Check isText() when editing traverses layout tree for ::first-letter

third_party/WebKit/Source/core/editing/VisibleUnits.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 2680 matching lines @@
         layoutTextFragment->start() + layoutTextFragment->fragmentLength());
     return layoutTextFragment;
   }
   if (layoutTextFragment->fragmentLength() &&
       static_cast<unsigned>(offsetInNode) >= layoutTextFragment->start())
     return layoutObject;
   LayoutObject* firstLetterLayoutObject =
       layoutTextFragment->firstLetterPseudoElement()->layoutObject();
   // TODO(yosin): We're not sure when |firstLetterLayoutObject| has
   // multiple child layout object.
-  DCHECK_EQ(firstLetterLayoutObject->slowFirstChild(),
-            firstLetterLayoutObject->slowLastChild());
-  return firstLetterLayoutObject->slowFirstChild();
+  LayoutObject* child = firstLetterLayoutObject->slowFirstChild();
+  CHECK(child && child->isText());
+  DCHECK_EQ(child, firstLetterLayoutObject->slowLastChild());
+  return child;
 }
 
 int caretMinOffset(const Node* node) {
   LayoutObject* layoutObject = associatedLayoutObjectOf(*node, 0);
   return layoutObject ? layoutObject->caretMinOffset() : 0;
 }
 
 int caretMaxOffset(const Node* n) {
   return EditingStrategy::caretMaxOffset(*n);
 }
@@ skipping 1204 matching lines @@
 
 VisiblePositionInFlatTree previousPositionOf(
     const VisiblePositionInFlatTree& visiblePosition,
     EditingBoundaryCrossingRule rule) {
   DCHECK(visiblePosition.isValid()) << visiblePosition;
   return previousPositionOfAlgorithm<EditingInFlatTreeStrategy>(
       visiblePosition.deepEquivalent(), rule);
 }
 
 }  // namespace blink