Avoid to crash in NGCaretPosition::ToPositionInDOMTreeWithAffinity()

This patch changes |NGCaretPosition::ToPositionInDOMTreeWithAffinity()|
to avoid crash regarding null |NGOffsetMapping|.

Note: This is speculative change because we don't have reproducible
test case yet.

Bug: 1145514
Change-Id: I8935175d721e6cc678efcb1f8c52d33275197143
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2519544
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#824330}

third_party/blink/renderer/core/layout/ng/inline/ng_caret_position.cc

@@ -357,6 +357,13 @@ PositionWithAffinity NGCaretPosition::ToPositionInDOMTreeWithAffinity() const {
       DCHECK(text_offset.has_value());
       const NGOffsetMapping* mapping =
           NGOffsetMapping::GetFor(cursor.Current().GetLayoutObject());
+      if (!mapping) {
+        // TODO(yosin): We're not sure why |mapping| is |nullptr|. It seems
+        // we are attempt to use destroyed/moved |NGFragmentItem|.
+        // See http://crbug.com/1145514
+        NOTREACHED() << cursor << " " << cursor.Current().GetLayoutObject();
+        return PositionWithAffinity();
+      }
       const TextAffinity affinity =
           *text_offset == cursor.Current().TextEndOffset()
               ? TextAffinity::kUpstreamIfPossible