Unlock cursor when moved outside of frame

The cursor locking logic doesn't gracefully handle the case where the
cursor location is outside of the viewport. This leads to us locking the
incorrect directions and trapping the cursor outside the viewport.

This CL fixes the issue by always resetting the lock when we receive a
mouse move outside the viewport.

Bug: 983386
Change-Id: I33d7ab7fae0a14225663cca972dd665a9d83a4a4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1699258
Auto-Submit: David Bokan <bokan@chromium.org>
Commit-Queue: Michael Thiessen <mthiesse@chromium.org>
Reviewed-by: Michael Thiessen <mthiesse@chromium.org>
Cr-Commit-Position: refs/heads/master@{#676910}

third_party/blink/renderer/core/input/fallback_cursor_event_manager.cc

@@ -291,9 +291,24 @@ void FallbackCursorEventManager::HandleMouseMoveEvent(const WebMouseEvent& e) {
 
   DCHECK(scrollable);
 
+  DCHECK(root_frame_->GetDocument());
+  DCHECK(root_frame_->GetDocument()->View());
+  // TODO(bokan): Overly-defensive since we'll be merging, remove from ToT.
+  if (!root_frame_->GetDocument() || !root_frame_->GetDocument()->View())
+    return;
+
   IntPoint location_in_root_frame{e.PositionInRootFrame().x,
                                   e.PositionInRootFrame().y};
 
+  // Make sure we unlock all movement if the cursor is outside our bounds. This
+  // can happen when the cursor is enabled/disabled (e.g. position: -1,-1).
+  IntRect root_frame_rect = root_frame_->GetDocument()->View()->FrameRect();
+  if (!root_frame_rect.Contains(location_in_root_frame)) {
+    ResetCurrentScrollable();
+    LockCursor(false, false, false, false);
+    return;
+  }
+
   IntSize scrollable_clip_size_in_root_frame =
       ScrollableAreaClipSizeInRootFrame(*scrollable);
   IntPoint location_in_scrollable =

third_party/blink/renderer/core/input/fallback_cursor_event_manager_test.cc

@@ -122,6 +122,38 @@ TEST_F(FallbackCursorEventManagerTest, RootFrameNotScrollable) {
   ExpectLock(false, false, false, false);
 }
 
+TEST_F(FallbackCursorEventManagerTest, ResetOnOutOfFrame) {
+  SetBodyInnerHTML(R"HTML(
+    <style>
+    html, body {
+      margin: 0px;
+    }
+    .big {
+      height: 10000px;
+      width: 10000px;
+    }
+    </style>
+    <div class='big'></div>
+  )HTML");
+  TurnOnFallbackCursorMode();
+
+  // Move below the scroll down line.
+  MouseMove(100, 500);
+  ExpectLock(false, false, false, true);
+
+  // Ensure an invalid or out-of-bounds mouse move will reset the lock.
+  MouseMove(-1, -1);
+  ExpectLock(false, false, false, false);
+
+  // Ensure an invalid or out-of-bounds mouse move will reset the lock.
+  MouseMove(790, 590);
+  ExpectLock(false, true, false, true);
+
+  // Ensure an invalid or out-of-bounds mouse move will reset the lock.
+  MouseMove(800, 600);
+  ExpectLock(false, false, false, false);
+}
+
 TEST_F(FallbackCursorEventManagerTest, MouseMoveCursorLockOnRootFrame) {
   SetBodyInnerHTML(R"HTML(
     <style>