Fix selectionEnd value in a case of dragging out from an INPUT element.

third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 291 matching lines @@
             remainingCharactersToMoveForward -= text.length();
             lastBrOrText = &node;
             continue;
         }
 
         NOTREACHED();
     }
     return lastPositionInOrAfterNode(lastBrOrText);
 }
 
-static int indexForPosition(HTMLElement* innerEditor, const Position& passedPosition)
+int HTMLTextFormControlElement::indexForPosition(HTMLElement* innerEditor, const Position& passedPosition)
 {
     if (!innerEditor || !innerEditor->contains(passedPosition.anchorNode()) || passedPosition.isNull())
         return 0;
 
     if (Position::beforeNode(innerEditor) == passedPosition)
         return 0;
 
     int index = 0;
     Node* startNode = passedPosition.computeNodeBeforePosition();
     if (!startNode)
         startNode = passedPosition.computeContainerNode();
+    if (startNode == innerEditor && passedPosition.isAfterAnchor())
+        startNode = innerEditor->lastChild();
     DCHECK(startNode);
     DCHECK(innerEditor->contains(startNode));
 
     for (Node* node = startNode; node; node = NodeTraversal::previous(*node, innerEditor)) {
         if (node->isTextNode()) {
             int length = toText(*node).length();
             if (node == passedPosition.computeContainerNode())
                 index += std::min(length, passedPosition.offsetInContainerNode());
             else
                 index += length;
@@ skipping 685 matching lines @@
 }
 
 void HTMLTextFormControlElement::copyNonAttributePropertiesFromElement(const Element& source)
 {
     const HTMLTextFormControlElement& sourceElement = static_cast<const HTMLTextFormControlElement&>(source);
     m_lastChangeWasUserEdit = sourceElement.m_lastChangeWasUserEdit;
     HTMLFormControlElement::copyNonAttributePropertiesFromElement(source);
 }
 
 } // namespace blink