Do not traverse nodes not having a layout object while searching editable visible position.

Source/core/dom/PositionIterator.cpp

 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 53 matching lines @@
     return PositionAlgorithm<Strategy>::createLegacyEditingPosition(m_anchorNode, m_offsetInAnchor);
 }
 
 template <typename Strategy>
 PositionAlgorithm<Strategy> PositionIteratorAlgorithm<Strategy>::computePosition() const
 {
     if (m_nodeAfterPositionInAnchor) {
         ASSERT(Strategy::parent(*m_nodeAfterPositionInAnchor) == m_anchorNode);
         return PositionAlgorithm<Strategy>::inParentBeforeNode(*m_nodeAfterPositionInAnchor);
     }
-    if (Strategy::hasChildren(*m_anchorNode))
+    if (m_anchorNode && Strategy::hasChildren(*m_anchorNode))

[yosin_UTC9, 2015/07/31 06:37:01]

Could you remove |m_anchorNode|? |computePosition()| should be identical to
|deprecatedComputePositon()| except for calling |createLegacyEditing()|.

         return PositionAlgorithm<Strategy>::lastPositionInOrAfterNode(m_anchorNode);
-    if (m_anchorNode->isTextNode())
+    if (m_anchorNode && m_anchorNode->isTextNode())

[yosin_UTC9, 2015/07/31 06:37:01]

Could you remove |m_anchorNode|? |computePosition()| should be identical to
|deprecatedComputePositon()| except for calling |createLegacyEditing()|.

         return PositionAlgorithm<Strategy>(m_anchorNode, m_offsetInAnchor);
     if (m_offsetInAnchor)
         return PositionAlgorithm<Strategy>(m_anchorNode, PositionAnchorType::AfterAnchor);
     return PositionAlgorithm<Strategy>(m_anchorNode, PositionAnchorType::BeforeAnchor);
 }
 
 template <typename Strategy>
 void PositionIteratorAlgorithm<Strategy>::increment()
 {
     if (!m_anchorNode)
         return;
 
     if (m_nodeAfterPositionInAnchor) {
         m_anchorNode = m_nodeAfterPositionInAnchor;
         m_nodeAfterPositionInAnchor = Strategy::firstChild(*m_anchorNode);
         m_offsetInAnchor = 0;
         return;
     }
 
-    if (!Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {
+    if (m_anchorNode->layoutObject() && !Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {
         m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     } else {
         m_nodeAfterPositionInAnchor = m_anchorNode;
         m_anchorNode = Strategy::parent(*m_nodeAfterPositionInAnchor);
         m_nodeAfterPositionInAnchor = Strategy::nextSibling(*m_nodeAfterPositionInAnchor);
         m_offsetInAnchor = 0;
     }
 }
 
 template <typename Strategy>
@@ skipping 12 matching lines @@
             m_anchorNode = Strategy::parent(*m_nodeAfterPositionInAnchor);
             m_offsetInAnchor = 0;
         }
         return;
     }
 
     if (Strategy::hasChildren(*m_anchorNode)) {
         m_anchorNode = Strategy::lastChild(*m_anchorNode);
         m_offsetInAnchor = Strategy::hasChildren(*m_anchorNode)? 0 : Strategy::lastOffsetForEditing(m_anchorNode);
     } else {
-        if (m_offsetInAnchor) {
+        if (m_offsetInAnchor && m_anchorNode->layoutObject()) {
             m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
         } else {
             m_nodeAfterPositionInAnchor = m_anchorNode;
             m_anchorNode = Strategy::parent(*m_anchorNode);
         }
     }
 }
 
 template <typename Strategy>
 bool PositionIteratorAlgorithm<Strategy>::atStart() const
@@ skipping 32 matching lines @@
         return true;
     if (m_nodeAfterPositionInAnchor)
         return false;
     return Strategy::hasChildren(*m_anchorNode) || m_offsetInAnchor >= Strategy::lastOffsetForEditing(m_anchorNode);
 }
 
 template class PositionIteratorAlgorithm<EditingStrategy>;
 template class PositionIteratorAlgorithm<EditingInComposedTreeStrategy>;
 
 } // namespace blink