The length of a TextIterator containing replaced element is at least 1

Source/core/editing/PlainTextRange.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 92 matching lines @@
     for (; !it.atEnd(); it.advance()) {
         int len = it.length();
         textRunRange = it.range();
 
         bool foundStart = start() >= docTextPosition && start() <= docTextPosition + len;
         bool foundEnd = end() >= docTextPosition && end() <= docTextPosition + len;
 
         // Fix textRunRange->endPosition(), but only if foundStart || foundEnd, because it is only
         // in those cases that textRunRange is used.
         if (foundEnd) {
-            // FIXME: This is a workaround for the fact that the end of a run is often at the wrong
-            // position for emitted '\n's.
-            if (len == 1 && it.characterAt(0) == '\n') {
+            // FIXME: This is a workaround for the fact that the end of a run
+            // is often at the wrong position for emitted '\n's or if the
+            // renderer of the current node is a replaced element.
+            if (len == 1 && (it.characterAt(0) == '\n' || it.isInsideReplacedElement())) {
                 scope.document().updateLayoutIgnorePendingStylesheets();
                 it.advance();
                 if (!it.atEnd()) {
                     RefPtrWillBeRawPtr<Range> range = it.range();
                     textRunRange->setEnd(range->startContainer(), range->startOffset(), ASSERT_NO_EXCEPTION);
                 } else {
                     Position runStart = textRunRange->startPosition();
                     Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
                     if (runEnd.isNotNull())
                         textRunRange->setEnd(runEnd.containerNode(), runEnd.computeOffsetInContainerNode(), ASSERT_NO_EXCEPTION);
@@ skipping 60 matching lines @@
     size_t start = TextIterator::rangeLength(testRange.get());
 
     testRange->setEnd(range.endContainer(), range.endOffset(), IGNORE_EXCEPTION);
     ASSERT(testRange->startContainer() == &scope);
     size_t end = TextIterator::rangeLength(testRange.get());
 
     return PlainTextRange(start, end);
 }
 
 }