[LayoutNG] Let it crash if HandleText does not move forward

One suspect for issue 896456 is where ShapingLineBreaker
fails to move offset forward. If this occurs, NGLineBreaker
is likely to keep adding NGInlineItemResult of zero-length
until all the memory is consumed.

This patch turns DCHECK to CHECK to see if it is happening.

Change-Id: I8a7355ec32e823e7ab517d2a3754c2fcc2104b3a
Bug: 896456
Reviewed-on: https://chromium-review.googlesource.com/c/1304182Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#603647}

third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc

@@ -447,7 +447,9 @@ void NGLineBreaker::BreakText(NGInlineItemResult* item_result,
   item_result->inline_size = shape_result->SnappedWidth().ClampNegativeToZero();
   item_result->end_offset = result.break_offset;
   item_result->shape_result = std::move(shape_result);
-  DCHECK_GT(item_result->end_offset, item_result->start_offset);
+  // It is critical to move offset forward, or NGLineBreaker may keep adding
+  // NGInlineItemResult until all the memory is consumed.
+  CHECK_GT(item_result->end_offset, item_result->start_offset) << Text();
 
   // * If width <= available_width:
   //   * If offset < item.EndOffset(): the break opportunity to fit is found.