match the frame with the node

In a couple of places, the wrong frame is used
with the node, resulting in a crash if the
node is in a layer.

bug:3373069
Change-Id: I0ff7a9d0aa07f742e95278c377b43ca77eb73212

2 files changed, 2 insertions, 2 deletions

diff --git a/WebKit/android/nav/CachedRoot.cpp b/WebKit/android/nav/CachedRoot.cpp
index c028afd..2f0e74d 100644
--- a/WebKit/android/nav/CachedRoot.cpp
+++ b/WebKit/android/nav/CachedRoot.cpp
@@ -1475,7 +1475,7 @@ void CachedRoot::innerMove(const CachedNode* node, BestData* bestData,
         mHistory->addToVisited(bestData->mNode, direction);
         mHistory->mNavBounds = bestData->bounds();
         mHistory->mMouseBounds =
-                cursorFrame->unadjustBounds(bestData->mNode,
+                bestData->mFrame->unadjustBounds(bestData->mNode,
                                             bestData->mouseBounds());
     } else if (scroll->x() != 0 || scroll->y() != 0) {
         WebCore::IntRect newBounds = mHistory->mNavBounds;
diff --git a/WebKit/android/nav/WebView.cpp b/WebKit/android/nav/WebView.cpp
index 2b1e854..8c7a016 100644
--- a/WebKit/android/nav/WebView.cpp
+++ b/WebKit/android/nav/WebView.cpp
@@ -1513,7 +1513,7 @@ static const CachedNode* getFocusCandidate(JNIEnv *env, jobject obj,
     const CachedNode* cursor = root->currentCursor(frame);
     if (cursor && cursor->wantsKeyEvents())
         return cursor;
-    return root->currentFocus();
+    return root->currentFocus(frame);
 }
 
 static bool focusCandidateHasNextTextfield(JNIEnv *env, jobject obj)