The length of a TextIterator containing replaced element is at least 1

Source/core/editing/TextIterator.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 338 matching lines @@
     m_pastEndNode = nextInPreOrderCrossingShadowBoundaries(endContainer, endOffset);
 
     // Identify the first run.
     advance();
 }
 
 TextIterator::~TextIterator()
 {
 }
 
+bool TextIterator::isInsideReplacedElement() const
+{
+    if (atEnd() || length() != 1 || !m_node)
+        return false;
+
+    RenderObject* renderer = m_node->renderer();
+    return renderer && renderer->isReplaced();
+}
+
 void TextIterator::advance()
 {
     if (m_shouldStop)
         return;
 
     // reset the run information
     m_positionNode = nullptr;
     m_textLength = 0;
 
     // handle remembered node that needed a newline after the text node's newline
@@ skipping 1832 matching lines @@
             resultEnd = collapseTo;
             return;
         }
     }
 
     CharacterIterator computeRangeIterator(inputStart, inputEnd, iteratorFlagsForFindPlainText);
     calculateCharacterSubrange(computeRangeIterator, matchStart, matchLength, resultStart, resultEnd);
 }
 
 }