Make ShapeResult::CountGraphemesInCluster() not to crash with empty string

This patch changes |ShapeResult::CountGraphemesInCluster()| not to crash
when specified substring is empty by avoiding null reference of
|CursorMovementIterator|.

Note: This is a speculative patch because I could not reproduce locally.
ClusterFuzz will check whether this patch is effective or not.

Bug: 1071423
Change-Id: I6807ead3cb05f11d2ff663de8f5675aee524b5a8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2402467
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#805664}

third_party/blink/renderer/platform/fonts/shaping/shape_result.cc

@@ -756,6 +756,8 @@ unsigned ShapeResult::CountGraphemesInCluster(base::span<const UChar> str,
   uint16_t length = end_index - start_index;
   TextBreakIterator* cursor_pos_iterator =
       CursorMovementIterator(str.subspan(start_index, length));
+  if (!cursor_pos_iterator)
+    return 0;
 
   int cursor_pos = cursor_pos_iterator->current();
   int num_graphemes = -1;