Fix the rightOf and below conditions for overlapping case.

Source/core/page/SpatialNavigation.cpp

 /*
  * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Antonio Gomes <tonikitoo@webkit.org>
  *
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
@@ skipping 230 matching lines @@
         return true;
     }
 }
 
 // Return true if rect |a| is below |b|. False otherwise.
 // For overlapping rects, |a| is considered to be below |b|
 // if both edges of |a| are below the respective ones of |b|
 static inline bool below(const LayoutRect& a, const LayoutRect& b)
 {
     return a.y() >= b.maxY()
-        || (a.y() >= b.y() && a.maxY() > b.maxY());
+        || (a.y() >= b.y() && a.maxY() > b.maxY() && a.x() < b.maxX() && a.maxX() > b.x());
 }
 
 // Return true if rect |a| is on the right of |b|. False otherwise.
 // For overlapping rects, |a| is considered to be on the right of |b|
 // if both edges of |a| are on the right of the respective ones of |b|
 static inline bool rightOf(const LayoutRect& a, const LayoutRect& b)
 {
     return a.x() >= b.maxX()
-        || (a.x() >= b.x() && a.maxX() > b.maxX());
+        || (a.x() >= b.x() && a.maxX() > b.maxX() && a.y() < b.maxY() && a.maxY() > b.y());
 }
 
 static bool isRectInDirection(FocusType type, const LayoutRect& curRect, const LayoutRect& targetRect)
 {
     switch (type) {
     case FocusTypeLeft:
         return rightOf(curRect, targetRect);
     case FocusTypeRight:
         return rightOf(targetRect, curRect);
     case FocusTypeUp:
@@ skipping 476 matching lines @@
     LayoutRect rect = virtualRectForDirection(type, rectToAbsoluteCoordinates(area.document().frame(), area.computeRect(area.imageElement()->renderer())), 1);
     return rect;
 }
 
 HTMLFrameOwnerElement* frameOwnerElement(FocusCandidate& candidate)
 {
     return candidate.isFrameOwnerElement() ? toHTMLFrameOwnerElement(candidate.visibleNode) : nullptr;
 };
 
 } // namespace blink