1 files changed, 14 insertions, 7 deletions
diff --git a/android_webview/renderer/aw_render_view_ext.cc b/android_webview/renderer/aw_render_view_ext.cc
index 6bef962..c2877c5 100644
--- a/android_webview/renderer/aw_render_view_ext.cc
+++ b/android_webview/renderer/aw_render_view_ext.cc
@@ -64,6 +64,13 @@ blink::WebElement GetImgChild(const blink::WebElement& element) {
   return collection.firstItem();
 }
 
+GURL GetChildImageUrlFromElement(const blink::WebElement& element) {
+  const blink::WebElement child_img = GetImgChild(element);
+  if (child_img.isNull())
+    return GURL();
+  return GetAbsoluteSrcUrl(child_img);
+}
+
 bool RemovePrefixAndAssignIfMatches(const base::StringPiece& prefix,
                                     const GURL& url,
                                     std::string* dest) {
@@ -251,12 +258,7 @@ void AwRenderViewExt::FocusedNodeChanged(const blink::WebNode& node) {
   if (node.isLink())
     absolute_link_url = GetAbsoluteUrl(node, data.href);
 
-  GURL absolute_image_url;
-  const blink::WebElement child_img = GetImgChild(element);
-  if (!child_img.isNull()) {
-    absolute_image_url =
-        GetAbsoluteSrcUrl(child_img);
-  }
+  GURL absolute_image_url = GetChildImageUrlFromElement(element);
 
   PopulateHitTestData(absolute_link_url,
                       absolute_image_url,
@@ -276,13 +278,18 @@ void AwRenderViewExt::OnDoHitTest(const gfx::PointF& touch_center,
           blink::WebSize(touch_area.width(), touch_area.height()));
   AwHitTestData data;
 
+  GURL absolute_image_url = result.absoluteImageURL();
   if (!result.urlElement().isNull()) {
     data.anchor_text = result.urlElement().innerText();
     data.href = GetHref(result.urlElement());
+    // If we hit an image that failed to load, Blink won't give us its URL.
+    // Fall back to walking the DOM in this case.
+    if (absolute_image_url.is_empty())
+      absolute_image_url = GetChildImageUrlFromElement(result.urlElement());
   }
 
   PopulateHitTestData(result.absoluteLinkURL(),
-                      result.absoluteImageURL(),
+                      absolute_image_url,
                       result.isContentEditable(),
                       &data);
   Send(new AwViewHostMsg_UpdateHitTestData(routing_id(), data));