[Caja] onclick= set by innerHTML is broken

[felix8a]

Reviewers: MikeSamuel,

Description:
http://code.google.com/p/google-caja/issues/detail?id=588

domita has support for setting very simple onevent= handlers
when assigning to innerHTML.  for example, this is supposed
to work:

  <div id='a'></div>
  <script>
    var a = document.getElementById('a');
    a.innerHTML = '<input type="button" onclick="foo();">';
    function foo () { cajita.log(1); }
  </script>

however, this has been broken since valija was created,
because plugin_dispatchEvent knows how to find a cajita 'foo',
but not a valija 'foo'.

this change teaches plugin_dispatchEvent about valija 'foo'.

Please review this at http://codereview.appspot.com/115082

Affected files:
  M     src/com/google/caja/plugin/domita.js
  M     tests/com/google/caja/plugin/domita_test_untrusted.html


Index: tests/com/google/caja/plugin/domita_test_untrusted.html
===================================================================
--- tests/com/google/caja/plugin/domita_test_untrusted.html     (revision 3717)
+++ tests/com/google/caja/plugin/domita_test_untrusted.html     (working copy)
@@ -39,6 +39,10 @@
   <b>Click me</b>
 </p>

+<p class="clickme-testcontainer" id="test-innerhtml-onclick">
+  <b>do not click yet</b>
+</p>
+
 <div class="clickme-testcontainer" id="test-case-insensitive-attrs">
   <table id="is-red">
     <tr>
@@ -755,6 +759,23 @@
       });
 });

+jsunitRegister('testInnerhtmlOnclick',
+               function testInnerhtmlOnclick() {
+  var el = document.getElementById('test-innerhtml-onclick');
+  if (directAccess.isValija) {
+    el.innerHTML = '<b onclick="innerhtmlClicked();">Click me</b>';
+  } else {
+    // in cajita, innerhtmlClicked is a local module function,
+    // and there's no way for domita.js to access it.
+    el.innerHTML = "<span>Cajita can't link up onclick= functions</span>";
+    pass('test-innerhtml-onclick');
+  }
+});
+
+function innerhtmlClicked() {
+  pass('test-innerhtml-onclick');
+}
+
 jsunitRegister('testCaseInsensitiveAttrs',
                function testCaseInsensitiveAttrs() {
   var tableNode = document.getElementById('is-red');
Index: src/com/google/caja/plugin/domita.js
===================================================================
--- src/com/google/caja/plugin/domita.js        (revision 3717)
+++ src/com/google/caja/plugin/domita.js        (working copy)
@@ -4047,7 +4047,7 @@
   }
   switch (typeof handler) {
     case 'string':
-      handler = imports[handler];
+      handler = imports.$v ? imports.$v.ro(handler) : imports[handler];
       break;
     case 'function': case 'object':
       break;