[LayoutNG] Call AssociatedNode() instead of GetOwner() on possibly pseudo NGOffsetMappingUnits

Since we have now supported CSS-generated contents in |NGOffsetMapping|,
we should make sure an |NGOffsetMappingUnit| is not CSS-generated before
calling |GetOwner()|, otherwise we should use |AssociatedNode()|
instead.

This patch converts too calls of |GetOwner()| into |AssociatedNode()| so
that we don't hit the DCHECK in |GetOwner()|.

Bug: 967106
Change-Id: I62c362d93ba0608d0e6bcdd74c0d27fe0ffa7554
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1632900
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#663983}

third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping.cc

@@ -422,7 +422,7 @@ Position NGOffsetMapping::StartOfNextNonCollapsedContent(
   const auto node_and_offset = ToNodeOffsetPair(position);
   const Node& node = node_and_offset.first;
   const unsigned offset = node_and_offset.second;
-  while (unit != units_.end() && unit->GetOwner() == node) {
+  while (unit != units_.end() && unit->AssociatedNode() == node) {
     if (unit->DOMEnd() > offset &&
         unit->GetType() != NGOffsetMappingUnitType::kCollapsed) {
       const unsigned result = std::max(offset, unit->DOMStart());
@@ -443,7 +443,7 @@ Position NGOffsetMapping::EndOfLastNonCollapsedContent(
   const auto node_and_offset = ToNodeOffsetPair(position);
   const Node& node = node_and_offset.first;
   const unsigned offset = node_and_offset.second;
-  while (unit->GetOwner() == node) {
+  while (unit->AssociatedNode() == node) {
     if (unit->DOMStart() < offset &&
         unit->GetType() != NGOffsetMappingUnitType::kCollapsed) {
       const unsigned result = std::min(offset, unit->DOMEnd());

third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping_test.cc

@@ -1268,6 +1268,41 @@ TEST_F(NGOffsetMappingTest, TextOverflowEllipsis) {
   TEST_RANGE(mapping.GetRanges(), text, 0u, 1u);
 }
 
+// https://crbug.com/967106
+TEST_F(NGOffsetMappingTest, StartOfNextNonCollapsedContentWithPseudo) {
+  // The white spaces are necessary for bug repro. Do not remove them.
+  SetupHtml("t", R"HTML(
+    <style>span#quote::before { content: '"'}</style>
+    <div id=t>
+      <span>foo </span>
+      <span id=quote>bar</span>
+    </div>)HTML");
+
+  const Element* quote = GetElementById("quote");
+  const Node* text = quote->previousSibling();
+  const Position position = Position::FirstPositionInNode(*text);
+
+  EXPECT_EQ(Position(),
+            GetOffsetMapping().StartOfNextNonCollapsedContent(position));
+}
+
+// https://crbug.com/967106
+TEST_F(NGOffsetMappingTest, EndOfLastNonCollapsedContentWithPseudo) {
+  // The white spaces are necessary for bug repro. Do not remove them.
+  SetupHtml("t", R"HTML(
+    <style>span#quote::after { content: '" '}</style>
+    <div id=t>
+      <span id=quote>foo</span>
+      <span>bar</span>
+    </div>)HTML");
+
+  const Element* quote = GetElementById("quote");
+  const Node* text = quote->nextSibling();
+  const Position position = Position::LastPositionInNode(*text);
+
+  EXPECT_EQ(Position(),
+            GetOffsetMapping().EndOfLastNonCollapsedContent(position));
+}
 // Test |GetOffsetMapping| which is available both for LayoutNG and for legacy.
 class NGOffsetMappingGetterTest : public RenderingTest,
                                   public testing::WithParamInterface<bool>,