Fix an edge case in FirstLetterPseudoElement::FirstLetterTextLayoutObject

FirstLetterPseudoElement::FirstLetterTextLayoutObject finds the
remaining text layout object by traversing in the subtree of the
block container and inspects the layout objects one by one.

There is one case where the code fails to move past the list marker
layout object when the list marker is wrapped in an anonymous block
flow, which is fixed by this patch.

Bug: 947422
Change-Id: I427ee77ae43be8464bddd9120b5c50f3c1dd84be
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1548381
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#646667}

third_party/blink/renderer/core/dom/first_letter_pseudo_element.cc

@@ -148,7 +148,8 @@ LayoutText* FirstLetterPseudoElement::FirstLetterTextLayoutObject(
     } else if (first_letter_text_layout_object->IsListMarker() ||
                first_letter_text_layout_object == marker) {
       first_letter_text_layout_object =
-          first_letter_text_layout_object->NextSibling();
+          first_letter_text_layout_object->NextInPreOrderAfterChildren(
+              parent_layout_object);
     } else if (first_letter_text_layout_object
                    ->IsFloatingOrOutOfFlowPositioned()) {
       if (first_letter_text_layout_object->Style()->StyleType() ==

third_party/blink/renderer/core/editing/element_inner_text_test.cc

@@ -47,4 +47,14 @@ TEST_P(ElementInnerTest, SVGElementAsTableRow) {
   EXPECT_EQ("abc", target.innerText());
 }
 
+// https://crbug.com/947422
+TEST_P(ElementInnerTest, OverflowingListItemWithFloatFirstLetter) {
+  InsertStyleElement(
+      "div { display: list-item; overflow: hidden; }"
+      "div::first-letter { float: right; }");
+  SetBodyContent("<div id=target>foo</div>");
+  Element& target = *GetDocument().getElementById("target");
+  EXPECT_EQ("foo", target.innerText());
+}
+
 }  // namespace blink