[LayoutNG] Fix crash in LayoutNGListMarker::TextAlternative

This patch fixes LayoutNGListMarker::TextAlternative to not
to rely on it has LayoutText child. This can happen if the
list marker is an image marker (for bullet lists) or the
function was called before layout completes.

LayoutListMarker always computes from its list item. LayoutNG
took a shortcut because we store the result in its LayoutText
child, but cases where we don't store was missed.

AXLayoutObject::TextAlternative() calls this function.

Bug: 894691
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I6c13c6f00920702e17188858d15c674d38698dfb
Reviewed-on: https://chromium-review.googlesource.com/c/1277132
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: cathie chen <cathiechen@tencent.com>
Cr-Commit-Position: refs/heads/master@{#599327}

third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc

@@ -247,6 +247,12 @@ LayoutNGListItem::MarkerType LayoutNGListItem::MarkerText(
   return kStatic;
 }
 
+String LayoutNGListItem::MarkerTextWithSuffix() const {
+  StringBuilder text;
+  MarkerText(&text, kWithSuffix);
+  return text.ToString();
+}
+
 String LayoutNGListItem::MarkerTextWithoutSuffix() const {
   StringBuilder text;
   MarkerText(&text, kWithoutSuffix);

third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.h

@@ -19,6 +19,7 @@ class CORE_EXPORT LayoutNGListItem final : public LayoutNGBlockFlow {
   ListItemOrdinal& Ordinal() { return ordinal_; }
 
   int Value() const;
+  String MarkerTextWithSuffix() const;
   String MarkerTextWithoutSuffix() const;
 
   LayoutObject* Marker() const { return marker_; }

third_party/blink/renderer/core/layout/ng/list/layout_ng_list_marker.cc

@@ -66,7 +66,11 @@ LayoutObject* LayoutNGListMarker::SymbolMarkerLayoutText() const {
 }
 
 String LayoutNGListMarker::TextAlternative() const {
-  return ToLayoutText(FirstChild())->GetText();
+  // Compute from the list item, in the logical order even in RTL, reflecting
+  // speech order.
+  if (LayoutNGListItem* list_item = ListItem())
+    return list_item->MarkerTextWithSuffix();
+  return g_empty_string;
 }
 
 bool LayoutNGListMarker::NeedsOccupyWholeLine() const {