WebView: Make hit test results consistent for a failed image

WebView uses two mechanisms to computing hit test results: focus
change notifications and explicit hit test queries. Both paths use
slightly different logic for computing the final hit test result, which
makes two unit tests fail when the renderer scheduler is enabled.

The main reasons for the failures are: 1) the two hit testing paths
return different results and 2) both paths are being used
simultaneously and the scheduler changes which result 'wins'.

This patch fixes a problem where the two paths diverge if the user
clicked on an image that failed to load. Before, the logic that walks
the DOM finds the URL for the image, while the logic that relies on
Blink's hit testing does not.

With this patch, if Blink fails to give us a valid image URL, we fall
back to walking the DOM to see if there is an image tag under the node
that was hit. This makes the results consistent for both paths.

BUG=444572
TEST=WebKitHitTestTest#testSrcImgeAnchorType*

Review URL: https://codereview.chromium.org/832413002

Cr-Commit-Position: refs/heads/master@{#310515}

1 files changed, 14 insertions, 7 deletions

diff --git a/android_webview/renderer/aw_render_view_ext.cc b/android_webview/renderer/aw_render_view_ext.cc
index 6bef962..c2877c5 100644
--- a/android_webview/renderer/aw_render_view_ext.cc
+++ b/android_webview/renderer/aw_render_view_ext.cc
@@ -64,6 +64,13 @@ blink::WebElement GetImgChild(const blink::WebElement& element) {
   return collection.firstItem();
 }
 
+GURL GetChildImageUrlFromElement(const blink::WebElement& element) {
+  const blink::WebElement child_img = GetImgChild(element);
+  if (child_img.isNull())
+    return GURL();
+  return GetAbsoluteSrcUrl(child_img);
+}
+
 bool RemovePrefixAndAssignIfMatches(const base::StringPiece& prefix,
                                     const GURL& url,
                                     std::string* dest) {
@@ -251,12 +258,7 @@ void AwRenderViewExt::FocusedNodeChanged(const blink::WebNode& node) {
   if (node.isLink())
     absolute_link_url = GetAbsoluteUrl(node, data.href);
 
-  GURL absolute_image_url;
-  const blink::WebElement child_img = GetImgChild(element);
-  if (!child_img.isNull()) {
-    absolute_image_url =
-        GetAbsoluteSrcUrl(child_img);
-  }
+  GURL absolute_image_url = GetChildImageUrlFromElement(element);
 
   PopulateHitTestData(absolute_link_url,
                       absolute_image_url,
@@ -276,13 +278,18 @@ void AwRenderViewExt::OnDoHitTest(const gfx::PointF& touch_center,
           blink::WebSize(touch_area.width(), touch_area.height()));
   AwHitTestData data;
 
+  GURL absolute_image_url = result.absoluteImageURL();
   if (!result.urlElement().isNull()) {
     data.anchor_text = result.urlElement().innerText();
     data.href = GetHref(result.urlElement());
+    // If we hit an image that failed to load, Blink won't give us its URL.
+    // Fall back to walking the DOM in this case.
+    if (absolute_image_url.is_empty())
+      absolute_image_url = GetChildImageUrlFromElement(result.urlElement());
   }
 
   PopulateHitTestData(result.absoluteLinkURL(),
-                      result.absoluteImageURL(),
+                      absolute_image_url,
                       result.isContentEditable(),
                       &data);
   Send(new AwViewHostMsg_UpdateHitTestData(routing_id(), data));