Clear offset mapping cache in LayoutSVGText::UpdateLayout()

This patch makes |LayoutSVGText::UpdateLayout()| to clear offset mapping cache
if needed rather than in |LayoutBlockFlow::UpdateBlockLayout()|[1] to fix
heap-use-after-free in |NGOffsetMapping|.

Unlike other derived classes of |LayoutBlockFlow|,
|LayoutSVGBlock::UpdateLayout()| doesn't call |UpdateBlockLayout()|, then
|LayoutSVGBlock| holds stale offset mapping cache.

[1] http://crrev.com/c/1488479 Make LayoutBlockFlowRareData to hold
NGOffsetMapping for legacy layout

Bug: 951218
Change-Id: Iacaa72a426cfcf9cd71495cf2c1ed6a0c6511ed9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1574987
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#652503}