Fix regression that ComputeInlineBoxPosition no longer enters inline blocks

Previous CL crrev.com/c/775550 was supposed to be pure refactoring, but
changed behavior that ComputeInlineBoxPosition no longer enters inline
blocks, because the CL moved the branch handling atomic inlines above the
branch that moves input position into inline blocks.

This patch fixes the regression by moving the branches back to their old
positions.

Bug: 856417
Change-Id: I94a22259f723af11b701d3a1078e68b5729bb0d0
Reviewed-on: https://chromium-review.googlesource.com/1116357Reviewed-by: Yoichi Osato <yoichio@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#570791}

third_party/blink/renderer/core/editing/BUILD.gn

@@ -393,6 +393,7 @@ jumbo_source_set("unit_tests") {
     "selection_controller_test.cc",
     "selection_modifier_character_test.cc",
     "selection_modifier_test.cc",
+    "selection_modifier_word_test.cc",
     "selection_template_test.cc",
     "serializers/styled_markup_serializer_test.cc",
     "set_selection_options_test.cc",

third_party/blink/renderer/core/editing/inline_box_position.cc

@@ -227,18 +227,19 @@ PositionWithAffinityTemplate<Strategy> ComputeInlineAdjustedPositionAlgorithm(
   if (layout_object.IsText())
     return position;
 
-  if (layout_object.IsAtomicInlineLevel()) {
-    // TODO(crbug.com/567964): Change the following branch to DCHECK once fixed.
-    if (!layout_object.IsInline())
-      return PositionWithAffinityTemplate<Strategy>();
-    return position;
+  // We perform block flow adjustment first, so that we can move into an inline
+  // block when needed instead of stopping at its boundary as if it is a
+  // replaced element.
+  if (layout_object.IsLayoutBlockFlow() &&
+      CanHaveChildrenForEditing(position.AnchorNode()) &&
+      HasRenderedNonAnonymousDescendantsWithHeight(&layout_object)) {
+    return AdjustBlockFlowPositionToInline(position.GetPosition());
   }
 
-  if (!layout_object.IsLayoutBlockFlow() ||
-      !CanHaveChildrenForEditing(position.AnchorNode()) ||
-      !HasRenderedNonAnonymousDescendantsWithHeight(&layout_object))
+  // TODO(crbug.com/567964): Change the second operand to DCHECK once fixed.
+  if (!layout_object.IsAtomicInlineLevel() || !layout_object.IsInline())
     return PositionWithAffinityTemplate<Strategy>();
-  return AdjustBlockFlowPositionToInline(position.GetPosition());
+  return position;
 }
 
 // Returns true if |layout_object| and |offset| points after line end.

third_party/blink/renderer/core/editing/selection_modifier_word_test.cc

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/editing/selection_modifier.h"
+
+#include "third_party/blink/renderer/core/editing/testing/editing_test_base.h"
+
+namespace blink {
+
+class SelectionModifierWordTest : public EditingTestBase {};
+
+// Regression test for crbug.com/856417
+TEST_F(SelectionModifierWordTest, MoveIntoInlineBlockWithBidiNoHang) {
+  const SelectionInDOMTree selection = SetSelectionTextToBody(
+      "<div contenteditable>"
+      "<span>&#x05D0;|&#x05D1;&#x05D2;</span>"
+      "<span style=\"display: inline-block\">foo</span>"
+      "</div>");
+  SelectionModifier modifier(GetFrame(), selection);
+  modifier.Modify(SelectionModifyAlteration::kMove,
+                  SelectionModifyDirection::kRight, TextGranularity::kWord);
+  // Shouldn't hang here.
+  EXPECT_EQ(
+      "<div contenteditable>"
+      "<span>\xD7\x90\xD7\x91\xD7\x92</span>"
+      "<span style=\"display: inline-block\">foo|</span>"
+      "</div>",
+      GetSelectionTextFromBody(modifier.Selection().AsSelection()));
+}
+
+}  // namespace blink