Fix use-after-move in blink/renderer/core/layout/ng/inline/

Fix use-after-move (potential) bugs found by the
"bugprone-use-after-move" clang-tidy check.

Bug: 1122844
Change-Id: I6f6fb791f00075cffdb791d8297289cbea383a4e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2401047Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Maksim Ivanov <emaxx@chromium.org>
Cr-Commit-Position: refs/heads/master@{#805771}

third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.cc

@@ -159,6 +159,7 @@ void NGFragmentItemsBuilder::AddItems(NGLogicalLineItem* child_begin,
       continue;
     }
 
+    const unsigned children_count = child.children_count;
     // Children of inline boxes are flattened and added to |items_|, with the
     // count of descendant items to preserve the tree structure.
     //
@@ -167,14 +168,14 @@ void NGFragmentItemsBuilder::AddItems(NGLogicalLineItem* child_begin,
     items_.emplace_back(child.rect.offset, std::move(child), writing_mode);
 
     // Add all children, including their desendants, skipping this item.
-    CHECK_GE(child.children_count, 1u);  // 0 will loop infinitely.
-    NGLogicalLineItem* end_child_iter = child_iter + child.children_count;
+    CHECK_GE(children_count, 1u);  // 0 will loop infinitely.
+    NGLogicalLineItem* end_child_iter = child_iter + children_count;
     CHECK_LE(end_child_iter - child_begin, child_end - child_begin);
     AddItems(child_iter + 1, end_child_iter);
     child_iter = end_child_iter;
 
     // All children are added. Compute how many items are actually added. The
-    // number of items added maybe different from |child.children_count|.
+    // number of items added may be different from |children_count|.
     const wtf_size_t item_count = items_.size() - box_start_index;
     NGFragmentItem& box_item = items_[box_start_index].item;
     DCHECK_EQ(box_item.DescendantsCount(), 1u);