nextTextField may walk off the end or try invalid frames

Rewrote nextTextField() to check range and frame, and
to more resemble other node walkers.

Caller no longer passes uninitialized frame in focused
case, and looks at parent frames after the target node.

Change-Id: I7ea9dffb75d28bdd9d71d83921058feca6baf928
http://b/2607250

1 files changed, 2 insertions, 10 deletions

diff --git a/WebKit/android/nav/CachedFrame.h b/WebKit/android/nav/CachedFrame.h
index ed76583..9334707 100644
--- a/WebKit/android/nav/CachedFrame.h
+++ b/WebKit/android/nav/CachedFrame.h
@@ -120,16 +120,6 @@ public:
 #endif
     WebCore::IntRect localBounds(const CachedNode* ,
         const WebCore::IntRect& ) const;
-    /**
-     * Find the next textfield/textarea
-     * @param start Must be a CachedNode in this CachedFrame's tree, or
-     *              null, in which case we start from the beginning.
-     * @param framePtr  If not null, and a textfield/textarea is found, its
-     *                  CachedFrame will be pointed to by this pointer.
-     * @return CachedNode* Next textfield (or area)
-     */
-    const CachedNode* nextTextField(const CachedNode* start,
-        const CachedFrame** framePtr) const;
     const CachedFrame* parent() const { return mParent; }
     CachedFrame* parent() { return mParent; }
     SkPicture* picture(const CachedNode* ) const;
@@ -152,6 +142,8 @@ public:
     }
     const CachedNode* validDocument() const;
 protected:
+    const CachedNode* nextTextField(const CachedNode* start,
+        const CachedFrame** framePtr, bool* found) const;
     struct BestData {
         int mDistance;
         int mSideDistance;