pass the current cursor when computing the mouse position

Most of the time, the simulated mouse position can be
computed from the current cursor. But when the cursor
is changed, the current cursor info could be out of
date and generate a bus error.

fixes http://b/issue?id=2061211

3 files changed, 7 insertions, 6 deletions

diff --git a/WebKit/android/nav/CachedRoot.cpp b/WebKit/android/nav/CachedRoot.cpp
index 9fdd5dc..9608d64 100644
--- a/WebKit/android/nav/CachedRoot.cpp
+++ b/WebKit/android/nav/CachedRoot.cpp
@@ -866,7 +866,8 @@ int CachedRoot::getBlockLeftEdge(int x, int y, float scale) const
     return result;
 }
 
-void CachedRoot::getSimulatedMousePosition(WebCore::IntPoint* point) const
+void CachedRoot::getSimulatedMousePosition(const CachedNode* cursor,
+    WebCore::IntPoint* point) const
 {
 #ifndef NDEBUG
     ASSERT(CachedFrame::mDebug.mInUse);
@@ -878,7 +879,6 @@ void CachedRoot::getSimulatedMousePosition(WebCore::IntPoint* point) const
     int height = mouseBounds.height();
     point->setX(x + (width >> 1)); // default to box center
     point->setY(y + (height >> 1));
-    const CachedNode* cursor = currentCursor();
     if (cursor && cursor->bounds().contains(mHistory->mMouseBounds)) {
         if (cursor->isTextField()) // if text field, return end of line
             point->setX(x + width - 1);
diff --git a/WebKit/android/nav/CachedRoot.h b/WebKit/android/nav/CachedRoot.h
index 123e7d2..f84542c 100644
--- a/WebKit/android/nav/CachedRoot.h
+++ b/WebKit/android/nav/CachedRoot.h
@@ -67,7 +67,7 @@ public:
     int getAndResetSelectionEnd();
     int getAndResetSelectionStart();
     int getBlockLeftEdge(int x, int y, float scale) const;
-    void getSimulatedMousePosition(WebCore::IntPoint* ) const;
+    void getSimulatedMousePosition(const CachedNode* , WebCore::IntPoint* ) const;
     void init(WebCore::Frame* , CachedHistory* );
     bool innerDown(const CachedNode* , BestData* ) const;
     bool innerLeft(const CachedNode* , BestData* ) const;
diff --git a/WebKit/android/nav/WebView.cpp b/WebKit/android/nav/WebView.cpp
index cc90396..20daafc 100644
--- a/WebKit/android/nav/WebView.cpp
+++ b/WebKit/android/nav/WebView.cpp
@@ -741,7 +741,8 @@ void updateCursorBounds(const CachedRoot* root, const CachedFrame* cachedFrame,
         m_viewImpl->m_cursorBounds = cachedNode->bounds();
         m_viewImpl->m_cursorHitBounds = cachedNode->hitBounds();
         m_viewImpl->m_cursorFrame = cachedFrame->framePointer();
-        root->getSimulatedMousePosition(&m_viewImpl->m_cursorLocation);
+        root->getSimulatedMousePosition(cachedNode,
+            &m_viewImpl->m_cursorLocation);
         m_viewImpl->m_cursorNode = cachedNode->nodePointer();
     }
     m_viewImpl->gCursorBoundsMutex.unlock();
@@ -1461,7 +1462,7 @@ static jobject nativeCursorPosition(JNIEnv *env, jobject obj)
     const CachedRoot* root = view->getFrameCache(WebView::DontAllowNewer);
     WebCore::IntPoint pos = WebCore::IntPoint(0, 0);
     if (root)
-        root->getSimulatedMousePosition(&pos);
+        root->getSimulatedMousePosition(root->currentCursor(), &pos);
     jclass pointClass = env->FindClass("android/graphics/Point");
     jmethodID init = env->GetMethodID(pointClass, "<init>", "(II)V");
     jobject point = env->NewObject(pointClass, init, pos.x(), pos.y());
@@ -1928,7 +1929,7 @@ static void nativeMoveCursorToNextTextInput(JNIEnv *env, jobject obj)
     root->setCursor(const_cast<CachedFrame*>(frame),
             const_cast<CachedNode*>(next));
     WebCore::IntPoint pos;
-    root->getSimulatedMousePosition(&pos);
+    root->getSimulatedMousePosition(next, &pos);
     view->sendMoveMouse(static_cast<WebCore::Frame*>(frame->framePointer()),
             static_cast<WebCore::Node*>(next->nodePointer()), pos.x(), pos.y());
     view->scrollRectOnScreen(bounds.x(), bounds.y(), bounds.right(),