https://bugs.webkit.org/show_bug.cgi?id=45164

Reviewed by Dan Bernstein.

REGRESSION: <a><img align=top></a> Clickable area too large
        
Make sure to clamp hit testing of quirky inline flow boxes the same way we already clamped
painting.

Source/WebCore: 

* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::nodeAtPoint):

LayoutTests: 

* fast/inline/inline-position-top-align-expected.txt: Added.
* fast/inline/inline-position-top-align.html: Added.



git-svn-id: svn://svn.chromium.org/blink/trunk@81055 bbb929c8-8fbe-4397-9dbb-9b2b20218538
void InlineFlowBox::flipLinesInBlockDirection(int lineTop, int lineBottom)
{
    setLogicalTop(lineBottom - (logicalTop() - lineTop) - logicalHeight());
    
    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
        if (curr->renderer()->isPositioned())
            continue; // Positioned placeholders aren't affected here.
        
        if (curr->isInlineFlowBox())
            static_cast<InlineFlowBox*>(curr)->flipLinesInBlockDirection(lineTop, lineBottom);
        else
            curr->setLogicalTop(lineBottom - (curr->logicalTop() - lineTop) - curr->logicalHeight());
    }
}

void InlineFlowBox::flipLinesInBlockDirection(int lineTop, int lineBottom)
{
    setLogicalTop(lineBottom - (logicalTop() - lineTop) - logicalHeight());
    
    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
        if (curr->renderer()->isPositioned())
            continue; // Positioned placeholders aren't affected here.
        
        if (curr->isInlineFlowBox())
            static_cast<InlineFlowBox*>(curr)->flipLinesInBlockDirection(lineTop, lineBottom);
        else
            curr->setLogicalTop(lineBottom - (curr->logicalTop() - lineTop) - curr->logicalHeight());
    }
}
