test/test_bug1323815.html
@@ -0,0 +1,50 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1323815
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1323815</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1323815 **/
+
+SimpleTest.waitForExplicitFinish();
+function test() {
+  var n = document.getElementById("number");
+  var t = document.getElementById("text");
+  t.focus();
+  var gotBlur = false;
+  t.onblur = function(e) {
+    try {
+      is(e.relatedTarget.localName, "input");
+    } catch(ex) {
+      ok(false, "Accessing properties on the relatedTarget shouldn't throw! " + ex);
+    }
+    gotBlur = true;
+  }
+
+  n.focus();
+  ok(gotBlur);
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForFocus(test);
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1323815">Mozilla Bug 1323815</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+
+<input type="number" id="number"><input type="text" id="text">
+</body>
+</html>