<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[185156] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/185156">185156</a></dd>
<dt>Author</dt> <dd>bfulgham@apple.com</dd>
<dt>Date</dt> <dd>2015-06-03 11:37:23 -0700 (Wed, 03 Jun 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>REGRESSION: (<a href="http://trac.webkit.org/projects/webkit/changeset/181879">r181879</a>): Scrolling in select/option region in iFrame scrolls both select and iframe
https://bugs.webkit.org/show_bug.cgi?id=145574
&lt;rdar://problem/20966828&gt;

Reviewed by Simon Fraser.

Source/WebCore:

Tested by platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html

When the scroll gesture is started when the latched scrollable container is not at the limit of its
scroll region, we are NOT supposed to propagate the scroll event to the enclosing region. However,
we were doing two things wrong:
(1) When we recognized we were latching, we were using the right wheel event target, but not using
    the latched scrollable container.
(2) Likewise, we were not using latched ScrollableArea when handling wheel events.

Instead, we were using the current scrollable container and ScrollableArea under the mouse pointer,
which could be different from the point we started latching as the content scrolled.
        
The fix was to properly track the scrollable container and scrollable area during latching.

I attempted to store the latched ScrollableArea in the latchingState object, like we already do for the
scrollable container, but found that this did not work properly. I think the life cycle of the
ScrollableArea may not match the scrollable container, and since they are not reference counted I
simply retrieve the ScrollableArea when needed.

* page/mac/EventHandlerMac.mm:
(WebCore::scrollableAreaForContainerNode): Helper function to return the correct ScrollableArea
for the two types of RenderBox elements.
(WebCore::latchedToFrameOrBody): Helper predicate to identify Frame and Body elements.
(WebCore::EventHandler::platformPrepareForWheelEvents): Use the correct ScrollableArea for the given
ContainerNode. When latching, make sure to use the ScrollableArea that is related to the latched scrollable
container, not the area currently underneath the mouse pointer.

LayoutTests:

* platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select-expected.txt: Added.
* platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html: Added.
* platform/mac-wk2/tiled-drawing/scrolling/frames/select_iframe.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorepagemacEventHandlerMacmm">trunk/Source/WebCore/page/mac/EventHandlerMac.mm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingfastscrolliframelatchedselectexpectedtxt">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingfastscrolliframelatchedselecthtml">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html</a></li>
<li>trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/resources/</li>
<li><a href="#trunkLayoutTestsplatformmacwk2tileddrawingscrollingresourcesselect_iframehtml">trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/resources/select_iframe.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (185155 => 185156)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2015-06-03 17:33:16 UTC (rev 185155)
+++ trunk/LayoutTests/ChangeLog        2015-06-03 18:37:23 UTC (rev 185156)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2015-06-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
+
+        REGRESSION: (r181879): Scrolling in select/option region in iFrame scrolls both select and iframe
+        https://bugs.webkit.org/show_bug.cgi?id=145574
+        &lt;rdar://problem/20966828&gt;
+
+        Reviewed by Simon Fraser.
+
+        * platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select-expected.txt: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html: Added.
+        * platform/mac-wk2/tiled-drawing/scrolling/frames/select_iframe.html: Added.
+
</ins><span class="cx"> 2015-06-03  Brady Eidson  &lt;beidson@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         REGRESSION (r183498): Certain types of frame loads in iframes with &lt;base target=&quot;_blank&quot;&gt; can open urls in new window/tabs
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingfastscrolliframelatchedselectexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select-expected.txt (0 => 185156)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select-expected.txt                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select-expected.txt        2015-06-03 18:37:23 UTC (rev 185156)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+
+Tests that iframe doesn't consume wheel events when scrolling a select in an iframe.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS Page did not receive wheel events.
+PASS IFrame did not receive wheel events.
+PASS Select consumed wheel events.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingfastscrolliframelatchedselecthtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html (0 => 185156)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html        2015-06-03 18:37:23 UTC (rev 185156)
</span><span class="lines">@@ -0,0 +1,99 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;link rel=&quot;help&quot; href=&quot;http://www.w3.org/TR/DOM-Level-3-Events/#events-WheelEvent&quot;&gt;
+&lt;script src=&quot;../../../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body onload=&quot;setupTopLevel();&quot;&gt;
+&lt;script&gt;
+var pageScrollPositionBefore;
+var iframeTarget;
+var iFrameScrollPositionBefore;
+var selectTarget;
+var selectTargetScrollPositionBefore;
+
+function checkForScroll()
+{
+    // The IFrame should not have scrolled at all.
+    var pageScrollPositionAfter = document.body.scrollTop;
+    if (pageScrollPositionAfter != pageScrollPositionAfter)
+        testFailed(&quot;Page consumed wheel events.&quot;);
+    else
+        testPassed(&quot;Page did not receive wheel events.&quot;);
+
+    var iFrameScrollPositionAfter = window.frames['target'].document.body.scrollTop;
+    if (iFrameScrollPositionBefore != iFrameScrollPositionAfter)
+        testFailed(&quot;IFrame consumed wheel events.&quot;);
+    else
+        testPassed(&quot;IFrame did not receive wheel events.&quot;);
+
+    var selectTargetScrollPositionAfter = selectTarget.scrollTop;
+    if (selectTargetScrollPositionBefore != selectTargetScrollPositionAfter)
+        testPassed(&quot;Select consumed wheel events.&quot;);
+    else
+        testFailed(&quot;Select did not receive wheel events.&quot;);
+
+    finishJSTest();
+    testRunner.notifyDone();
+}
+
+function scrollTest()
+{
+    pageScrollPositionBefore = document.body.scrollTop;
+    iFrameScrollPositionBefore = window.frames['target'].document.body.scrollTop;
+
+    iframeTarget = document.getElementById('target');
+
+    selectTarget = window.frames['target'].document.getElementById('selectTarget');
+    selectTargetScrollPositionBefore = selectTarget.scrollTop;
+
+    // Scroll the #source until we reach the #target.
+    var startPosX = Math.round(selectTarget.offsetLeft) + 10;
+    var startPosY = Math.round(selectTarget.offsetTop) + 10; // Slightly more than one wheel scroll away from the IFrame
+    eventSender.mouseMoveTo(startPosX, startPosY);
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'began', 'none');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'changed', 'none');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'changed', 'none');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, 0, 'ended', 'none');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'none', 'begin');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'none', 'continue');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'none', 'continue');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'none', 'continue');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, -1, 'none', 'continue');
+    eventSender.mouseScrollByWithWheelAndMomentumPhases(0, 0, 'none', 'end');
+    eventSender.callAfterScrollingCompletes(checkForScroll);
+
+    // We should finish via the scroll event; this will fire in the case of failure when the page doesn't scroll.
+}
+
+function setupTopLevel()
+{
+    if (window.eventSender) {
+        testRunner.dumpAsText();
+        testRunner.waitUntilDone();
+
+        eventSender.monitorWheelEvents();
+        setTimeout(scrollTest, 0);
+    } else {
+        var messageLocation = document.getElementById('parent');
+        var message = document.createElement('div');
+        message.innerHTML = &quot;&lt;p&gt;This test is better run under DumpRenderTree. To manually test it, place the mouse pointer&lt;br/&gt;&quot;
+            + &quot;at the top of the page, and then use the mouse wheel or a two-finger swipe to scroll the&lt;br/&gt;&quot;
+            + &quot;down past the iframe.&lt;br/&gt;&lt;br/&gt;&quot;
+            + &quot;The iframe should not scroll.&lt;/p&gt;&quot;;
+        messageLocation.appendChild(message);
+    }
+}
+
+&lt;/script&gt;
+&lt;div id=&quot;parent&quot; style=&quot;height: 2000px;&quot;&gt;
+    &lt;iframe id=&quot;target&quot; name=&quot;target&quot; height=&quot;500&quot; width=&quot;600&quot; src=&quot;resources/select_iframe.html&quot;&gt;&lt;/iframe&gt;
+    &lt;/iframe&gt;
+&lt;/div&gt;
+&lt;div id=&quot;console&quot;&gt;&lt;/div&gt;
+&lt;script&gt;
+description(&quot;Tests that iframe doesn't consume wheel events when scrolling a select in an iframe.&quot;);
+&lt;/script&gt;
+&lt;script src=&quot;../../../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacwk2tileddrawingscrollingresourcesselect_iframehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/resources/select_iframe.html (0 => 185156)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/resources/select_iframe.html                                (rev 0)
+++ trunk/LayoutTests/platform/mac-wk2/tiled-drawing/scrolling/resources/select_iframe.html        2015-06-03 18:37:23 UTC (rev 185156)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt; 
+&lt;title&gt;Page Title&lt;/title&gt;
+&lt;/head&gt;
+&lt;body&gt;
+
+&lt;h1&gt;This is a Heading&lt;/h1&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+ &lt;select id=&quot;selectTarget&quot; size=&quot;5&quot; multiple=&quot;multiple&quot; name=&quot;driver[]&quot;&gt;
+        &lt;option value=&quot;&quot; &gt;(No Driver Filter)&lt;/option&gt;
+        &lt;option value=&quot;drivername=''&quot;&gt;&lt;/option&gt;
+        &lt;option value=&quot;drivername='alex'&quot;&gt;alex&lt;/option&gt;
+        &lt;option value=&quot;drivername='marc'&quot;&gt;marc&lt;/option&gt;
+        &lt;option value=&quot;drivername='frank'&quot;&gt;frank&lt;/option&gt;
+        &lt;option value=&quot;drivername='james'&quot;&gt;james&lt;/option&gt;
+    &lt;option value=&quot;drivername='michael'&quot;&gt;michael&lt;/option&gt;
+&lt;/select&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+&lt;p&gt;This is a paragraph.&lt;/p&gt;
+
+
+&lt;/body&gt;
+&lt;/html&gt;
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (185155 => 185156)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2015-06-03 17:33:16 UTC (rev 185155)
+++ trunk/Source/WebCore/ChangeLog        2015-06-03 18:37:23 UTC (rev 185156)
</span><span class="lines">@@ -1,3 +1,38 @@
</span><ins>+2015-06-03  Brent Fulgham  &lt;bfulgham@apple.com&gt;
+
+        REGRESSION: (r181879): Scrolling in select/option region in iFrame scrolls both select and iframe
+        https://bugs.webkit.org/show_bug.cgi?id=145574
+        &lt;rdar://problem/20966828&gt;
+
+        Reviewed by Simon Fraser.
+
+        Tested by platform/mac-wk2/tiled-drawing/scrolling/fast-scroll-iframe-latched-select.html
+
+        When the scroll gesture is started when the latched scrollable container is not at the limit of its
+        scroll region, we are NOT supposed to propagate the scroll event to the enclosing region. However,
+        we were doing two things wrong:
+        (1) When we recognized we were latching, we were using the right wheel event target, but not using
+            the latched scrollable container.
+        (2) Likewise, we were not using latched ScrollableArea when handling wheel events.
+
+        Instead, we were using the current scrollable container and ScrollableArea under the mouse pointer,
+        which could be different from the point we started latching as the content scrolled.
+        
+        The fix was to properly track the scrollable container and scrollable area during latching.
+
+        I attempted to store the latched ScrollableArea in the latchingState object, like we already do for the
+        scrollable container, but found that this did not work properly. I think the life cycle of the
+        ScrollableArea may not match the scrollable container, and since they are not reference counted I
+        simply retrieve the ScrollableArea when needed.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::scrollableAreaForContainerNode): Helper function to return the correct ScrollableArea
+        for the two types of RenderBox elements.
+        (WebCore::latchedToFrameOrBody): Helper predicate to identify Frame and Body elements.
+        (WebCore::EventHandler::platformPrepareForWheelEvents): Use the correct ScrollableArea for the given
+        ContainerNode. When latching, make sure to use the ScrollableArea that is related to the latched scrollable
+        container, not the area currently underneath the mouse pointer.
+
</ins><span class="cx"> 2015-06-03  Brady Eidson  &lt;beidson@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         REGRESSION (r183498): Certain types of frame loads in iframes with &lt;base target=&quot;_blank&quot;&gt; can open urls in new window/tabs
</span></span></pre></div>
<a id="trunkSourceWebCorepagemacEventHandlerMacmm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/mac/EventHandlerMac.mm (185155 => 185156)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/mac/EventHandlerMac.mm        2015-06-03 17:33:16 UTC (rev 185155)
+++ trunk/Source/WebCore/page/mac/EventHandlerMac.mm        2015-06-03 18:37:23 UTC (rev 185156)
</span><span class="lines">@@ -883,6 +883,26 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static ScrollableArea* scrollableAreaForContainerNode(ContainerNode&amp; container)
+{
+    ScrollableArea* scrollableArea = nullptr;
+
+    if (RenderBox* box = container.renderBox()) {
+        if (is&lt;RenderListBox&gt;(*box))
+            scrollableArea = downcast&lt;RenderListBox&gt;(box);
+        else
+            scrollableArea = box-&gt;layer();
+    }
+
+    return scrollableArea;
+}
+
+static bool latchedToFrameOrBody(ContainerNode&amp; container)
+{
+    // FIXME(106133): We might need to add or switch to is&lt;HTMLDocumentElement&gt; when this bug is fixed.
+    return is&lt;HTMLFrameSetElement&gt;(container) || is&lt;HTMLBodyElement&gt;(container);
+}
+
</ins><span class="cx"> void EventHandler::platformPrepareForWheelEvents(const PlatformWheelEvent&amp; wheelEvent, const HitTestResult&amp; result, RefPtr&lt;Element&gt;&amp; wheelEventTarget, RefPtr&lt;ContainerNode&gt;&amp; scrollableContainer, ScrollableArea*&amp; scrollableArea, bool&amp; isOverWidget)
</span><span class="cx"> {
</span><span class="cx">     FrameView* view = m_frame.view();
</span><span class="lines">@@ -897,14 +917,9 @@
</span><span class="cx">             scrollableArea = scrollViewForEventTarget(wheelEventTarget.get());
</span><span class="cx">         } else {
</span><span class="cx">             scrollableContainer = findEnclosingOverflowScroll(wheelEventTarget.get());
</span><del>-            if (scrollableContainer) {
-                if (RenderBox* box = scrollableContainer-&gt;renderBox()) {
-                    if (is&lt;RenderListBox&gt;(*box))
-                        scrollableArea = downcast&lt;RenderListBox&gt;(box);
-                    else
-                        scrollableArea = box-&gt;layer();
-                }
-            } else {
</del><ins>+            if (scrollableContainer)
+                scrollableArea = scrollableAreaForContainerNode(*scrollableContainer);
+            else {
</ins><span class="cx">                 scrollableContainer = view-&gt;frame().document()-&gt;bodyOrFrameset();
</span><span class="cx">                 scrollableArea = view;
</span><span class="cx">             }
</span><span class="lines">@@ -944,6 +959,12 @@
</span><span class="cx"> 
</span><span class="cx">         wheelEventTarget = latchingState-&gt;wheelEventElement();
</span><span class="cx">         isOverWidget = latchingState-&gt;widgetIsLatched();
</span><ins>+        scrollableContainer = latchingState-&gt;scrollableContainer();
+
+        if (scrollableContainer) {
+            if (!latchedToFrameOrBody(*scrollableContainer) &amp;&amp; !latchingState-&gt;widgetIsLatched())
+                scrollableArea = scrollableAreaForContainerNode(*scrollableContainer);
+        }
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>