Fix server-side image map click location with "Open link in new tab"

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
index f858f4ff170bb2e954455e1b33ce27f9b6cd2a43..72f509db7039bdc88431ebc4314e8dd92e4c9099 100644
--- a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
@@ -106,24 +106,31 @@ bool HTMLAnchorElement::isKeyboardFocusable() const
     return HTMLElement::isKeyboardFocusable();
 }
 
-static void appendServerMapMousePosition(StringBuilder& url, Event* event)
+bool HTMLAnchorElement::getClampedPointFromEvent(IntPoint& clampedPoint, const Event* event)
 {
+    if (!event)
+        return false;
+
     if (!event->isMouseEvent())
-        return;
+        return false;
+
+    if (!event->target())
+        return false;
 
-    ASSERT(event->target());
     Node* target = event->target()->toNode();
-    ASSERT(target);
+    if (!target)
+        return false;
+
     if (!isHTMLImageElement(*target))
-        return;
+        return false;
 
     HTMLImageElement& imageElement = toHTMLImageElement(*target);
     if (!imageElement.isServerMap())
-        return;
+        return false;
 
     LayoutObject* layoutObject = imageElement.layoutObject();
     if (!layoutObject || !layoutObject->isBox())
-        return;
+        return false;
 
     // The coordinates sent in the query string are relative to the height and
     // width of the image element, ignoring CSS transform/zoom.
@@ -139,9 +146,14 @@ static void appendServerMapMousePosition(StringBuilder& url, Event* event)
 
     // Negative coordinates are clamped to 0 such that clicks in the left and
     // top padding/border areas receive an X or Y coordinate of 0.
-    IntPoint clampedPoint(roundedIntPoint(mapPoint));
+    clampedPoint = IntPoint(roundedIntPoint(mapPoint));
     clampedPoint.clampNegativeToZero();
 
+    return true;
+}
+
+void HTMLAnchorElement::appendServerMapMousePosition(StringBuilder& url, IntPoint& clampedPoint)

[tkent, 2016/03/14 00:06:33]

IntPoint& -> const IntPoint&

+{
     url.append('?');
     url.appendNumber(clampedPoint.x());
     url.append(',');
@@ -325,7 +337,11 @@ void HTMLAnchorElement::handleClick(Event* event)
 
     StringBuilder url;
     url.append(stripLeadingAndTrailingHTMLSpaces(fastGetAttribute(hrefAttr)));
-    appendServerMapMousePosition(url, event);
+    IntPoint clampedPoint;
+    bool success = getClampedPointFromEvent(clampedPoint, event);
+    if (success) {
+        appendServerMapMousePosition(url, clampedPoint);
+    }
     KURL completedURL = document().completeURL(url.toString());
 
     // Schedule the ping before the frame load. Prerender in Chrome may kill the renderer as soon as the navigation is