Make NGInlineCursor::PositionForPointInInlineBox() to skip virtually culled inline boxes

This patch changes |NGInlineCursor::PositionForPointInInlineBox()| to skip
virtually "culled" inline boxes, used to be culled, to make mapping from hit
test point to DOM position work correctly.

This patch fixes following tests (at least):
 1. editing/selection/android-longtap-not-select-empty.html
 2. editing/selection/offset-from-point.html
 3. editing/selection/shift-click.html

Bug: 982194
Change-Id: I506ba863cc2ee760d78ff3fe1ef57a9dd2e577c0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2041150
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#738887}

third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.cc

@@ -755,6 +755,13 @@ PositionWithAffinity NGInlineCursor::PositionForPointInInlineBox(
   for (; descendants; descendants.MoveToNext()) {
     const NGFragmentItem* child_item = descendants.CurrentItem();
     DCHECK(child_item);
+    if (child_item->Type() == NGFragmentItem::kBox &&
+        !child_item->BoxFragment()) {
+      // Skip virtually "culled" inline box, e.g. <span>foo</span>
+      // "editing/selection/shift-click.html" reaches here.
+      DCHECK(child_item->GetLayoutObject()->IsLayoutInline()) << child_item;
+      continue;
+    }
     const LayoutUnit child_inline_offset =
         child_item->OffsetInContainerBlock()
             .ConvertToLogical(writing_mode, direction, container_size,
@@ -822,7 +829,10 @@ PositionWithAffinity NGInlineCursor::PositionForPointInChild(
           return child_item.GetLayoutObject()->PositionForPoint(
               point - child_item.OffsetInContainerBlock());
         }
+      } else {
+        // |LayoutInline| used to be culled.
       }
+      DCHECK(child_item.GetLayoutObject()->IsLayoutInline()) << child_item;
       break;
     case NGFragmentItem::kLine:
       NOTREACHED();