[LayoutNG] Stop innerText from crashing in production build for missing layout

|Element.innerText| is a hot code path called on every page by
by TranslateHelper. However, there are some cases where we fail to
layout certain blocks, and hence their NGOffsetMapping can't be
computed.

As the root cause is hard to fix, this patch works around it by making
|innerText| emit empty strings on the failed blocks so that we don't
crash in this hot code path.

Bug: 967995, 955678
Change-Id: Idd8f5dbaea71d49fc70fc4a6202755d90b17b676
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1636669
Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#664553}

third_party/blink/renderer/core/editing/element_inner_text.cc

@@ -253,6 +253,15 @@ void ElementInnerTextCollector::ProcessLayoutText(const LayoutText& layout_text,
   }
 
   const NGOffsetMapping* const mapping = GetOffsetMapping(layout_text);
+  if (!mapping) {
+    // TODO(crbug.com/967995): There are certain cases where we fail to compute
+    // |NGOffsetMapping| due to failures in layout. As the root cause is hard to
+    // fix at the moment, we work around it here so that the production build
+    // doesn't crash.
+    NOTREACHED() << layout_text;
+    return;
+  }
+
   const NGMappingUnitRange range = mapping->GetMappingUnitsForNode(text_node);
   for (const NGOffsetMappingUnit& unit : range) {
     result_.EmitText(