Steps to reproduce: 1) Type something in "Add comment" textarea of this bug. 2) Copy some text from the page (e.g. "Nobody" from Assigned To). 3) Paste it in the textarea. 4) Click inside the pasted text. Results: the insertion point is positioned before the pasted text. Clicking in typed text works fine.
I think this regressed in <http://trac.webkit.org/projects/webkit/changeset/22037> which made it impossible for closestLeafChildForXPos() to return the last leaf.
Here is a non-forms test case: <div style="line-height: 3;">Lorem <!-- comment --> ipsum</div> You can drag just above the text (where the cursor is still an arrow, not an I-beam) to select individual letters from "Lorem", but not from "ipsum" -- either it's selected or not.
Created attachment 15896 [details] Allow the last leaf child to be returned from closestLeafChildForXPos Includes change log and layout test. No layout test regressions.
<rdar://problem/5397344>
Comment on attachment 15896 [details] Allow the last leaf child to be returned from closestLeafChildForXPos r=me
Committed revision 24999.