Incorrect element hit testing for inline elements containing children with transform applied

third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 995 matching lines @@
             lineLayoutItem().updateHitTestResult(result, locationInContainer.point() - toLayoutSize(accumulatedOffset));
             return true;
         }
 
         // If the current inline box's layout object and the previous inline box's layout object are same,
         // we should yield the hit-test to the previous inline box.
         if (prev && curr->lineLayoutItem() == prev->lineLayoutItem())
             continue;
 
         // If a parent of the current inline box is a culled inline,
         // we hit test it before we move the previous inline box.

[Xianzhu, 2016/01/14 21:45:25]

Can you also update the comments which seem inaccurate. It seems that we hit
test the culled inline when the current inline box has no previous descendant
under the culled inline. (I'm not super familiar with the code, so please
correct me if I'm wrong.)

[nolan.robin.cao, 2016/01/15 03:25:33]

Yes, it's not consistent with comments inside the while loop. I'd like to change
it to:
// Hit test the culled inline if necessary.

[Xianzhu, 2016/01/15 05:09:41]

This sgtm.

         LineLayoutItem currLayoutItem = curr->lineLayoutItem();
         while (true) {
             // If the previous inline box is not a descendant of a current inline's parent,
             // the parent is a culled inline and we hit test it.
             // Otherwise, move to the previous inline box because we hit test first all
             // candidate inline boxes under the parent to take a pre-order tree traversal in reverse.
             bool hasSibling = currLayoutItem.previousSibling() || currLayoutItem.nextSibling();
             LineLayoutItem culledParent = currLayoutItem.parent();
             ASSERT(culledParent);
 
-            if (culledParent == lineLayoutItem() || (hasSibling && prev && prev->lineLayoutItem().isDescendantOf(culledParent)))
+            if (culledParent == lineLayoutItem() || (hasSibling && prev && prev->lineLayoutItem().isDescendantOf(culledParent) && !(prev->boxModelObject() && prev->boxModelObject().hasSelfPaintingLayer())))

[Xianzhu, 2016/01/14 21:45:25]

I think this is to workaround the 'continue' at line 1003, so we should change
that place instead of here:

1012   if (!curr->boxModelObject() ||
!curr->boxModelObject().hasSelfPaintingLayer()) {
1013       if (curr->nodeAtPoint(...) {
           ...
           }
       }

[nolan.robin.cao, 2016/01/15 03:25:33]

Good point!

                 break;
 
             if (culledParent.isLayoutInline() && LineLayoutInline(culledParent).hitTestCulledInline(result, locationInContainer, accumulatedOffset))
                 return true;
 
             currLayoutItem = culledParent;
         }
     }
 
     if (lineLayoutItem().style()->hasBorderRadius()) {
@@ skipping 276 matching lines @@
         ASSERT(child->prevOnLine() == prev);
         prev = child;
     }
     ASSERT(prev == m_lastChild);
 #endif
 }
 
 #endif
 
 } // namespace blink