Check that first-letter text is not null before attaching.

Under certain combinations of whitespace-reattachment after removing
nodes, parent element being display:contents triggering anonymous
inline boxes for such parents, and ::first-letter being marked for re-
attachment, we can end up with a calculated first-letter text node
changing from non-null to null between style recalc and layout tree
rebuild. Make sure we check that the first-letter text node is still
non-null early in UpdateFirstLetterPseudoElement during the
kRebuildLayoutTree so that we nuke the first-letter pseudo instead of
re-attaching without first-letter text.

Bug: 908253
Change-Id: Ifaac75b34edce21467581b5a9e78f5287a842fe5
Reviewed-on: https://chromium-review.googlesource.com/c/1356714
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/master@{#613076}

third_party/blink/renderer/core/dom/element.cc

@@ -3958,13 +3958,6 @@ void Element::UpdateFirstLetterPseudoElement(StyleUpdatePhase phase) {
     return;
   }
 
-  if (phase == StyleUpdatePhase::kRebuildLayoutTree &&
-      element->NeedsReattachLayoutTree()) {
-    // We were already updated in RecalcStyle and ready for reattach.
-    DCHECK(element->GetNonAttachedStyle());
-    return;
-  }
-
   if (!CanGeneratePseudoElement(kPseudoIdFirstLetter)) {
     GetElementRareData()->SetPseudoElement(kPseudoIdFirstLetter, nullptr);
     return;
@@ -3978,6 +3971,13 @@ void Element::UpdateFirstLetterPseudoElement(StyleUpdatePhase phase) {
     return;
   }
 
+  if (phase == StyleUpdatePhase::kRebuildLayoutTree &&
+      element->NeedsReattachLayoutTree()) {
+    // We were already updated in RecalcStyle and ready for reattach.
+    DCHECK(element->GetNonAttachedStyle());
+    return;
+  }
+
   bool text_node_changed =
       remaining_text_layout_object !=
       ToFirstLetterPseudoElement(element)->RemainingTextLayoutObject();