REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value direct...