Do not traverse nodes not having a layout object while searching editable visible position.

Source/core/dom/PositionIterator.cpp

Index: Source/core/dom/PositionIterator.cpp
diff --git a/Source/core/dom/PositionIterator.cpp b/Source/core/dom/PositionIterator.cpp
index cf18d99daa24fda35d57fbb4d1052a962c686916..2f42975f82e3abd3a29f88eeaaf822f6ce7242f8 100644
--- a/Source/core/dom/PositionIterator.cpp
+++ b/Source/core/dom/PositionIterator.cpp
@@ -71,9 +71,9 @@ PositionAlgorithm<Strategy> PositionIteratorAlgorithm<Strategy>::computePosition
         ASSERT(Strategy::parent(*m_nodeAfterPositionInAnchor) == m_anchorNode);
         return PositionAlgorithm<Strategy>::inParentBeforeNode(*m_nodeAfterPositionInAnchor);
     }
-    if (Strategy::hasChildren(*m_anchorNode))
+    if (m_anchorNode && Strategy::hasChildren(*m_anchorNode))

[yosin_UTC9, 2015/07/31 06:37:01]

Could you remove |m_anchorNode|? |computePosition()| should be identical to
|deprecatedComputePositon()| except for calling |createLegacyEditing()|.

         return PositionAlgorithm<Strategy>::lastPositionInOrAfterNode(m_anchorNode);
-    if (m_anchorNode->isTextNode())
+    if (m_anchorNode && m_anchorNode->isTextNode())

[yosin_UTC9, 2015/07/31 06:37:01]

Could you remove |m_anchorNode|? |computePosition()| should be identical to
|deprecatedComputePositon()| except for calling |createLegacyEditing()|.

         return PositionAlgorithm<Strategy>(m_anchorNode, m_offsetInAnchor);
     if (m_offsetInAnchor)
         return PositionAlgorithm<Strategy>(m_anchorNode, PositionAnchorType::AfterAnchor);
@@ -93,7 +93,7 @@ void PositionIteratorAlgorithm<Strategy>::increment()
         return;
     }
 
-    if (!Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {
+    if (m_anchorNode->layoutObject() && !Strategy::hasChildren(*m_anchorNode) && m_offsetInAnchor < Strategy::lastOffsetForEditing(m_anchorNode)) {
         m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     } else {
         m_nodeAfterPositionInAnchor = m_anchorNode;
@@ -126,7 +126,7 @@ void PositionIteratorAlgorithm<Strategy>::decrement()
         m_anchorNode = Strategy::lastChild(*m_anchorNode);
         m_offsetInAnchor = Strategy::hasChildren(*m_anchorNode)? 0 : Strategy::lastOffsetForEditing(m_anchorNode);
     } else {
-        if (m_offsetInAnchor) {
+        if (m_offsetInAnchor && m_anchorNode->layoutObject()) {
             m_offsetInAnchor = PositionAlgorithm<Strategy>::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
         } else {
             m_nodeAfterPositionInAnchor = m_anchorNode;