The length of a TextIterator containing replaced element is at least 1

Source/core/editing/TextIterator.h

 /*
  * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 66 matching lines @@
 class TextIterator {
     STACK_ALLOCATED();
 public:
     explicit TextIterator(const Range*, TextIteratorBehaviorFlags = TextIteratorDefaultBehavior);
     // [start, end] indicates the document range that the iteration should take place within (both ends inclusive).
     TextIterator(const Position& start, const Position& end, TextIteratorBehaviorFlags = TextIteratorDefaultBehavior);
     ~TextIterator();
 
     bool atEnd() const { return !m_positionNode || m_shouldStop; }
     void advance();
+    bool isInsideReplacedElement() const;
 
     int length() const { return m_textLength; }
     UChar characterAt(unsigned index) const;
     String substring(unsigned position, unsigned length) const;
     void appendTextToStringBuilder(StringBuilder&, unsigned position = 0, unsigned maxLength = UINT_MAX) const;
 
     template<typename BufferType>
     void appendTextTo(BufferType& output, unsigned position = 0)
     {
         ASSERT_WITH_SECURITY_IMPLICATION(position <= static_cast<unsigned>(length()));
@@ skipping 270 matching lines @@
     Vector<UChar> m_buffer;
     // Did we have to look ahead in the textIterator to confirm the current chunk?
     bool m_didLookAhead;
     RefPtrWillBeMember<Range> m_range;
     TextIterator m_textIterator;
 };
 
 }
 
 #endif