Merge 88456

Source/WebCore/rendering/RenderTextControl.cpp

Index: Source/WebCore/rendering/RenderTextControl.cpp
===================================================================
--- Source/WebCore/rendering/RenderTextControl.cpp	(revision 88774)
+++ Source/WebCore/rendering/RenderTextControl.cpp	(working copy)
@@ -205,7 +205,12 @@
     Frame* frame = this->frame();
     if (!frame)
         return 0;
-    return indexForVisiblePosition(frame->selection()->start());
+    
+    HTMLElement* innerText = innerTextElement();
+    // Do not call innerTextElement() in the function arguments as creating a VisiblePosition
+    // from frame->selection->start() can blow us from underneath. Also, function ordering is
+    // usually dependent on the compiler.
+    return RenderTextControl::indexForVisiblePosition(innerText, frame->selection()->start());
 }
 
 int RenderTextControl::selectionEnd() const
@@ -213,7 +218,12 @@
     Frame* frame = this->frame();
     if (!frame)
         return 0;
-    return indexForVisiblePosition(frame->selection()->end());
+
+    HTMLElement* innerText = innerTextElement();
+    // Do not call innerTextElement() in the function arguments as creating a VisiblePosition
+    // from frame->selection->end() can blow us from underneath. Also, function ordering is
+    // usually dependent on the compiler.
+    return RenderTextControl::indexForVisiblePosition(innerText, frame->selection()->end());
 }
 
 bool RenderTextControl::hasVisibleTextArea() const
@@ -256,15 +266,15 @@
         frame->selection()->setSelection(newSelection);
 }
 
-bool RenderTextControl::isSelectableElement(Node* node) const
+bool RenderTextControl::isSelectableElement(HTMLElement* innerText, Node* node)
 {
-    if (!node || !m_innerText)
+    if (!node || !innerText)
         return false;
-    
-    if (node->rootEditableElement() == m_innerText)
+
+    if (node->rootEditableElement() == innerText)
         return true;
     
-    if (!m_innerText->contains(node))
+    if (!innerText->contains(node))
         return false;
     
     Node* shadowAncestor = node->shadowAncestorNode();
@@ -334,14 +344,14 @@
     return VisiblePosition(Position(endContainer, endOffset, Position::PositionIsOffsetInAnchor), UPSTREAM);
 }
 
-int RenderTextControl::indexForVisiblePosition(const VisiblePosition& pos) const
+int RenderTextControl::indexForVisiblePosition(HTMLElement* innerTextElement, const VisiblePosition& pos)
 {
     Position indexPosition = pos.deepEquivalent();
-    if (!isSelectableElement(indexPosition.deprecatedNode()))
+    if (!RenderTextControl::isSelectableElement(innerTextElement, indexPosition.deprecatedNode()))
         return 0;
     ExceptionCode ec = 0;
-    RefPtr<Range> range = Range::create(document());
-    range->setStart(m_innerText.get(), 0, ec);
+    RefPtr<Range> range = Range::create(indexPosition.document());
+    range->setStart(innerTextElement, 0, ec);
     ASSERT(!ec);
     range->setEnd(indexPosition.deprecatedNode(), indexPosition.deprecatedEditingOffset(), ec);
     ASSERT(!ec);