3 files changed, 44 insertions, 4 deletions

diff --git a/WebKit/android/jni/WebCoreFrameBridge.cpp b/WebKit/android/jni/WebCoreFrameBridge.cpp
index a233cf5..c1454e4 100644
--- a/WebKit/android/jni/WebCoreFrameBridge.cpp
+++ b/WebKit/android/jni/WebCoreFrameBridge.cpp
@@ -1393,7 +1393,10 @@ static jboolean HasPasswordField(JNIEnv *env, jobject obj)
     bool found = false;
     WTF::PassRefPtr<WebCore::HTMLCollection> form = pFrame->document()->forms();
     WebCore::Node* node = form->firstItem();
-    while (node && !found) {
+    // Null/Empty namespace means that node is not created in HTMLFormElement
+    // class, but just normal Element class.
+    while (node && !found && !node->namespaceURI().isNull() &&
+           !node->namespaceURI().isEmpty()) {
         WTF::Vector<WebCore::HTMLFormControlElement*>& elements =
         		((WebCore::HTMLFormElement*)node)->formElements;
         size_t size = elements.size();
@@ -1423,7 +1426,8 @@ static jobjectArray GetUsernamePassword(JNIEnv *env, jobject obj)
     bool found = false;
     WTF::PassRefPtr<WebCore::HTMLCollection> form = pFrame->document()->forms();
     WebCore::Node* node = form->firstItem();
-    while (node && !found) {
+    while (node && !found && !node->namespaceURI().isNull() &&
+           !node->namespaceURI().isEmpty()) {
         WTF::Vector<WebCore::HTMLFormControlElement*>& elements =
         		((WebCore::HTMLFormElement*)node)->formElements;
         size_t size = elements.size();
@@ -1468,7 +1472,8 @@ static void SetUsernamePassword(JNIEnv *env, jobject obj,
     bool found = false;
     WTF::PassRefPtr<WebCore::HTMLCollection> form = pFrame->document()->forms();
     WebCore::Node* node = form->firstItem();
-    while (node && !found) {
+    while (node && !found && !node->namespaceURI().isNull() &&
+           !node->namespaceURI().isEmpty()) {
         WTF::Vector<WebCore::HTMLFormControlElement*>& elements =
         		((WebCore::HTMLFormElement*)node)->formElements;
         size_t size = elements.size();
@@ -1517,7 +1522,9 @@ static jobject GetFormTextData(JNIEnv *env, jobject obj)
 
         WebCore::HTMLFormElement* form;
         WebCore::HTMLInputElement* input;
-        for (WebCore::Node* node = collection->firstItem(); node; node = collection->nextItem()) {
+        for (WebCore::Node* node = collection->firstItem();
+             node && !node->namespaceURI().isNull() && !node->namespaceURI().isEmpty();
+             node = collection->nextItem()) {
             form = static_cast<WebCore::HTMLFormElement*>(node);
             if (form->autoComplete()) {
                 WTF::Vector<WebCore::HTMLFormControlElement*> elements = form->formElements;
diff --git a/WebKit/android/jni/WebViewCore.cpp b/WebKit/android/jni/WebViewCore.cpp
index fecacc9..57bc11c 100644
--- a/WebKit/android/jni/WebViewCore.cpp
+++ b/WebKit/android/jni/WebViewCore.cpp
@@ -685,6 +685,35 @@ void WebViewCore::updateButtonList(WTF::Vector<Container>* buttons)
     }
 }
 
+// note: updateCursorBounds is called directly by the WebView thread
+// This needs to be called each time we call CachedRoot::setCursor() with
+// non-null CachedNode/CachedFrame, since otherwise the WebViewCore's data
+// about the cursor is incorrect.  When we call setCursor(0,0), we need
+// to set hasCursorBounds to false.
+void WebViewCore::updateCursorBounds(const CachedRoot* root,
+        const CachedFrame* cachedFrame, const CachedNode* cachedNode)
+{
+    LOG_ASSERT(root, "updateCursorBounds: root cannot be null");
+    LOG_ASSERT(cachedNode, "updateCursorBounds: cachedNode cannot be null");
+    LOG_ASSERT(cachedFrame, "updateCursorBounds: cachedFrame cannot be null");
+    gCursorBoundsMutex.lock();
+    m_hasCursorBounds = !cachedNode->isHidden();
+    // If m_hasCursorBounds is false, we never look at the other
+    // values, so do not bother setting them.
+    if (m_hasCursorBounds) {
+        WebCore::IntRect bounds = cachedNode->bounds(cachedFrame);
+        if (m_cursorBounds != bounds)
+            DBG_NAV_LOGD("new cursor bounds=(%d,%d,w=%d,h=%d)",
+                bounds.x(), bounds.y(), bounds.width(), bounds.height());
+        m_cursorBounds = bounds;
+        m_cursorHitBounds = cachedNode->hitBounds(cachedFrame);
+        m_cursorFrame = cachedFrame->framePointer();
+        root->getSimulatedMousePosition(&m_cursorLocation);
+        m_cursorNode = cachedNode->nodePointer();
+    }
+    gCursorBoundsMutex.unlock();
+}
+
 void WebViewCore::clearContent()
 {
     DBG_SET_LOG("");
diff --git a/WebKit/android/jni/WebViewCore.h b/WebKit/android/jni/WebViewCore.h
index 967023a..7bac254 100644
--- a/WebKit/android/jni/WebViewCore.h
+++ b/WebKit/android/jni/WebViewCore.h
@@ -70,6 +70,8 @@ class SkIRect;
 
 namespace android {
 
+    class CachedFrame;
+    class CachedNode;
     class CachedRoot;
     class ListBoxReply;
 
@@ -439,6 +441,8 @@ namespace android {
         float scale() const { return m_scale; }
         float screenWidthScale() const { return m_screenWidthScale; }
         WebCore::Frame* mainFrame() const { return m_mainFrame; }
+        void updateCursorBounds(const CachedRoot* root,
+                const CachedFrame* cachedFrame, const CachedNode* cachedNode);
         void updateFrameCacheIfLoading();
 
         // utility to split slow parts of the picture set