Update CommandEvent/ToggleEvent retargeting logic

Apparently the original implementation could leak nodes out of the
shadowroot due to a misreading of the spec:
whatwg/html#11345 (review)

This patch makes the new retargeting logic use currentTarget, and if
currentTarget is null, then null is returned instead of returning the
original node.

Bug: 420639769
Change-Id: Ib5e580f83e68aa58ca5b9e8f024391e0191cb604
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6853807
Commit-Queue: Joey Arhar <[email protected]>
Reviewed-by: Mason Freed <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1509850}

Author: josepharhar

third_party/blink/renderer/core/dom/events/event.cc

@@ -285,13 +285,18 @@ void Event::SetRelatedTargetIfExists(EventTarget* related_target) {
 
 void Event::ReceivedTarget() {}
 
-Element* Event::Retarget(const Element* element) const {
+Element* Event::Retarget(Element* element) const {
   CHECK(RuntimeEnabledFeatures::ImprovedSourceRetargetingEnabled());
-  EventTarget* retarget_against = currentTarget() ? currentTarget() : target();
-  if (element && retarget_against && retarget_against->ToNode()) {
-    return &retarget_against->ToNode()->GetTreeScope().Retarget(*element);
+  if (!element) {
+    return nullptr;
+  }
+  if (EventTarget* current_target = currentTarget()) {
+    if (auto* current_target_node = current_target->ToNode()) {
+      return &current_target_node->GetTreeScope().Retarget(*element);
+    }
   }
-  return nullptr;
+  // retarget against the topmost TreeScope if there isn't a current target.
+  return &element->GetDocument().Retarget(*element);
 }
 
 void Event::SetUnderlyingEvent(const Event* ue) {

third_party/blink/renderer/core/dom/events/event.h

@@ -344,7 +344,7 @@ class CORE_EXPORT Event : public ScriptWrappable {
   // retargeted against currentTarget(). Otherwise, it is retargeted against
   // target().  target() may be null after event dispatch to prevent leaking,
   // and in that case, this method will return null as well.
-  Element* Retarget(const Element* element) const;
+  Element* Retarget(Element* element) const;
 
  private:
   AtomicString type_;