Do not use Node in FocusController, 2nd

third_party/WebKit/Source/core/page/FocusController.cpp

Index: third_party/WebKit/Source/core/page/FocusController.cpp
diff --git a/third_party/WebKit/Source/core/page/FocusController.cpp b/third_party/WebKit/Source/core/page/FocusController.cpp
index eddc8b262b8cfcd386707dbe4cbe61162bb33c69..00331f92853074ae97f543955673ddafec30f748 100644
--- a/third_party/WebKit/Source/core/page/FocusController.cpp
+++ b/third_party/WebKit/Source/core/page/FocusController.cpp
@@ -74,7 +74,7 @@ class FocusNavigationScope {
 public:
     Node* rootNode() const;
     Element* owner() const;
-    static FocusNavigationScope focusNavigationScopeOf(const Node&);
+    static FocusNavigationScope focusNavigationScopeOf(const Element&);
     static FocusNavigationScope ownedByNonFocusableFocusScopeOwner(Element&);
     static FocusNavigationScope ownedByShadowHost(const Element&);
     static FocusNavigationScope ownedByShadowInsertionPoint(HTMLShadowElement&);
@@ -109,9 +109,9 @@ Element* FocusNavigationScope::owner() const
     return nullptr;
 }
 
-FocusNavigationScope FocusNavigationScope::focusNavigationScopeOf(const Node& node)
+FocusNavigationScope FocusNavigationScope::focusNavigationScopeOf(const Element& element)
 {
-    return FocusNavigationScope(&node.treeScope());
+    return FocusNavigationScope(&element.treeScope());
 }
 
 FocusNavigationScope FocusNavigationScope::ownedByNonFocusableFocusScopeOwner(Element& element)
@@ -529,6 +529,16 @@ Element* findFocusableElementAcrossFocusScopes(WebFocusType type, const FocusNav
         findFocusableElementAcrossFocusScopesBackward(scope, currentNode);
 }
 
+inline Element* adjustToElement(Node* node, WebFocusType type)
+{
+    ASSERT(type == WebFocusTypeForward || type == WebFocusTypeBackward);
+    if (!node)
+        return nullptr;
+    if (node->isElementNode())
+        return toElement(node);
+    return (type == WebFocusTypeForward) ? ElementTraversal::next(*node) : ElementTraversal::previous(*node);

[tkent, 2016/02/22 06:07:07]

If ElementTraversal::next(*node) is focusable, the element is not focused by TAB
key, right?
It's a behavior change.

+}
+
 } // anonymous namespace
 
 FocusController::FocusController(Page* page)
@@ -714,33 +724,34 @@ bool FocusController::advanceFocusAcrossFrames(WebFocusType type, RemoteFrame* f
     // child frame has no more focusable elements, and we should continue
     // looking for focusable elements in the parent, starting from the <iframe>
     // element of the child frame.
-    Node* startingNode = nullptr;
+    Element* start = nullptr;
     if (from->tree().parent() == to) {
         ASSERT(from->owner()->isLocal());
-        startingNode = toHTMLFrameOwnerElement(from->owner());
+        start = toHTMLFrameOwnerElement(from->owner());
     }
 
-    return advanceFocusInDocumentOrder(to, startingNode, type, false, sourceCapabilities);
+    return advanceFocusInDocumentOrder(to, start, type, false, sourceCapabilities);
 }
 
-bool FocusController::advanceFocusInDocumentOrder(LocalFrame* frame, Node* startingNode, WebFocusType type, bool initialFocus, InputDeviceCapabilities* sourceCapabilities)
+bool FocusController::advanceFocusInDocumentOrder(LocalFrame* frame, Element* start, WebFocusType type, bool initialFocus, InputDeviceCapabilities* sourceCapabilities)
 {
     ASSERT(frame);
     Document* document = frame->document();
+    ASSERT(document->documentElement());

[hayato, 2016/03/15 07:08:16]

I guess this assertion is not always true and this is the cause of the crash.
See https://bugs.chromium.org/p/chromium/issues/detail?id=594841

 
-    Node* currentNode = startingNode;
-    if (!currentNode)
-        currentNode = document->focusedElement();
+    Element* current = start;
+    if (!current)
+        current = document->focusedElement();
 
     // FIXME: Not quite correct when it comes to focus transitions leaving/entering the WebView itself
     bool caretBrowsing = frame->settings() && frame->settings()->caretBrowsingEnabled();
 
-    if (caretBrowsing && !currentNode)
-        currentNode = frame->selection().start().anchorNode();
+    if (caretBrowsing && !current)
+        current = adjustToElement(frame->selection().start().anchorNode(), type);
 
     document->updateLayoutIgnorePendingStylesheets();
 
-    RefPtrWillBeRawPtr<Element> element = findFocusableElementAcrossFocusScopes(type, FocusNavigationScope::focusNavigationScopeOf(currentNode ? *currentNode : *document), currentNode);
+    RefPtrWillBeRawPtr<Element> element = findFocusableElementAcrossFocusScopes(type, FocusNavigationScope::focusNavigationScopeOf(current ? *current : *document->documentElement()), current);
 
     if (!element) {
         // If there's a RemoteFrame on the ancestor chain, we need to continue
@@ -760,7 +771,7 @@ bool FocusController::advanceFocusInDocumentOrder(LocalFrame* frame, Node* start
         }
 
         // Chrome doesn't want focus, so we should wrap focus.
-        element = findFocusableElementRecursively(type, FocusNavigationScope::focusNavigationScopeOf(*toLocalFrame(m_page->mainFrame())->document()), nullptr);
+        element = findFocusableElementRecursively(type, FocusNavigationScope::focusNavigationScopeOf(*toLocalFrame(m_page->mainFrame())->document()->documentElement()), nullptr);
         element = findFocusableElementDescendingDownIntoFrameDocument(type, element.get());
 
         if (!element)