[Caja] support window.onload

[felix8a]

Reviewers: MikeSamuel,
Description:
Domita supports window.addEventListener('load')
but doesn't do anything with window.onload.

This adds support for window.onload.
It's not exactly identical to browser handling
of window.onload, because the order of
running onload handlers is different.

Browsers act as if setting window.onload were a
call to removeEventListener then addEventListener,
and all the onload handlers get run in the order
they were registered.  I didn't see a reason to
add all the code necessary to duplicate that order.

Please review this at http://codereview.appspot.com/150070

Affected files:
  M     src/com/google/caja/plugin/domita.js
  M     tests/com/google/caja/plugin/domita_test_untrusted.html


Index: tests/com/google/caja/plugin/domita_test_untrusted.html
===================================================================
--- tests/com/google/caja/plugin/domita_test_untrusted.html     (revision 3834)
+++ tests/com/google/caja/plugin/domita_test_untrusted.html     (working copy)
@@ -1937,17 +1937,20 @@
                function testOnLoadListener() {
   var b1 = false;
   var b2 = false;
+  var b3 = false;
   function setb1() { console.log('set onload b1'); b1 = true; }
   function setb2() { console.log('set onload b2'); b2 = true; }
+  function setb3() { console.log('set onload b3'); b3 = true; }

   window.addEventListener('load', setb1);
   window.addEventListener('load', setb2);
   window.removeEventListener('load', setb1);
+  window.onload = setb3;

   assertAsynchronousRequirement(
       'onload listeners',
       function () {
-        if (!b1 && b2) {
+        if (!b1 && b2 && b3) {
           pass('test-onload-listener');
           return true;
         }
@@ -1956,6 +1959,7 @@

   assertFalse(b1);
   assertFalse(b2);
+  assertFalse(b3);
 });

 jsunitRegister('testInnerHTMLStyleSanitizer',
Index: src/com/google/caja/plugin/domita.js
===================================================================
--- src/com/google/caja/plugin/domita.js        (revision 3834)
+++ src/com/google/caja/plugin/domita.js        (working copy)
@@ -3388,6 +3388,15 @@
     };
     // Called by the html-emitter when the virtual document has been  
loaded.
     TameHTMLDocument.prototype.signalLoaded___ = function () {
+      var onload = ((___.canRead(imports, '$v')
+                     && ___.canCallPub(imports.$v, 'ro')
+                     && imports.$v.ro('onload'))
+                    || ___.readPub(imports.window, 'onload'));
+      if (onload) {
+        setTimeout(
+            function () { ___.callPub(onload, 'call', [___.USELESS]); },
+            0);
+      }
       var listeners = this.onLoadListeners___;
       this.onLoadListeners___ = [];
       for (var i = 0, n = listeners.length; i < n; ++i) {
@@ -4069,7 +4078,7 @@

     var outers = imports.outers;
     if (___.isJSONContainer(outers)) {
-      // For Valija, attach use the window object as outers.
+      // For Valija, use the window object as outers.
       ___.forOwnKeys(outers, ___.markFuncFreeze(function(k, v) {
         if (!(k in tameWindow)) {
           tameWindow[k] = v;