LayoutTests:

        Reviewed by john
        
        <rdar://problem/4861080>
        GMail Editor: Crash when dropping content into certain list items

        * editing/pasteboard/4861080-expected.checksum: Added.
        * editing/pasteboard/4861080-expected.png: Added.
        * editing/pasteboard/4861080-expected.txt: Added.
        * editing/pasteboard/4861080.html: Added.

WebCore:

        Reviewed by john

        <rdar://problem/4861080>
        GMail Editor: Crash when dropping content into certain list items
        
        A rendering bug (4907469) creates unwanted space at the top of a 
        list item when its contents are wrapped in span.  Dropping content 
        inside that space causes a crash because positionForCoordinates 
        fails there and the code that creates drag carets can't handle it.

        * page/mac/WebCoreFrameBridge.mm:
        (-[WebCoreFrameBridge _visiblePositionForPoint:]): Added the
        that's inside click handling for the case where 
        positionForCoordinates returns null.  We should also fix 
        positionForCoordinates but that's less important: now its only side 
        effect is that a no-op drop is performed instead of a snap back 
        when you drop the contents of one of these list items its own 
        unwanted space.



git-svn-id: svn://svn.chromium.org/blink/trunk@18601 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/ChangeLog

+2007-01-04  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by john
+        
+        <rdar://problem/4861080>
+        GMail Editor: Crash when dropping content into certain list items
+
+        * editing/pasteboard/4861080-expected.checksum: Added.
+        * editing/pasteboard/4861080-expected.png: Added.
+        * editing/pasteboard/4861080-expected.txt: Added.
+        * editing/pasteboard/4861080.html: Added.
+
 2007-01-03  Adele Peterson  <adele@apple.com>
 
         Reviewed by Darin.

third_party/WebKit/LayoutTests/editing/pasteboard/4861080-expected.checksum

+b1a5f740b696f4f8eb45c3179a00d19b
\ No newline at end of file

third_party/WebKit/LayoutTests/editing/pasteboard/4861080-expected.txt

+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x576
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 769x36
+          text run at (0,0) width 741: "This tests dropping content into the unwanted space above a list items content when the content is wrapped in a span. "
+          text run at (741,0) width 28: "You"
+          text run at (0,18) width 234: "should see 'DragMe DropAboveMe'."
+      RenderBlock {DIV} at (0,52) size 784x58
+        RenderListItem {LI} at (0,0) size 784x40 [border: (1px solid #000000)]
+          RenderBlock (anonymous) at (1,1) size 782x18
+            RenderListMarker at (-1,0) size 7x18
+            RenderInline {SPAN} at (0,0) size 0x18
+          RenderBlock (anonymous) at (1,19) size 782x20
+            RenderBlock {DIV} at (0,0) size 782x20 [border: (1px solid #FF0000)]
+              RenderInline {SPAN} at (0,0) size 57x18
+                RenderInline {SPAN} at (0,0) size 57x18
+                  RenderText {#text} at (1,1) size 57x18
+                    text run at (1,1) width 57: "DragMe "
+              RenderText {#text} at (58,1) size 97x18
+                text run at (58,1) width 97: "DropAboveMe"
+          RenderBlock (anonymous) at (1,39) size 782x0
+            RenderInline {SPAN} at (0,0) size 0x0
+        RenderBlock {DIV} at (0,40) size 784x18
+          RenderBR {BR} at (0,0) size 0x18
+      RenderBlock {UL} at (0,126) size 784x0
+selection start: position 0 of child 0 {#text} of child 0 {SPAN} of child 0 {SPAN} of child 0 {DIV} of child 0 {SPAN} of child 1 {LI} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document
+selection end:   position 7 of child 0 {#text} of child 0 {SPAN} of child 0 {SPAN} of child 0 {DIV} of child 0 {SPAN} of child 1 {LI} of child 2 {DIV} of child 0 {BODY} of child 0 {HTML} of document

third_party/WebKit/LayoutTests/editing/pasteboard/4861080.html

+<p>This tests dropping content into the unwanted space above a list items content when the content is wrapped in a span.  You should see 'DragMe DropAboveMe'.</p>
+<div contenteditable="true">
+<li id="li" style="border: 1px solid black;"><span><div id="contents" style="border: 1px solid red;">DropAboveMe</div></span></li>
+<div><span id="drag">DragMe</span></div>
+</div>
+<ul id="console"></ul>
+<script>
+function log(str) {
+    var li = document.createElement("li");
+    li.appendChild(document.createTextNode(str));
+    var console = document.getElementById("console");
+    console.appendChild(li);
+}
+
+function runTest() {
+    if (!window.layoutTestController)
+        log("This can only be run automatically using the layout test engine.  To run it manually, drag 'Dragme' and drop it above 'DropAboveMe'.");
+    
+    window.layoutTestController.waitUntilDone();
+
+    var drag = document.getElementById("drag");
+    var dragx = drag.offsetParent.offsetLeft + drag.offsetLeft + drag.offsetWidth / 2;
+    var dragy = drag.offsetParent.offsetTop +  drag.offsetTop + drag.offsetHeight / 2;
+    
+    eventSender.mouseMoveTo(dragx, dragy);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+    // Leap forward so that the next mouseDown doesn't trigger a triple click.
+    eventSender.leapForward(1200);
+    
+    eventSender.mouseDown();
+    // Leap forward so that the mouse movement causes a drag instead of selection creation.
+    eventSender.leapForward(500);
+
+    var li = document.getElementById("li");
+    
+    var dropx = li.offsetParent.offsetLeft + li.offsetLeft + li.offsetWidth / 2;
+    var dropy = li.offsetParent.offsetTop + li.offsetTop + 15;
+
+    eventSender.mouseMoveTo(dropx, dropy);
+    eventSender.mouseUp();
+    
+    window.layoutTestController.notifyDone();
+}
+
+runTest();
+</script>

third_party/WebKit/WebCore/ChangeLog

+2007-01-04  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by john
+
+        <rdar://problem/4861080>
+        GMail Editor: Crash when dropping content into certain list items
+        
+        A rendering bug (4907469) creates unwanted space at the top of a 
+        list item when its contents are wrapped in span.  Dropping content 
+        inside that space causes a crash because positionForCoordinates 
+        fails there and the code that creates drag carets can't handle it.
+
+        * page/mac/WebCoreFrameBridge.mm:
+        (-[WebCoreFrameBridge _visiblePositionForPoint:]): Added the
+        that's inside click handling for the case where 
+        positionForCoordinates returns null.  We should also fix 
+        positionForCoordinates but that's less important: now its only side 
+        effect is that a no-op drop is performed instead of a snap back 
+        when you drop the contents of one of these list items its own 
+        unwanted space.
+
 2007-01-04  Beth Dakin  <bdakin@apple.com>
 
         Reviewed by Adam.

third_party/WebKit/WebCore/page/mac/WebCoreFrameBridge.mm

@@ -1289,7 +1289,10 @@ static HTMLFormElement *formElementFromDOMElement(DOMElement *element)
     FrameView* outerView = m_frame->view();
     FrameView* innerView = node->document()->view();
     IntPoint innerPoint = innerView->windowToContents(outerView->contentsToWindow(outerPoint));
-    return renderer->positionForCoordinates(innerPoint.x(), innerPoint.y());
+    VisiblePosition visiblePos = renderer->positionForCoordinates(innerPoint.x(), innerPoint.y());
+    if (visiblePos.isNull())
+        visiblePos = VisiblePosition(Position(node, 0));
+    return visiblePos;
 }
 
 - (void)moveDragCaretToPoint:(NSPoint)point