How can I fix [civicrm.root] variable on an addon domain?
tl;dr: Uncomment and fill in the define('CIVICRM_CMSDIR', '/path/to/install/root/'); in civicrm.settings.php.

I traced through the functions that go toward building the URL for loadins crm.ckeditor.js.  It seems there's a problem with the logic of the WordPress cmsRootPath function.  

I can't tell you what the specific issue you're having that's causing that function to fail; I know it struggles with symlinks, and I'd guess there's other edge cases as well.

If I understand this line of code correctly, in addition to $civicrm_root, there's also a lesser-known cousin CIVICRM_CMSDIR, which is actually the relevant data here.  In my 4.7.22 WordPress instance's civicrm.settings.php, that constant is present but commented out.

See also: CRM-18221 for what appears to be a similar issue on earlier versions of Civi 4.7.