Fix a crash with AXPosition and images in CSS content

Images in CSS content are not anonymous blocks, but they are anonymous.
This means that LayoutObject::GetNode returns null for them. We should
handle this case.

Bug: 1003047
Change-Id: I091c8890c67e85b1326d67e7f046ce5ac94d437e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1804482
Auto-Submit: Martin Robinson <mrobinson@igalia.com>
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#697348}

third_party/blink/renderer/modules/accessibility/ax_layout_object.cc

@@ -297,7 +297,7 @@ Node* AXLayoutObject::GetNodeOrContainingBlockNode() const {
     return nullptr;
   }
 
-  if (layout_object_->IsAnonymousBlock() && layout_object_->ContainingBlock()) {
+  if (layout_object_->IsAnonymous() && layout_object_->ContainingBlock()) {
     return layout_object_->ContainingBlock()->GetNode();
   }
 

third_party/blink/renderer/modules/accessibility/ax_layout_object.h

@@ -56,7 +56,7 @@ class MODULES_EXPORT AXLayoutObject : public AXNodeObject {
   ax::mojom::Role DetermineAccessibilityRole() override;
   ax::mojom::Role NativeRoleIgnoringAria() const override;
 
-  // If this is an anonymous block, returns the node of its containing layout
+  // If this is an anonymous node, returns the node of its containing layout
   // block, otherwise returns the node of this layout object.
   Node* GetNodeOrContainingBlockNode() const;
 

third_party/blink/renderer/modules/accessibility/ax_position_test.cc

@@ -1236,6 +1236,36 @@ TEST_F(AccessibilityTest, PositionInCSSContent) {
   EXPECT_EQ(12, position_after.GetPosition().OffsetInContainerNode());
 }
 
+TEST_F(AccessibilityTest, PositionInCSSImageContent) {
+  constexpr char css_content_no_text[] = R"HTML(
+   <style>
+   .heading::before {
+    content: url(data:image/gif;base64,);
+   }
+   </style>
+   <h1 id="heading" class="heading">Heading</h1>)HTML";
+  SetBodyInnerHTML(css_content_no_text);
+
+  const Node* heading = GetElementById("heading");
+  ASSERT_NE(nullptr, heading);
+
+  const AXObject* ax_heading = GetAXObjectByElementId("heading");
+  ASSERT_NE(nullptr, ax_heading);
+  ASSERT_EQ(ax::mojom::Role::kHeading, ax_heading->RoleValue());
+  ASSERT_EQ(2, ax_heading->ChildCount());
+
+  const AXObject* ax_css_before = ax_heading->FirstChild();
+  ASSERT_NE(nullptr, ax_css_before);
+  ASSERT_EQ(ax::mojom::Role::kImage, ax_css_before->RoleValue());
+
+  const auto ax_position_before =
+      AXPosition::CreateFirstPositionInObject(*ax_css_before);
+  const auto position = ax_position_before.ToPositionWithAffinity(
+      AXPositionAdjustmentBehavior::kMoveLeft);
+  EXPECT_EQ(GetDocument().body(), position.AnchorNode());
+  EXPECT_EQ(3, position.GetPosition().OffsetInContainerNode());
+}
+
 TEST_F(AccessibilityTest, PositionInTableWithCSSContent) {
   SetBodyInnerHTML(kHTMLTable);