Incorrect element hit testing for inline elements containing children with transform applied

third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp

Index: third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp b/third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp
index 886eac95a46b4ebbc92e8b2b956f988724676b9a..dd8dae7c6cf95a37ac1ebdfe8f2a83aac009c875 100644
--- a/third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp
+++ b/third_party/WebKit/Source/core/layout/line/InlineFlowBox.cpp
@@ -1024,7 +1024,7 @@ bool InlineFlowBox::nodeAtPoint(HitTestResult& result, const HitTestLocation& lo
             LineLayoutItem culledParent = currLayoutItem.parent();
             ASSERT(culledParent);
 
-            if (culledParent == lineLayoutItem() || (hasSibling && prev && prev->lineLayoutItem().isDescendantOf(culledParent)))
+            if (culledParent == lineLayoutItem() || (hasSibling && prev && prev->lineLayoutItem().isDescendantOf(culledParent) && !(prev->boxModelObject() && prev->boxModelObject().hasSelfPaintingLayer())))

[Xianzhu, 2016/01/14 21:45:25]

I think this is to workaround the 'continue' at line 1003, so we should change
that place instead of here:

1012   if (!curr->boxModelObject() ||
!curr->boxModelObject().hasSelfPaintingLayer()) {
1013       if (curr->nodeAtPoint(...) {
           ...
           }
       }

[nolan.robin.cao, 2016/01/15 03:25:33]

Good point!

                 break;
 
             if (culledParent.isLayoutInline() && LineLayoutInline(culledParent).hitTestCulledInline(result, locationInContainer, accumulatedOffset))