Another, just like bug 24313: Hit testing on a RenderTextControlMultiLine seems to work only because of a side-effect of HitTestResult behavior. What I see happening is this: RenderLayer::hitTest calls hitTest() on the renderer, which goes into RenderTextControlMultiLine::nodeAtPoint(). This ends up setting some text node inside the textarea as the innerNode() on the result. However, RenderTextControlMultiLine::nodeAtPoint() then returns false! So we continue to hit test all the way up to the body. The body's layer ends up being the one hit, but we use the node in the result anyway. This is hurting my karma. See bug 24312.
Created attachment 28213 [details] Patch
Comment on attachment 28213 [details] Patch r=me
http://trac.webkit.org/changeset/41385