Fix ComputeInlineBoxPosition crash when after BR and next line has no leaf child

ComputeInlineBoxPosition() handles after-BR positions by looking into
the first leaf child of the next line, which crashes if the next line
has no leaf child.

This patch changes the function to iteratively check the succeeding
lines until we find a line with leaf child, to stop the crash and make
the behavior saner.

Bug: 835779
Change-Id: Iafd04aaf467a8e53c92cb0d36ab291ff3627e67e
Reviewed-on: https://chromium-review.googlesource.com/1024799Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#552999}

third_party/blink/renderer/core/editing/inline_box_position.cc

@@ -458,14 +458,17 @@ InlineBoxPosition NextLinePositionOf(
   if (!last)
     return InlineBoxPosition();
   const RootInlineBox& root = last->Root();
-  const RootInlineBox* const next_root = root.NextRootBox();
-  if (!next_root)
-    return InlineBoxPosition();
-  InlineBox* const inline_box = next_root->FirstLeafChild();
-  auto ans = AdjustInlineBoxPositionForTextDirection(
-      inline_box, inline_box->CaretMinOffset(),
-      layout_text.Style()->GetUnicodeBidi());
-  return ans;
+  for (const RootInlineBox* runner = root.NextRootBox(); runner;
+       runner = runner->NextRootBox()) {
+    InlineBox* const inline_box = runner->FirstLeafChild();
+    if (!inline_box)
+      continue;
+
+    return AdjustInlineBoxPositionForTextDirection(
+        inline_box, inline_box->CaretMinOffset(),
+        layout_text.Style()->GetUnicodeBidi());
+  }
+  return InlineBoxPosition();
 }
 
 template <typename Strategy>

third_party/blink/renderer/core/editing/local_caret_rect_test.cc

@@ -920,4 +920,24 @@ TEST_P(ParameterizedLocalCaretRectTest,
   EXPECT_EQ(LayoutRect(0, 0, 1, 10), caret_rect);
 }
 
+// http://crbug.com/835779
+TEST_P(ParameterizedLocalCaretRectTest, NextLineWithoutLeafChild) {
+  LoadAhem();
+  InsertStyleElement("div { font: 10px/10px Ahem; width: 30px }");
+  SetBodyContent(
+      "<div>"
+      "<br>"
+      "<span style=\"border-left: 50px solid\"></span>"
+      "foo"
+      "</div>");
+
+  const Element& br = *GetDocument().QuerySelector("br");
+  EXPECT_EQ(
+      // TODO(xiaochengh): Should return the same result for legacy and
+      // LayoutNG.
+      LayoutNGEnabled() ? LayoutRect(50, 10, 1, 10) : LayoutRect(0, 20, 1, 10),
+      LocalCaretRectOfPosition(PositionWithAffinity(Position::AfterNode(br)))
+          .rect);
+}
+
 }  // namespace blink