Make LayoutBlock::PositionForBox() not to crash on anonymous block

This patch changes |LayoutBlock::PositionForBox()| to return null
position if |LayoutBlock| is anonymous for avoiding call
|Position::FirstPositionInOrBeforeNode()| with null position.

Note: |LayoutBlock::PositionForBox()| is used only for legacy layout.

Note: I don't have the test case to reproduce because ClusterFuzz's
test case is too huge (large than 1MB) to reduce.

Bug: 1157993
Change-Id: Ief106d22bb6c29620182fbb9a4f5fe84919879c5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2626820
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#843404}

third_party/blink/renderer/core/layout/layout_block.cc

@@ -1339,6 +1339,8 @@ Position LayoutBlock::PositionForBox(InlineBox* box, bool start) const {
 
   Node* const node = box->GetLineLayoutItem().NonPseudoNode();
   if (!node) {
+    if (!NonPseudoNode())
+      return Position();
     if (start)
       return Position::FirstPositionInOrBeforeNode(*NonPseudoNode());
     return Position::LastPositionInOrAfterNode(*NonPseudoNode());