diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 59f01aa..abf537b 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,36 @@
+2008-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22190
+
+        Fix the painting and event handling in transformed search fields.
+        When painting the cancel and results button parts,  get the rect from AppKit
+        relative to the input bounds (rather than in absolute coords), then convert
+        it into the coords of the part's renderer (which is the one that is painting).
+        To do this we need to compute an offset relative to some container, so expose
+        a method on RenderObject for that.
+        
+        Also fix the location at which the search popup shows up to take transforms
+        into account, and fix the math that is used to figure out if the search
+        results button, or the cancel button should get the mouse events.
+        
+        Test: fast/forms/search-transformed.html
+
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromContainer):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::forwardEvent):
+        (WebCore::RenderTextControl::showPopup):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::convertToPaintingRect):
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+
 2008-11-20  Joerg Bornemann  <joerg.bornemann@trolltech.com>
 
         Reviewed by Simon Hausmann.
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index ded9cb5..5f2021d 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -191,7 +191,7 @@
     
     virtual bool shouldCalculateSizeAsReplaced() const { return isReplaced() && !isInlineBlockOrInlineTable(); }
 
-    IntSize offsetFromContainer(RenderObject*) const;
+    virtual IntSize offsetFromContainer(RenderObject*) const;
     
 private:
     void paintRootBoxDecorations(PaintInfo&, int tx, int ty);
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 51e5b02..fc7134d 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -2443,6 +2443,19 @@
     return FloatQuad();
 }
 
+IntSize RenderObject::offsetFromContainer(RenderObject* o) const
+{
+    ASSERT(o == container());
+
+    IntSize offset;
+    offset.expand(0, o->borderTopExtra());
+
+    if (o->hasOverflowClip())
+        offset -= o->layer()->scrolledContentOffset();
+
+    return offset;
+}
+
 IntRect RenderObject::caretRect(InlineBox* inlineBox, int caretOffset, int* extraWidthToEndOfLine)
 {
    if (extraWidthToEndOfLine)
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index 99b2309..e2689e3 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -602,6 +602,9 @@
     // Convert a local quad to an absolute quad, taking transforms into account.
     virtual FloatQuad localToAbsoluteQuad(const FloatQuad&, bool fixed = false) const;
 
+    // Return the offset from the container() renderer (excluding transforms)
+    virtual IntSize offsetFromContainer(RenderObject*) const;
+
     // width and height are without margins but include paddings and borders
     virtual int width() const { return 0; }
     virtual int height() const { return 0; }
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index 567eb45..0abf88b 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -852,9 +852,10 @@
     } else if (evt->type() == eventNames().focusEvent)
         capsLockStateMayHaveChanged();
     else {
-        if (evt->isMouseEvent() && m_resultsButton && static_cast<MouseEvent*>(evt)->x() < m_innerText->renderer()->absoluteBoundingBoxRect().x())
+        FloatPoint localPoint = m_innerText->renderer()->absoluteToLocal(FloatPoint(static_cast<MouseEvent*>(evt)->pageX(), static_cast<MouseEvent*>(evt)->pageY()), false, true);
+        if (evt->isMouseEvent() && m_resultsButton && localPoint.x() < m_innerText->renderer()->borderBox().x())
             m_resultsButton->defaultEventHandler(evt);
-        else if (evt->isMouseEvent() && m_cancelButton && static_cast<MouseEvent*>(evt)->x() > m_innerText->renderer()->absoluteBoundingBoxRect().right())
+        else if (evt->isMouseEvent() && m_cancelButton && localPoint.x() > m_innerText->renderer()->borderBox().right())
             m_cancelButton->defaultEventHandler(evt);
         else
             m_innerText->defaultEventHandler(evt);
@@ -986,7 +987,7 @@
         m_searchPopup->saveRecentSearches(name, m_recentSearches);
     }
 
-    m_searchPopup->show(absoluteBoundingBoxRect(), document()->view(), -1);
+    m_searchPopup->show(absoluteBoundingBoxRect(true), document()->view(), -1);
 }
 
 void RenderTextControl::hidePopup()
diff --git a/WebCore/rendering/RenderThemeMac.h b/WebCore/rendering/RenderThemeMac.h
index 1a49898..a1da7ff 100644
--- a/WebCore/rendering/RenderThemeMac.h
+++ b/WebCore/rendering/RenderThemeMac.h
@@ -120,6 +120,8 @@
 private:
     IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
 
+    FloatRect convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const;
+    
     // Get the control size based off the font.  Used by some of the controls (like buttons).
     NSControlSize controlSizeForFont(RenderStyle*) const;
     NSControlSize controlSizeForSystemFont(RenderStyle*) const;
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 789f0b2..e400ebb 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -475,6 +475,28 @@
     return result;
 }
 
+FloatRect RenderThemeMac::convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const
+{
+    FloatRect partRect(inputRect);
+    
+    // Compute an offset between the part renderer and the input renderer
+    FloatSize offsetFromInputRenderer;
+    const RenderObject* renderer = partRenderer;
+    while (renderer && renderer != inputRenderer) {
+        RenderObject* containingRenderer = renderer->container();
+        offsetFromInputRenderer -= renderer->offsetFromContainer(containingRenderer);
+        renderer = containingRenderer;
+    }
+    // If the input renderer was not a container, something went wrong
+    ASSERT(renderer == inputRenderer);
+    // Move the rect into partRenderer's coords
+    partRect.move(offsetFromInputRenderer);
+    // Account for the local drawing offset (tx, ty)
+    partRect.move(r.x(), r.y());
+
+    return partRect;
+}
+
 void RenderThemeMac::updateCheckedState(NSCell* cell, const RenderObject* o)
 {
     bool oldIndeterminate = [cell state] == NSMixedState;
@@ -1243,9 +1265,10 @@
 
     float zoomLevel = o->style()->effectiveZoom();
 
-    NSRect bounds = [search cancelButtonRectForBounds:NSRect(input->renderer()->absoluteBoundingBoxRect())];
-    
-    IntRect unzoomedRect(bounds);
+    FloatRect localBounds = [search cancelButtonRectForBounds:NSRect(input->renderer()->borderBox())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
+
+    FloatRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
@@ -1313,8 +1336,10 @@
     if ([search searchMenuTemplate] != nil)
         [search setSearchMenuTemplate:nil];
 
-    NSRect bounds = [search searchButtonRectForBounds:NSRect(input->renderer()->absoluteBoundingBoxRect())];
-    [[search searchButtonCell] drawWithFrame:bounds inView:o->view()->frameView()->documentView()];
+    FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderer()->borderBox())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
+
+    [[search searchButtonCell] drawWithFrame:localBounds inView:o->view()->frameView()->documentView()];
     [[search searchButtonCell] setControlView:nil];
     return false;
 }
@@ -1342,9 +1367,10 @@
 
     float zoomLevel = o->style()->effectiveZoom();
 
-    NSRect bounds = [search searchButtonRectForBounds:NSRect(input->renderer()->absoluteBoundingBoxRect())];
+    FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderer()->borderBox())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
     
-    IntRect unzoomedRect(bounds);
+    IntRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);