Propagate Range exceptions through InputEvent::Create.

When InputEvent's constructor is given StaticRange objects, converting
those objects to Range objects might throw an exception.  Currently in
those cases we have a DCHECK failure in DCHECK-enabled builds, and store
a default-initialized range (pointing to the Document) in non-DCHECK
builds.

This instead propagates those exceptions through the InputEvent
constructor.

It's not really clear what the spec requires since the spec isn't clear
about the processing model for this InputEvent constructor; in
particular the fact that we store these ranges as Range rather than
StaticRange is unclear in the spec.

This is a behavior change, but only for an obscure corner of the spec
(manually-initialized events) that didn't work correctly before.

The added test fails without the change (crashing in DCHECK-enabled
builds, and failing in non-DCHECK-enabled builds).

Fixed: 377955857
Change-Id: Ia74d2194d3da78853f2ac4862b78b074579f9d66
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6039813
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Siye Liu <siliu@microsoft.com>
Reviewed-by: Di Zhang <dizhangg@chromium.org>
Commit-Queue: David Baron <dbaron@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1393973}