Make NGAbstractInlineText::GetOrCreate() to take only NGPaintFragment

This patch changes to |NGAbstractInlineText::GetOrCreate()| to take only
|NGPaintFragment| to avoid to create |NGAbstractInlineText| having
|NGPaintFragment| not to associated to |line_layout_item_| member variable.

These invalid |NGAbstractInlineText| causes crash by referring destructed
|LayoutObject| in |NGAbstractInlineText::Detach()|.

This crash can be happend in following scenario:

1. Create |NGAbstractInlineText| by |LayoutText::FirstAbstractInlineText()|
with layout object L1 and fragment F1_1 then get A1(L1, F1)
2. Create |NGAbstractInlineText::NextOnLine()| with L1 and F2 then get
A2(L1, F2) where F2 is associated to L2.
3. Destroy L1 then call Detach() for A1(L1, F1) => no problem
4. Destroy L2 then call Detach() for A2(L1, F2) => crash since L1 is destroyed

Bug: 928925
Change-Id: Ic0a55b4e15723e1988d0727aba45723aed4d3a4b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1525257
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#641109}
3 files changed