Bug 305239. Fix regression in text entry. r+sr=roc, patch by Uri Bernstein

layout/generic/nsFrame.cpp

@@ -3602,16 +3602,24 @@ DrillDownToEndOfLine(nsIFrame* aFrame, PRInt32 aLineFrameCount,
   if (!aFrame)
     return NS_ERROR_UNEXPECTED;
 
+  nsIFrame *prevFrame = aFrame;
   nsIFrame *currentFrame = aFrame;
   PRInt32 i;
 
   for (i = 1; i < aLineFrameCount; i++) //already have 1st frame
   {
+    prevFrame = currentFrame;
     currentFrame = currentFrame->GetNextSibling();
     NS_ASSERTION(currentFrame, "lineFrame Count lied to us from nsILineIterator!\n");
   }
+  if (!currentFrame->GetRect().width) //this can happen with BR frames and or empty placeholder frames.
+  {
+    //if we do hit an empty frame then back up the current frame to the frame before it if there is one.
+    currentFrame = prevFrame;
+  }
+  
   nsFrame::GetLastLeaf(aFrame->GetPresContext(), &currentFrame);
-    
+  
   aPos->mResultContent = currentFrame->GetContent();
   PRInt32 startOffset, endOffset;
   nsresult rv = currentFrame->GetOffsets(startOffset, endOffset);

layout/generic/nsSelection.cpp

@@ -2736,14 +2736,8 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, HINT aHin
   if (aNode->IsContentOfType(nsIContent::eELEMENT))
   {
     PRInt32 childIndex  = 0;
-    PRInt32 numChildren = theNode->GetChildCount();
+    PRInt32 numChildren = 0;
 
-    if (numChildren == 0)
-    {
-      *aReturnOffset = 0;
-      return mShell->GetPrimaryFrameFor(theNode, aReturnFrame);
-    }
-    
     if (aHint == HINTLEFT)
     {
       if (aOffset > 0)
@@ -2753,8 +2747,15 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, HINT aHin
     }
     else // HINTRIGHT
     {
+      numChildren = theNode->GetChildCount();
+
       if (aOffset >= numChildren)
-        childIndex = numChildren - 1;
+      {
+        if (numChildren > 0)
+          childIndex = numChildren - 1;
+        else
+          childIndex = 0;
+      }
       else
         childIndex = aOffset;
     }