Do not traverse nodes not having a layout object while searching editable visible position.

Source/core/dom/PositionIterator.cpp

Index: Source/core/dom/PositionIterator.cpp
diff --git a/Source/core/dom/PositionIterator.cpp b/Source/core/dom/PositionIterator.cpp
index c610f14236bdf0e6cdf73b0788ba9188d0f991e6..ef8f22f1b899e1580d9a8e310376e05d39f3c366 100644
--- a/Source/core/dom/PositionIterator.cpp
+++ b/Source/core/dom/PositionIterator.cpp
@@ -77,7 +77,7 @@ void PositionIteratorAlgorithm<Strategy>::increment()
         return;
     }
 
-    if (!Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {
+    if (m_anchorNode->layoutObject() && !Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {

[yosin_UTC9, 2015/07/17 12:00:21]

Please check layoutObject() only for nodes which return true for
offsetInCharacter().

[changseok, 2015/07/28 05:05:37]

Done.

         m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     } else {
         m_nodeAfterPositionInAnchor = m_anchorNode;
@@ -110,7 +110,7 @@ void PositionIteratorAlgorithm<Strategy>::decrement()
         m_anchorNode = Strategy::lastChild(*m_anchorNode);
         m_offsetInAnchor = Strategy::hasChildren(*m_anchorNode)? 0 : Strategy::lastOffsetForEditing(m_anchorNode);
     } else {
-        if (m_offsetInAnchor) {
+        if (m_offsetInAnchor && m_anchorNode->layoutObject()) {

[yosin_UTC9, 2015/07/17 12:00:21]

Same as L80

[changseok, 2015/07/28 05:05:37]

Done.

             m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
         } else {
             m_nodeAfterPositionInAnchor = m_anchorNode;