[css-counters] Fix DCHECK failure in counter node manipulation.

We are failing a DCHECK where we assumed that reset nodes cannot have
non-reset nodes as their next sibling (i.e. a reset node cannot be
followed by a non-reset node on the same level). We were using this
assumption when we wanted to reparent all non-reset nodes and we stopped
at the first reset node.

However, this assumption seems to be wrong as we are hitting this DCHECK
on ClusterFuzz. This patch speculatively fixes this issue by not
stopping at the first reset node.

This is a speculative fix.

Bug: 822217
Change-Id: I83679c51d82d28c7bd1ace92b27cc7910b9c9db4
Reviewed-on: https://chromium-review.googlesource.com/981334
Commit-Queue: Darren Shen <shend@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#546035}

third_party/WebKit/Source/core/layout/CounterNode.cpp

@@ -368,20 +368,15 @@ void CounterNode::MoveNonResetSiblingsToChildOf(
 
   scoped_refptr<CounterNode> cur_node = first_node;
   scoped_refptr<CounterNode> old_parent = first_node->Parent();
-  while (cur_node && !cur_node->ActsAsReset()) {
+  while (cur_node) {
     scoped_refptr<CounterNode> next = cur_node->NextSibling();
-    old_parent->RemoveChild(cur_node.get());
-    new_parent.InsertAfter(cur_node.get(), new_parent.LastChild(), identifier);
+    if (!cur_node->ActsAsReset()) {
+      old_parent->RemoveChild(cur_node.get());
+      new_parent.InsertAfter(cur_node.get(), new_parent.LastChild(),
+                             identifier);
+    }
     cur_node = next;
   }
-
-  // We assume that a reset node cannot have a non-reset node as its next
-  // sibling, but we're not sure this is always true, so we add a DCHECK to be
-  // safe.
-  while (cur_node) {
-    DCHECK(cur_node->ActsAsReset());
-    cur_node = cur_node->NextSibling();
-  }
 }
 
 #ifndef NDEBUG