[LayoutNG] Fix NextOnLineInternalNG

Both this and PreviousOnLineInlineNG had the same typo, but
PreviousOnLineInlineNG was fixed in r659579
(http://crrev.com/c/1608867).

Unlike http://crrev.com/c/1608867, unfortunately this does
not seem to have a test coverage.

Change-Id: I707884c83e9c5bf711def37ceee888a294409e41
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1739235
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Alice Boxhall <aboxhall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#685207}

third_party/blink/renderer/modules/accessibility/ax_layout_object.cc

@@ -1250,7 +1250,7 @@ static AXObject* NextOnLineInternalNG(const AXObject& ax_object) {
   DCHECK(!layout_object.IsListMarkerIncludingNG()) << layout_object;
   DCHECK(ShouldUseLayoutNG(layout_object)) << layout_object;
   const auto fragments = NGPaintFragment::InlineFragmentsFor(&layout_object);
-  if (fragments.IsEmpty() || fragments.IsInLayoutNGInlineFormattingContext())
+  if (fragments.IsEmpty() || !fragments.IsInLayoutNGInlineFormattingContext())
     return nullptr;
   for (NGPaintFragmentTraversalContext runner =
            NGPaintFragmentTraversal::NextInlineLeafOf(

third_party/blink/renderer/modules/accessibility/ax_object_test.cc

@@ -12,6 +12,20 @@
 namespace blink {
 namespace test {
 
+class AccessibilityLayoutTest : public testing::WithParamInterface<bool>,
+                                private ScopedLayoutNGForTest,
+                                public AccessibilityTest {
+ public:
+  AccessibilityLayoutTest() : ScopedLayoutNGForTest(GetParam()) {}
+
+ protected:
+  bool LayoutNGEnabled() const { return GetParam(); }
+};
+
+INSTANTIATE_TEST_SUITE_P(AccessibilityTest,
+                         AccessibilityLayoutTest,
+                         testing::Bool());
+
 TEST_F(AccessibilityTest, IsDescendantOf) {
   SetBodyInnerHTML(R"HTML(<button id="button">button</button>)HTML");
 
@@ -296,5 +310,27 @@ TEST_F(AccessibilityTest, AxNodeObjectContainsInPageLinkTarget) {
   EXPECT_EQ(anchor->Url(), KURL("http://test.com/#target"));
 }
 
+TEST_P(AccessibilityLayoutTest, NextOnLine) {
+  SetBodyInnerHTML(R"HTML(
+    <style>
+    html {
+      font-size: 10px;
+    }
+    /* TODO(kojii): |NextOnLine| doesn't work for culled-inline.
+       Ensure spans are not culled to avoid hitting the case. */
+    span {
+      background: gray;
+    }
+    </style>
+    <div><span id="span1">a</span><span>b</span></div>
+  )HTML");
+  const AXObject* span1 = GetAXObjectByElementId("span1");
+  ASSERT_NE(nullptr, span1);
+
+  const AXObject* next = span1->NextOnLine();
+  ASSERT_NE(nullptr, next);
+  EXPECT_EQ("b", next->GetNode()->textContent());
+}
+
 }  // namespace test
 }  // namespace blink