1 files changed, 12 insertions, 6 deletions

diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index aa362b3..7635d07 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -59,6 +59,9 @@ static void makeCapitalized(String* string, UChar previous)
     unsigned length = string->length();
     const UChar* characters = string->characters();
 
+    if (length >= numeric_limits<unsigned>::max())
+        CRASH();
+
     StringBuffer stringWithPrevious(length + 1);
     stringWithPrevious[0] = previous == noBreakSpace ? ' ' : previous;
     for (unsigned i = 1; i < length + 1; i++) {
@@ -422,13 +425,13 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
     int pointBlockDirection = firstTextBox()->isHorizontal() ? point.y() : point.x();
     
     // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && pointBlockDirection <  firstTextBox()->root()->lineBottom() && pointLineDirection < firstTextBox()->logicalLeft()) {
+    if (firstTextBox() && pointBlockDirection <  firstTextBox()->root()->selectionBottom() && pointLineDirection < firstTextBox()->logicalLeft()) {
         // at the y coordinate of the first line or above
         // and the x coordinate is to the left of the first text box left edge
         offset = firstTextBox()->offsetForPosition(pointLineDirection);
         return createVisiblePosition(offset + firstTextBox()->start(), DOWNSTREAM);
     }
-    if (lastTextBox() && pointBlockDirection >= lastTextBox()->root()->lineTop() && pointLineDirection >= lastTextBox()->logicalRight()) {
+    if (lastTextBox() && pointBlockDirection >= lastTextBox()->root()->selectionTop() && pointLineDirection >= lastTextBox()->logicalRight()) {
         // at the y coordinate of the last line or below
         // and the x coordinate is to the right of the last text box right edge
         offset = lastTextBox()->offsetForPosition(pointLineDirection);
@@ -437,8 +440,11 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
 
     InlineTextBox* lastBoxAbove = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        if (pointBlockDirection >= box->root()->lineTop()) {
-            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->lineTop() : box->root()->lineBottom();
+        RootInlineBox* rootBox = box->root();
+        if (pointBlockDirection >= rootBox->selectionTop()) {
+            int bottom = rootBox->selectionBottom();
+            if (rootBox->nextRootBox())
+                bottom = min(bottom, rootBox->nextRootBox()->lineTop());
             if (pointBlockDirection < bottom) {
                 offset = box->offsetForPosition(pointLineDirection);
 
@@ -481,8 +487,8 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
     InlineTextBox* box = static_cast<InlineTextBox*>(inlineBox);
 
-    int height = box->root()->lineBottom() - box->root()->lineTop();
-    int top = box->root()->lineTop();
+    int height = box->root()->selectionHeight();
+    int top = box->root()->selectionTop();
 
     int left = box->positionForOffset(caretOffset);