nextTextField may walk off the end or try invalid frames

Rewrote nextTextField() to check range and frame, and
to more resemble other node walkers.

Caller no longer passes uninitialized frame in focused
case, and looks at parent frames after the target node.

Change-Id: I7ea9dffb75d28bdd9d71d83921058feca6baf928
http://b/2607250

1 files changed, 8 insertions, 0 deletions

diff --git a/WebKit/android/nav/CachedRoot.h b/WebKit/android/nav/CachedRoot.h
index 735f23b..6e9fff0 100644
--- a/WebKit/android/nav/CachedRoot.h
+++ b/WebKit/android/nav/CachedRoot.h
@@ -75,6 +75,14 @@ public:
     WebCore::String imageURI(int x, int y) const;
     bool maskIfHidden(BestData* ) const;
     const CachedNode* moveCursor(Direction , const CachedFrame** , WebCore::IntPoint* scroll);
+    /**
+     * Find the next textfield/textarea
+     * @param start         The textfield/textarea to search from.
+     * @param framePtr      If non-zero, returns CachedFrame* containing result.
+     * @return CachedNode*  Next textfield/textarea or null (0) if none.
+     */
+    const CachedNode* nextTextField(const CachedNode* start,
+        const CachedFrame** framePtr) const;
     SkPicture* pictureAt(int x, int y) const;
     void reset();
     CachedHistory* rootHistory() const { return mHistory; }