[LayoutNG] Fix crash when painting decorations to br tags

BR tags and tabulation characters produce NGPhysicalTextFragment
without ShapeResult. This patch skips computing intercepts in such
cases. Whether they should or should not is still subject to
discuss though.

This fix alone doesn't fix any tests because then crashing tests
will crash in other DCHECK. fast/inline/br-text-decoration.html
should pass when combined with other fixes.

Bug: 636993, 714962
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I74687c7b2acc34c4889d2efac8c42b91b79cd3a3
Reviewed-on: https://chromium-review.googlesource.com/765622Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#515972}

third_party/WebKit/Source/core/paint/ng/ng_text_painter.cc

@@ -82,7 +82,7 @@ void NGTextPainter::PaintInternal(unsigned start_offset,
 void NGTextPainter::ClipDecorationsStripe(float upper,
                                           float stripe_width,
                                           float dilation) {
-  if (!fragment_.Length())
+  if (!fragment_.Length() || !fragment_.TextShapeResult())
     return;
 
   NGTextFragmentPaintInfo fragment_paint_info = fragment_.PaintInfo();