Do not traverse nodes not having a layout object while searching editable visible position.

Source/core/dom/PositionIterator.cpp

 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 59 matching lines @@
     if (!m_anchorNode)
         return;
 
     if (m_nodeAfterPositionInAnchor) {
         m_anchorNode = m_nodeAfterPositionInAnchor;
         m_nodeAfterPositionInAnchor = Strategy::firstChild(*m_anchorNode);
         m_offsetInAnchor = 0;
         return;
     }
 
-    if (!Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {
+    if (m_anchorNode->layoutObject() && !Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {

[yosin_UTC9, 2015/07/17 12:00:21]

Please check layoutObject() only for nodes which return true for
offsetInCharacter().

[changseok, 2015/07/28 05:05:37]

Done.

         m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     } else {
         m_nodeAfterPositionInAnchor = m_anchorNode;
         m_anchorNode = Strategy::parent(*m_nodeAfterPositionInAnchor);
         m_nodeAfterPositionInAnchor = Strategy::nextSibling(*m_nodeAfterPositionInAnchor);
         m_offsetInAnchor = 0;
     }
 }
 
 template <typename Strategy>
@@ skipping 12 matching lines @@
             m_anchorNode = Strategy::parent(*m_nodeAfterPositionInAnchor);
             m_offsetInAnchor = 0;
         }
         return;
     }
 
     if (Strategy::hasChildren(*m_anchorNode)) {
         m_anchorNode = Strategy::lastChild(*m_anchorNode);
         m_offsetInAnchor = Strategy::hasChildren(*m_anchorNode)? 0 : Strategy::lastOffsetForEditing(m_anchorNode);
     } else {
-        if (m_offsetInAnchor) {
+        if (m_offsetInAnchor && m_anchorNode->layoutObject()) {

[yosin_UTC9, 2015/07/17 12:00:21]

Same as L80

[changseok, 2015/07/28 05:05:37]

Done.

             m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
         } else {
             m_nodeAfterPositionInAnchor = m_anchorNode;
             m_anchorNode = Strategy::parent(*m_anchorNode);
         }
     }
 }
 
 template <typename Strategy>
 bool PositionIteratorAlgorithm<Strategy>::atStart() const
@@ skipping 82 matching lines @@
         }
     }
 
     return false;
 }
 
 template class PositionIteratorAlgorithm<EditingStrategy>;
 template class PositionIteratorAlgorithm<EditingInComposedTreeStrategy>;
 
 } // namespace blink