[FragmentItem] Skip destroyed objects in RecalcInkOverflowForCursor

When computing ink overflow against dirty tree, r784297
crrev.com/c/2275373 fixed to skip if corresponding
|LayoutObject| was destroyed or moved.

This patch adds another check of this, this time in
|RecalcInkOverflowForCursor|, because without it,
|HasSelfPaintingLayer| will crash.

Bug: 1101079
Change-Id: Ia7abb284dd52b467b492e81da5523d0546d7a61b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2275926Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#784339}

third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item.cc

@@ -454,6 +454,14 @@ PhysicalRect NGFragmentItem::RecalcInkOverflowForCursor(
   while (*cursor) {
     const NGFragmentItem* item = cursor->CurrentItem();
     DCHECK(item);
+    if (UNLIKELY(item->IsLayoutObjectDestroyedOrMoved())) {
+      // TODO(crbug.com/1099613): This should not happen, as long as it is
+      // layout-clean. It looks like there are cases where the layout is dirty.
+      NOTREACHED();
+      cursor->MoveToNextSkippingChildren();
+      continue;
+    }
+
     PhysicalRect child_rect;
     item->GetMutableForPainting().RecalcInkOverflow(cursor, &child_rect);
     if (item->HasSelfPaintingLayer())