Fix touch accessibility events in WebViews and iframes

third_party/WebKit/Source/web/WebViewImpl.cpp

Index: third_party/WebKit/Source/web/WebViewImpl.cpp
diff --git a/third_party/WebKit/Source/web/WebViewImpl.cpp b/third_party/WebKit/Source/web/WebViewImpl.cpp
index dbce5b06b65f7e4ff4ef9e4783670e765bcfada8..0e9930d3ae1231bb296a3791e5eb19d08df13cb6 100644
--- a/third_party/WebKit/Source/web/WebViewImpl.cpp
+++ b/third_party/WebKit/Source/web/WebViewImpl.cpp
@@ -2156,19 +2156,12 @@ WebInputEventResult WebViewImpl::handleInputEvent(const WebInputEvent& inputEven
 
         // Find the right target frame. See issue 1186900.
         HitTestResult result = hitTestResultForRootFramePos(pme.position());
-        Frame* targetFrame;
-        if (result.innerNodeOrImageMapImage())
-            targetFrame = result.innerNodeOrImageMapImage()->document().frame();
-        else
-            targetFrame = m_page->focusController().focusedOrMainFrame();
-
-        if (targetFrame->isLocalFrame()) {
-            LocalFrame* targetLocalFrame = toLocalFrame(targetFrame);
-            Document* document = targetLocalFrame->document();
+        if (result.innerNodeFrame()) {

[dcheng, 2016/05/25 17:44:38]

I like this because it looks simpler, but I don't think I understand why this
new version is more correct. Do you mind enlightening me?

[dmazzoni, 2016/05/25 17:53:51]

I don't think result.innerNodeOrImageMapImage()->document().frame() was
incorrect - it seemed to return the same result for the cases I tried.
result.innerNodeFrame() does seem cleaner.

The critical bug was below, passing pme.position() rather than
result.roundedPointInInnerNodeFrame().

[dcheng, 2016/05/25 18:03:00]

Hmm. It looks like the original code is from the initial upstreaming of
WebViewImpl... +pdr who touched some hittesting stuff recently.

Intuitively this makes sense: I don't think you should be able to hittest a
detached document (which is what a null frame would imply), but I'm not sure if
there's an edge case I'm missing here.

[pdr., 2016/05/26 21:32:48]

This change seems reasonable to me. LGTM

+            Document* document = result.innerNodeFrame()->document();
             if (document) {
                 AXObjectCache* cache = document->existingAXObjectCache();
                 if (cache)
-                    cache->onTouchAccessibilityHover(pme.position());
+                    cache->onTouchAccessibilityHover(result.roundedPointInInnerNodeFrame());
             }
         }
     }