[editing] Fix NextVisuallyDistinctCandidateAlgorithm

NextVisuallyDistinctCandidateAlgorithm used to iterate forwards and
return the first candidate whose MostForwardCaretPosition was different
than the MostForwardCaretPosition of the original position.

However, it could happen that the returned candidate and the original
position had the same MostBackwardCaretPosition, leading to crashes.

Therefore, this patch ensures that both the forward and backward caret
positions of the candidate are different. And for consistency, the same
is done for PreviousVisuallyDistinctCandidateAlgorithm, even though I
couldn't find a problematic case.

Bug: 1138054

TEST=VisibleUnitsTest.nextPositionOfTable

Change-Id: I1e97e42765d58f5db70fb79410c8e471582a9d4d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2501041
Commit-Queue: Oriol Brufau <obrufau@igalia.com>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#821711}

third_party/blink/renderer/core/editing/editing_utilities.cc

@@ -556,12 +556,15 @@ static PositionTemplate<Strategy> NextVisuallyDistinctCandidateAlgorithm(
   PositionIteratorAlgorithm<Strategy> p(position);
   const PositionTemplate<Strategy> downstream_start =
       MostForwardCaretPosition(position);
+  const PositionTemplate<Strategy> upstream_start =
+      MostBackwardCaretPosition(position);
 
   p.Increment();
   while (!p.AtEnd()) {
     PositionTemplate<Strategy> candidate = p.ComputePosition();
     if (IsVisuallyEquivalentCandidate(candidate) &&
-        MostForwardCaretPosition(candidate) != downstream_start)
+        MostForwardCaretPosition(candidate) != downstream_start &&
+        MostBackwardCaretPosition(candidate) != upstream_start)
       return candidate;
 
     p.Increment();
@@ -620,12 +623,15 @@ PositionTemplate<Strategy> PreviousVisuallyDistinctCandidateAlgorithm(
   PositionIteratorAlgorithm<Strategy> p(position);
   PositionTemplate<Strategy> downstream_start =
       MostForwardCaretPosition(position);
+  const PositionTemplate<Strategy> upstream_start =
+      MostBackwardCaretPosition(position);
 
   p.Decrement();
   while (!p.AtStart()) {
     PositionTemplate<Strategy> candidate = p.ComputePosition();
     if (IsVisuallyEquivalentCandidate(candidate) &&
-        MostForwardCaretPosition(candidate) != downstream_start)
+        MostForwardCaretPosition(candidate) != downstream_start &&
+        MostBackwardCaretPosition(candidate) != upstream_start)
       return candidate;
 
     p.Decrement();

third_party/blink/renderer/core/editing/visible_units_test.cc

@@ -578,6 +578,23 @@ TEST_F(VisibleUnitsTest, nextPositionOf) {
                 .DeepEquivalent());
 }
 
+TEST_F(VisibleUnitsTest, nextPositionOfTable) {
+  SetBodyContent("<table id='table'></table>");
+  Element* table = GetDocument().getElementById("table");
+  // Couldn't include the <br> in the HTML above since the parser would have
+  // messed up the structure in the DOM.
+  table->setInnerHTML("<br>", ASSERT_NO_EXCEPTION);
+  UpdateAllLifecyclePhasesForTest();
+
+  Position position(table, 0);
+  Position next =
+      NextPositionOf(CreateVisiblePosition(position)).DeepEquivalent();
+  EXPECT_NE(position, next);
+  EXPECT_NE(MostBackwardCaretPosition(position),
+            MostBackwardCaretPosition(next));
+  EXPECT_NE(MostForwardCaretPosition(position), MostForwardCaretPosition(next));
+}
+
 TEST_F(VisibleUnitsTest, previousPositionOf) {
   const char* body_content =
       "<b id=zero>0</b><p id=host><b id=one>1</b><b id=two>22</b></p><b "