Fix hit-testing of elements with the same z-index.

sky/engine/core/rendering/RenderBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 544 matching lines @@
         if (childZOffset > *zOffset) {
             *zOffset = childZOffset;
             return true;
         }
         return false;
     }
 
     return true;
 }
 
-static inline bool reverseCompareZIndex(RenderBox* first, RenderBox* second)
+static inline bool forwardCompareZIndex(RenderBox* first, RenderBox* second)
 {
-    return first->style()->zIndex() > second->style()->zIndex();
+    return first->style()->zIndex() < second->style()->zIndex();
 }
 
 // hitTestLocation and hitTestRect are relative to rootLayer.
 // A 'flattening' layer is one preserves3D() == false.
 // transformState.m_accumulatedTransform holds the transform from the containing flattening layer.
 // transformState.m_lastPlanarPoint is the hitTestLocation in the plane of the containing flattening layer.
 // transformState.m_lastPlanarQuad is the hitTestRect as a quad in the plane of the containing flattening layer.
 //
 // If zOffset is non-null (which indicates that the caller wants z offset information),
 //  *zOffset on return is the z offset of the hit point relative to the containing flattening layer.
@@ skipping 78 matching lines @@
         zOffsetForDescendantsPtr = zOffset ? zOffset : &localZOffset;
         zOffsetForContentsPtr = zOffset ? zOffset : &localZOffset;
     } else if (zOffset) {
         zOffsetForDescendantsPtr = 0;
         // Container needs us to give back a z offset for the hit layer.
         zOffsetForContentsPtr = zOffset;
     }
 
     Vector<RenderBox*> layers;
     collectSelfPaintingLayers(layers);
-    std::stable_sort(layers.begin(), layers.end(), reverseCompareZIndex);
+    // Hit testing needs to walk in the backwards direction from paint.
+    // Forward compare and then reverse instead of just reverse comparing
+    // so that elements with the same z-index are walked in reverse tree order.
+    std::stable_sort(layers.begin(), layers.end(), forwardCompareZIndex);
+    layers.reverse();
 
     bool hitLayer = false;
     for (auto& currentLayer : layers) {
         HitTestResult tempResult(result.hitTestLocation());
         bool localHitLayer = currentLayer->hitTestLayer(rootLayer, layer(), request, tempResult,
             hitTestRect, hitTestLocation, localTransformState.get(), zOffsetForDescendantsPtr);
 
         // If it a rect-based test, we can safely append the temporary result since it might had hit
         // nodes but not necesserily had hitLayer set.
         if (result.isRectBasedTest())
@@ skipping 63 matching lines @@
             result.setInnerNode(enclosingElement);
         if (!result.innerNonSharedNode())
             result.setInnerNonSharedNode(enclosingElement);
     }
 
     return true;
 }
 
 // --------------------- painting stuff -------------------------------
 
-static inline bool forwardCompareZIndex(RenderBox* first, RenderBox* second)
-{
-    return first->style()->zIndex() < second->style()->zIndex();
-}
-
 void RenderBox::paintLayer(GraphicsContext* context, const LayerPaintingInfo& paintingInfo)
 {
     // If this layer is totally invisible then there is nothing to paint.
     // TODO(ojan): Return false from isSelfPainting and then ASSERT(!opacity()) here.
     if (!opacity())
         return;
 
     if (!transform()) {
         paintLayerContents(context, paintingInfo);
         return;
@@ skipping 2308 matching lines @@
 
 RenderBox::BoxDecorationData::BoxDecorationData(const RenderStyle& style)
 {
     backgroundColor = style.colorIncludingFallback(CSSPropertyBackgroundColor);
     hasBackground = backgroundColor.alpha() || style.hasBackgroundImage();
     ASSERT(hasBackground == style.hasBackground());
     hasBorder = style.hasBorder();
 }
 
 } // namespace blink