Hit testing on a RenderTextControlSingleLine seems to work only because of a side-effect of HitTestResult behavior.
What I see happening is this.
RenderLayer::hitTest calls hitTest() on the renderer, which goes into RenderTextControlSingleLine::nodeAtPoint(). This ends up setting the TextControlInnerTextElement as the innerNode() on the result. However, RenderTextControlSingleLine::nodeAtPoint() then returns false!
So we continue to hit test all the way up to the body. The body's layer ends up being the one hit, but we use the node in the result anyway.
This is hurting my karma. See bug 24312.
Created attachment 28212 [details]
I'm pretty sure it was just wrong to test against m_innerBlock, because the superclass could never have set that on the result.