[editing] Add test for null-deref in TextIteratorAlgorithm()

The change from bug 1002937 made this code trigger a null-deref in
TextIteratorAlgorithm::TextIteratorAlgorithm, or a DCHECK failure in
CompositeEditCommand::MoveParagraphs. It's fine now since it had to be
reverted because of bug 1161370, but adding test coverage will be useful
to avoid the problem when relanding the patch.

Bug: 1155687
Change-Id: I8d509653ae998288ba4889f3d99014501f4e7b18
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2632954Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Oriol Brufau <obrufau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#844502}

third_party/blink/renderer/core/editing/commands/replace_selection_command_test.cc

@@ -185,4 +185,25 @@ TEST_F(ReplaceSelectionCommandTest, SmartPlainTextPaste) {
             GetSelectionTextFromBody());
 }
 
+// http://crbug.com/1155687
+TEST_F(ReplaceSelectionCommandTest, TableAndImages) {
+  GetDocument().setDesignMode("on");
+  SetBodyContent("<table>&#x20;<tbody></tbody>&#x20;</table>");
+  Element* tbody = GetDocument().QuerySelector("tbody");
+  tbody->AppendChild(GetDocument().CreateRawElement(html_names::kImgTag));
+  Selection().SetSelection(
+      SelectionInDOMTree::Builder().Collapse(Position(tbody, 1)).Build(),
+      SetSelectionOptions());
+
+  DocumentFragment* fragment = GetDocument().createDocumentFragment();
+  fragment->AppendChild(GetDocument().CreateRawElement(html_names::kImgTag));
+  auto& command = *MakeGarbageCollected<ReplaceSelectionCommand>(
+      GetDocument(), fragment, ReplaceSelectionCommand::kPreventNesting,
+      InputEvent::InputType::kNone);
+
+  // Should not crash
+  EXPECT_TRUE(command.Apply());
+  EXPECT_EQ("<table> <tbody><img><img></tbody><br><img>|<br> </table>",
+            GetSelectionTextFromBody());
+}
 }  // namespace blink