[New Multicolumn] Correct localPoint when hitting an anonymous child block.

Source/core/layout/Layer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 2041 matching lines @@
 {
     ASSERT(isSelfPaintingLayer() || hasSelfPaintingLayerDescendant());
 
     if (!layoutObject()->hitTest(request, result, hitTestLocation, toLayoutPoint(layerBounds.location() - layoutBoxLocation()), hitTestFilter)) {
         // It's wrong to set innerNode, but then claim that you didn't hit anything, unless it is
         // a rect-based test.
         ASSERT(!result.innerNode() || (request.listBased() && result.listBasedTestResult().size()));
         return false;
     }
 
-    // For positioned generated content, we might still not have a
-    // node by the time we get to the layer level, since none of
-    // the content in the layer has an element. So just walk up
-    // the tree.
     if (!result.innerNode() || !result.innerNonSharedNode()) {
+        // We hit something anonymous, and we didn't find a DOM node ancestor in this layer.
+
+        if (layoutObject()->isLayoutFlowThread()) {
+            // For a flow thread it's safe to just say that we didn't hit anything. That means that
+            // we'll continue as normally, and eventually hit a column set sibling instead. Column
+            // sets are also anonymous, but, unlike flow threads, they don't establish layers, so
+            // we'll fall back and hit the multicol container parent (which should have a DOM node).
+            return false;
+        }
+
         Node* e = enclosingElement();
         if (!result.innerNode())
             result.setInnerNode(e);
         if (!result.innerNonSharedNode())
             result.setInnerNonSharedNode(e);
+        // FIXME: missing call to result.setLocalPoint(). What we would really want to do here is to
+        // return and look for the nearest non-anonymous ancestor, and ignore aunts and uncles on
+        // our way. It's bad to look for it manually like we do here, and give up on setting a local
+        // point in the result, because that has bad implications for text selection and
+        // caretRangeFromPoint(). See crbug.com/461791
     }
-
     return true;
 }
 
 Layer* Layer::hitTestChildren(ChildrenIteration childrentoVisit, Layer* rootLayer,
     const HitTestRequest& request, HitTestResult& result,
     const LayoutRect& hitTestRect, const HitTestLocation& hitTestLocation,
     const HitTestingTransformState* transformState,
     double* zOffsetForDescendants, double* zOffset,
     const HitTestingTransformState* unflattenedTransformState,
     bool depthSortDescendants)
@@ skipping 878 matching lines @@
     }
 }
 
 void showLayerTree(const blink::LayoutObject* renderer)
 {
     if (!renderer)
         return;
     showLayerTree(renderer->enclosingLayer());
 }
 #endif