[LayoutNG] Handle empty FragmentRange in PaintBackgroundBorderShadow

Update NGInlineBoxFragmentPainter::PaintBackgroundBorderShadow to safely
handle cases where the FragmentRange is empty. This shouldn't happen but
assuming the layout object has a single fragment in those cases is safe.

Bug: 916948
Change-Id: I2e57b468a6d5137f843a61dbd9a02de117af3c20
Reviewed-on: https://chromium-review.googlesource.com/c/1396323Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#620010}

third_party/blink/renderer/core/paint/ng/ng_inline_box_fragment_painter.cc

@@ -82,7 +82,12 @@ void NGInlineBoxFragmentPainter::PaintBackgroundBorderShadow(
       inline_box_fragment_.InlineFragmentsFor(
           inline_box_fragment_.GetLayoutObject());
   NGPaintFragment::FragmentRange::iterator iter = fragments.begin();
-  bool object_has_multiple_boxes = ++iter != fragments.end();
+  // TODO(layout-dev): We shouldn't get here if there are no fragments for the
+  // layout object but in some cases that appears to happen. Likely when the
+  // object isn't a LayoutNGInlineFormattingContext.
+  DCHECK(iter != fragments.end());
+  bool object_has_multiple_boxes =
+      iter != fragments.end() && ++iter != fragments.end();
 
   // TODO(eae): Switch to LayoutNG version of BackgroundImageGeometry.
   BackgroundImageGeometry geometry(*static_cast<const LayoutBoxModelObject*>(