<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[206605] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/206605">206605</a></dd>
<dt>Author</dt> <dd>rniwa@webkit.org</dd>
<dt>Date</dt> <dd>2016-09-29 12:49:54 -0700 (Thu, 29 Sep 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Text nodes assigned to a linked slot are not clickable
https://bugs.webkit.org/show_bug.cgi?id=162091
&lt;rdar://problem/28383300&gt;

Reviewed by Antti Koivisto.

Source/WebCore:

The bug was caused by updateMouseEventTargetNode adjusting the target to its parent element when
the original target was a text node. Fixed the bug by using the parent element in the composed tree.

Also fixed the bug that the hit testing was not finding the anchor element and keeping the cursor
in I-beam by traversing the composed tree instead.

Test: fast/shadow-dom/click-text-inside-linked-slot.html

* dom/Node.cpp:
(WebCore::Node::enclosingLinkEventParentOrSelf): Fixed the cursor problem.
* page/EventHandler.cpp:
(WebCore::EventHandler::updateMouseEventTargetNode): Fixed the activation problem.

LayoutTests:

Added a regression test for clicking inside a text node assigned to a slot inside a hyperlink.

Unfortunately, there is not a way to make this a W3C style test until the web platform tests
start supporting WebDriver.

* fast/shadow-dom/click-text-inside-linked-slot-expected.txt: Added.
* fast/shadow-dom/click-text-inside-linked-slot.html: Added.
* platform/ios-simulator-wk2/TestExpectations:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsplatformiossimulatorwk2TestExpectations">trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomNodecpp">trunk/Source/WebCore/dom/Node.cpp</a></li>
<li><a href="#trunkSourceWebCorepageEventHandlercpp">trunk/Source/WebCore/page/EventHandler.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastshadowdomclicktextinsidelinkedslotexpectedtxt">trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastshadowdomclicktextinsidelinkedslothtml">trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (206604 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-09-29 19:48:25 UTC (rev 206604)
+++ trunk/LayoutTests/ChangeLog        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2016-09-28  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
+
+        Text nodes assigned to a linked slot are not clickable
+        https://bugs.webkit.org/show_bug.cgi?id=162091
+        &lt;rdar://problem/28383300&gt;
+
+        Reviewed by Antti Koivisto.
+
+        Added a regression test for clicking inside a text node assigned to a slot inside a hyperlink.
+
+        Unfortunately, there is not a way to make this a W3C style test until the web platform tests
+        start supporting WebDriver.
+
+        * fast/shadow-dom/click-text-inside-linked-slot-expected.txt: Added.
+        * fast/shadow-dom/click-text-inside-linked-slot.html: Added.
+        * platform/ios-simulator-wk2/TestExpectations:
+
</ins><span class="cx"> 2016-09-29  Ryan Haddad  &lt;ryanhaddad@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Marking fast/images/load-img-with-empty-src.html as crashing.
</span></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomclicktextinsidelinkedslotexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot-expected.txt (0 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot-expected.txt        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -0,0 +1,6 @@
</span><ins>+This tests clicking on a Text node assigned to a slot inside an anchor element. The link should be activated.
+To manually test, click &quot;here&quot; below and you should see &quot;PASS&quot; and the mouse cursor should indicate it's a hyperlink, not text:
+
+click here
+Activation: PASS
+Cursor: type=Hand hotSpot=0,0
</ins></span></pre></div>
<a id="trunkLayoutTestsfastshadowdomclicktextinsidelinkedslothtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot.html (0 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot.html                                (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/click-text-inside-linked-slot.html        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -0,0 +1,34 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;body&gt;
+&lt;p&gt;This tests clicking on a Text node assigned to a slot inside an anchor element. The link should be activated.&lt;br&gt;
+To manually test, click &quot;here&quot; below and you should see &quot;PASS&quot; and the mouse cursor should indicate it's a hyperlink, not text:&lt;/p&gt;
+&lt;script&gt;
+
+var shadowHost = document.createElement('div');
+document.body.appendChild(shadowHost);
+
+shadowHost.innerHTML = `click here`;
+var shadowRoot = shadowHost.attachShadow({mode: 'closed'});
+shadowRoot.innerHTML = `&lt;a href=&quot;javascript:activated()&quot;&gt;&lt;slot&gt;&lt;/slot&gt;&lt;/a&gt;`;
+
+document.write('&lt;div&gt;Activation: &lt;span id=&quot;activation&quot;&gt;&lt;span&gt;&lt;/div&gt;');
+
+function activated() {
+    document.getElementById('activation').textContent = 'PASS';
+    if (window.internals)
+        document.getElementById('cursor').textContent = internals.getCurrentCursorInfo();
+}
+
+if (window.internals) {
+    testRunner.dumpAsText();
+    document.getElementById('activation').textContent = 'FAIL';
+    document.write('&lt;div&gt;Cursor: &lt;span id=&quot;cursor&quot;&gt;FAIL&lt;span&gt;&lt;/div&gt;');
+    eventSender.mouseMoveTo(shadowHost.offsetLeft + 5, shadowHost.offsetTop + 5);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+}
+
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformiossimulatorwk2TestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations (206604 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations        2016-09-29 19:48:25 UTC (rev 206604)
+++ trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -1765,6 +1765,7 @@
</span><span class="cx"> fast/loader/location-hash-user-gesture.html [ Skip ]
</span><span class="cx"> imported/blink/editing/selection/selectstart-event-crash.html [ Skip ]
</span><span class="cx"> fast/dom/Window/post-message-user-action.html [ Skip ]
</span><ins>+fast/shadow-dom/click-text-inside-linked-slot.html [ Skip ]
</ins><span class="cx"> 
</span><span class="cx"> # No touch events
</span><span class="cx"> http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-always.html [ Skip ]
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (206604 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-09-29 19:48:25 UTC (rev 206604)
+++ trunk/Source/WebCore/ChangeLog        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2016-09-28  Ryosuke Niwa  &lt;rniwa@webkit.org&gt;
+
+        Text nodes assigned to a linked slot are not clickable
+        https://bugs.webkit.org/show_bug.cgi?id=162091
+        &lt;rdar://problem/28383300&gt;
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by updateMouseEventTargetNode adjusting the target to its parent element when
+        the original target was a text node. Fixed the bug by using the parent element in the composed tree.
+
+        Also fixed the bug that the hit testing was not finding the anchor element and keeping the cursor
+        in I-beam by traversing the composed tree instead.
+
+        Test: fast/shadow-dom/click-text-inside-linked-slot.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::enclosingLinkEventParentOrSelf): Fixed the cursor problem.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateMouseEventTargetNode): Fixed the activation problem.
+
</ins><span class="cx"> 2016-09-29  Sam Weinig  &lt;sam@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Allow overriding some NSURLSessionConfiguration properties on a per-NetworkProcess basis
</span></span></pre></div>
<a id="trunkSourceWebCoredomNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Node.cpp (206604 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Node.cpp        2016-09-29 19:48:25 UTC (rev 206604)
+++ trunk/Source/WebCore/dom/Node.cpp        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -1842,7 +1842,7 @@
</span><span class="cx"> 
</span><span class="cx"> Element* Node::enclosingLinkEventParentOrSelf()
</span><span class="cx"> {
</span><del>-    for (Node* node = this; node; node = node-&gt;parentOrShadowHostNode()) {
</del><ins>+    for (Node* node = this; node; node = node-&gt;parentInComposedTree()) {
</ins><span class="cx">         // For imagemaps, the enclosing link element is the associated area element not the image itself.
</span><span class="cx">         // So we don't let images be the enclosing link element, even though isLink sometimes returns
</span><span class="cx">         // true for them.
</span></span></pre></div>
<a id="trunkSourceWebCorepageEventHandlercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/page/EventHandler.cpp (206604 => 206605)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/page/EventHandler.cpp        2016-09-29 19:48:25 UTC (rev 206604)
+++ trunk/Source/WebCore/page/EventHandler.cpp        2016-09-29 19:49:54 UTC (rev 206605)
</span><span class="lines">@@ -2362,10 +2362,9 @@
</span><span class="cx">         targetElement = m_capturingMouseEventsElement.get();
</span><span class="cx">     else if (targetNode) {
</span><span class="cx">         // If the target node is a non-element, dispatch on the parent. &lt;rdar://problem/4196646&gt;
</span><del>-        if (!is&lt;Element&gt;(*targetNode))
-            targetElement = targetNode-&gt;parentOrShadowHostElement();
-        else
-            targetElement = downcast&lt;Element&gt;(targetNode);
</del><ins>+        while (targetNode &amp;&amp; !is&lt;Element&gt;(*targetNode))
+            targetNode = targetNode-&gt;parentInComposedTree();
+        targetElement = downcast&lt;Element&gt;(targetNode);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_elementUnderMouse = targetElement;
</span></span></pre>
</div>
</div>

</body>
</html>