Fix selectionEnd value in a case of dragging out from an INPUT element.

third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
index aaebf9ab04d740383ab5f28989f4b9a5b29f9448..816cfb2f6835166cf9e314a41283840dd93c27d5 100644
--- a/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLTextFormControlElement.cpp
@@ -309,7 +309,7 @@ static Position positionForIndex(HTMLElement* innerEditor, int index)
     return lastPositionInOrAfterNode(lastBrOrText);
 }
 
-static int indexForPosition(HTMLElement* innerEditor, const Position& passedPosition)
+int HTMLTextFormControlElement::indexForPosition(HTMLElement* innerEditor, const Position& passedPosition)
 {
     if (!innerEditor || !innerEditor->contains(passedPosition.anchorNode()) || passedPosition.isNull())
         return 0;
@@ -321,6 +321,8 @@ static int indexForPosition(HTMLElement* innerEditor, const Position& passedPosi
     Node* startNode = passedPosition.computeNodeBeforePosition();
     if (!startNode)
         startNode = passedPosition.computeContainerNode();
+    if (startNode == innerEditor && passedPosition.isAfterAnchor())
+        startNode = innerEditor->lastChild();
     DCHECK(startNode);
     DCHECK(innerEditor->contains(startNode));