[LayoutNG] Handle ellipsis for empty vertical-rl

Fix bug in NGLineTruncator::TruncateChild where it incorrectly assumes a
fragment always has content. This isn't always the case, especially when
obscure -webkit features are used. This change adds an extra null check.

Not using a WPT test as the test case replies on impl specific behavior.

Bug: 962297, 962471
Change-Id: I87ac7841a93303802aa2028e0ee04aaa9ab0961d
Test: web_tests/fast/text/empty-ellipsis-vertical-rl-crash.html
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1612224
Commit-Queue: Emil A Eklund <eae@chromium.org>
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#659740}
3 files changed