Fix server-side image map click location with "Open link in new tab"

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 88 matching lines @@
     ASSERT(document().isActive());
 
     if (isFocusable() && Element::supportsFocus())
         return HTMLElement::isKeyboardFocusable();
 
     if (isLink() && !document().frameHost()->chromeClient().tabsToLinks())
         return false;
     return HTMLElement::isKeyboardFocusable();
 }
 
-static void appendServerMapMousePosition(StringBuilder& url, Event* event)
+bool HTMLAnchorElement::getClampedPointFromEvent(IntPoint& clampedPoint, const Event* event)
 {
+    if (!event)
+        return false;
+
     if (!event->isMouseEvent())
-        return;
+        return false;
 
-    ASSERT(event->target());
+    if (!event->target())
+        return false;
+
     Node* target = event->target()->toNode();
-    ASSERT(target);
+    if (!target)
+        return false;
+
     if (!isHTMLImageElement(*target))
-        return;
+        return false;
 
     HTMLImageElement& imageElement = toHTMLImageElement(*target);
     if (!imageElement.isServerMap())
-        return;
+        return false;
 
     LayoutObject* layoutObject = imageElement.layoutObject();
     if (!layoutObject || !layoutObject->isBox())
-        return;
+        return false;
 
     // The coordinates sent in the query string are relative to the height and
     // width of the image element, ignoring CSS transform/zoom.
     LayoutPoint mapPoint(layoutObject->absoluteToLocal(FloatPoint(toMouseEvent(event)->absoluteLocation()), UseTransforms));
 
     // The origin (0,0) is at the upper left of the content area, inside the
     // padding and border.
     mapPoint -= toLayoutBox(layoutObject)->contentBoxOffset();
 
     // CSS zoom is not reflected in the map coordinates.
     float scaleFactor = 1 / layoutObject->style()->effectiveZoom();
     mapPoint.scale(scaleFactor, scaleFactor);
 
     // Negative coordinates are clamped to 0 such that clicks in the left and
     // top padding/border areas receive an X or Y coordinate of 0.
-    IntPoint clampedPoint(roundedIntPoint(mapPoint));
+    clampedPoint = IntPoint(roundedIntPoint(mapPoint));
     clampedPoint.clampNegativeToZero();
 
+    return true;
+}
+
+void HTMLAnchorElement::appendServerMapMousePosition(StringBuilder& url, IntPoint& clampedPoint)

[tkent, 2016/03/14 00:06:33]

IntPoint& -> const IntPoint&

+{
     url.append('?');
     url.appendNumber(clampedPoint.x());
     url.append(',');
     url.appendNumber(clampedPoint.y());
 }
 
 void HTMLAnchorElement::defaultEventHandler(Event* event)
 {
     if (isLink()) {
         if (focused() && isEnterKeyKeydownEvent(event) && isLiveLink()) {
@@ skipping 163 matching lines @@
 void HTMLAnchorElement::handleClick(Event* event)
 {
     event->setDefaultHandled();
 
     LocalFrame* frame = document().frame();
     if (!frame)
         return;
 
     StringBuilder url;
     url.append(stripLeadingAndTrailingHTMLSpaces(fastGetAttribute(hrefAttr)));
-    appendServerMapMousePosition(url, event);
+    IntPoint clampedPoint;
+    bool success = getClampedPointFromEvent(clampedPoint, event);
+    if (success) {
+        appendServerMapMousePosition(url, clampedPoint);
+    }
     KURL completedURL = document().completeURL(url.toString());
 
     // Schedule the ping before the frame load. Prerender in Chrome may kill the renderer as soon as the navigation is
     // sent out.
     sendPings(completedURL);
 
     ResourceRequest request(completedURL);
     request.setUIStartTime(event->platformTimeStamp());
     request.setInputPerfMetricReportPolicy(InputToLoadPerfMetricReportPolicy::ReportLink);
 
@@ skipping 43 matching lines @@
 }
 
 Node::InsertionNotificationRequest HTMLAnchorElement::insertedInto(ContainerNode* insertionPoint)
 {
     InsertionNotificationRequest request = HTMLElement::insertedInto(insertionPoint);
     logAddElementIfIsolatedWorldAndInDocument("a", hrefAttr);
     return request;
 }
 
 } // namespace blink