Root cause:

Hit testing on culled inlines is implemented in InlineFlowBox::NodeAtPoint:
1) Whenever the hit test request misses a child InlineBox, we examine if there is any culled inlines between the child and |this|
2) If such a culled inline exists, and it is not an ancestor of any unexamined InlineBox, then we perform hit testing on the culled inline

The legacy code assumes that the InlineBoxes of the same culled inline are consecutive in each line, and performs step 2) by checking only the previous sibling of the child. It fails when the previous sibling is under a different LayoutObject, but there are some other preceeding siblings that are under the same culled inline.