Incorrect element hit testing for inline elements containing children with transform applied

third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 981 matching lines @@
     // We need to hit test both our inline children (Inline Boxes) and culled inlines
     // (LayoutObjects). We check our inlines in the same order as line layout but
     // for each inline we additionally need to hit test its culled inline parents.
     // While hit testing culled inline parents, we can stop once we reach
     // a non-inline parent or a culled inline associated with a different inline box.
     InlineBox* prev;
     for (InlineBox* curr = lastChild(); curr; curr = prev) {
         prev = curr->prevOnLine();
 
         // Layers will handle hit testing themselves.
-        if (curr->boxModelObject() && curr->boxModelObject().hasSelfPaintingLayer())
-            continue;
-
-        if (curr->nodeAtPoint(result, locationInContainer, accumulatedOffset, lineTop, lineBottom)) {
-            lineLayoutItem().updateHitTestResult(result, locationInContainer.point() - toLayoutSize(accumulatedOffset));
-            return true;
+        if (!curr->boxModelObject() || !curr->boxModelObject().hasSelfPaintingLayer()) {
+            if (curr->nodeAtPoint(result, locationInContainer, accumulatedOffset, lineTop, lineBottom)) {
+                lineLayoutItem().updateHitTestResult(result, locationInContainer.point() - toLayoutSize(accumulatedOffset));
+                return true;
+            }
         }
 
         // If the current inline box's layout object and the previous inline box's layout object are same,
         // we should yield the hit-test to the previous inline box.
         if (prev && curr->lineLayoutItem() == prev->lineLayoutItem())
             continue;
 
-        // If a parent of the current inline box is a culled inline,
-        // we hit test it before we move the previous inline box.
+        // Hit test the culled inline if necessary.
         LineLayoutItem currLayoutItem = curr->lineLayoutItem();
         while (true) {
             // If the previous inline box is not a descendant of a current inline's parent,
             // the parent is a culled inline and we hit test it.
             // Otherwise, move to the previous inline box because we hit test first all
             // candidate inline boxes under the parent to take a pre-order tree traversal in reverse.
             bool hasSibling = currLayoutItem.previousSibling() || currLayoutItem.nextSibling();
             LineLayoutItem culledParent = currLayoutItem.parent();
             ASSERT(culledParent);
 
@@ skipping 287 matching lines @@
         ASSERT(child->prevOnLine() == prev);
         prev = child;
     }
     ASSERT(prev == m_lastChild);
 #endif
 }
 
 #endif
 
 } // namespace blink