Add RELEASE_ASSERT to InlineTextBox::constructTextRun

This patch adds RELEASE_CHECK of offset and length to
InlineTextBox::constructTextRun(). StringView constructor only does
SECURITY_DCHECK intentionally, see http://crrev.com/2587863002.

BUG=671328

Review-Url: https://codereview.chromium.org/2588193003
Cr-Commit-Position: refs/heads/master@{#439721}

third_party/WebKit/Source/core/layout/line/InlineTextBox.cpp

@@ -616,6 +616,10 @@ TextRun InlineTextBox::constructTextRun(
   String string = getLineLayoutItem().text();
   unsigned startPos = start();
   unsigned length = len();
+  // Ensure |this| is in sync with the corresponding LayoutText. Checking here
+  // has less binary size/perf impact than in StringView().
+  RELEASE_ASSERT(startPos <= string.length() &&
+                 length <= string.length() - startPos);
   return constructTextRun(style, StringView(string, startPos, length),
                           getLineLayoutItem().textLength() - startPos,
                           charactersWithHyphen);