Workaround for bug in NGInlineOffsetMappingBuilder whereby it does not assign...

Workaround for bug in NGInlineOffsetMappingBuilder whereby it does not assign mapping units to empty LayoutText objects

When using legacy layout, NGInlineOffsetMappingBuilder computes the text offset mappings fon demand
and caches them in the layout object's rare data.
However, due to a bug in that computation, empty LayoutText objects
are not given a corresponding OffsetMappingUnit in the list of offset mappings
causing a crash.

This workaround ignores such objects for now, returning the
best possible value, until NGInlineOffsetMappingBuilder is fixed to handle this situation.

AX-Relnotes: n/a.

R=dmazzoni@chromium.org, aleventhal@chromium.org

Bug: 1149171
Change-Id: I7a59f924cf94d0b40ca47cbe2be402b3fe68addd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2578098
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#834612}

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -3080,6 +3080,14 @@ int AXNodeObject::TextOffsetInFormattingContext(int offset) const {
     return AXObject::TextOffsetInFormattingContext(offset);
   }
 
+  // TODO(crbug.com/1149171): NGInlineOffsetMappingBuilder does not properly
+  // compute offset mappings for empty LayoutText objects. Other text objects
+  // (such as some list markers) are not affected.
+  if (const LayoutText* layout_text = DynamicTo<LayoutText>(layout_obj)) {
+    if (layout_text->GetText().IsEmpty())
+      return AXObject::TextOffsetInFormattingContext(offset);
+  }
+
   LayoutBlockFlow* formatting_context =
       NGOffsetMapping::GetInlineFormattingContextOf(*layout_obj);
   if (!formatting_context || formatting_context == layout_obj)

third_party/blink/renderer/modules/accessibility/ax_position.cc

@@ -441,6 +441,14 @@ int AXPosition::MaxTextOffset() const {
   if (!is_atomic_inline_level && !layout_object->IsText())
     return container_object_->ComputedName().length();
 
+  // TODO(crbug.com/1149171): NGInlineOffsetMappingBuilder does not properly
+  // compute offset mappings for empty LayoutText objects. Other text objects
+  // (such as some list markers) are not affected.
+  if (const LayoutText* layout_text = DynamicTo<LayoutText>(layout_object)) {
+    if (layout_text->GetText().IsEmpty())
+      return container_object_->ComputedName().length();
+  }
+
   LayoutBlockFlow* formatting_context =
       NGOffsetMapping::GetInlineFormattingContextOf(*layout_object);
   const NGOffsetMapping* container_offset_mapping =