[FragmentItem] Fix missing NGInlineItem in RTL

r729656 <crrev.com/c/1774425> sets |NGInlineItem| for inline
boxes without |NGPhysicalBoxFragment|, but failed to do so
when bidi reordering moved placeholder.

This patch fixes to set |NGInlineItem| even for that case.

crrev.com/c/2016771 fails without this fix.

Bug: 982194
Change-Id: I755b359cc2a177e667ff3f655ac147472707d081
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2021565Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#735319}

third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc

@@ -607,8 +607,8 @@ void NGInlineLayoutStateStack::CreateBoxFragments(
 
       // |AddBoxFragmentPlaceholder| adds a placeholder at |fragment_start|, but
       // bidi reordering may move it. Insert in such case.
-      line_box->InsertChild(start, std::move(box_fragment),
-                            box_data.rect.offset, end - start + 1);
+      line_box->InsertChild(start, std::move(box_fragment), box_data.rect,
+                            end - start + 1);
       ChildInserted(start + 1);
       continue;
     }
@@ -624,7 +624,7 @@ void NGInlineLayoutStateStack::CreateBoxFragments(
 
     // |AddBoxFragmentPlaceholder| adds a placeholder at |fragment_start|, but
     // bidi reordering may move it. Insert in such case.
-    line_box->InsertChild(start, /*box_fragment*/ nullptr, box_data.rect.offset,
+    line_box->InsertChild(start, *box_data.item, box_data.rect,
                           end - start + 1);
     ChildInserted(start + 1);
   }

third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.h

@@ -106,10 +106,24 @@ class CORE_EXPORT NGLineBoxFragmentBuilder final
     // level.
     Child(LayoutUnit block_offset, LayoutUnit block_size)
         : rect(LayoutUnit(), block_offset, LayoutUnit(), block_size) {}
+    Child(const NGInlineItem& inline_item,
+          const LogicalRect& rect,
+          unsigned children_count)
+        : inline_item(&inline_item),
+          rect(rect),
+          children_count(children_count) {}
     // Crete a bidi control. A bidi control does not have a fragment, but has
     // bidi level and affects bidi reordering.
     Child(UBiDiLevel bidi_level) : bidi_level(bidi_level) {}
     // Create an in-flow |NGLayoutResult|.
+    Child(scoped_refptr<const NGLayoutResult> layout_result,
+          const LogicalRect& rect,
+          unsigned children_count,
+          UBiDiLevel bidi_level)
+        : layout_result(std::move(layout_result)),
+          rect(rect),
+          children_count(children_count),
+          bidi_level(bidi_level) {}
     Child(scoped_refptr<const NGLayoutResult> layout_result,
           LogicalOffset offset,
           LayoutUnit inline_size,
@@ -247,12 +261,18 @@ class CORE_EXPORT NGLineBoxFragmentBuilder final
     void InsertChild(unsigned index);
     void InsertChild(unsigned index,
                      scoped_refptr<const NGLayoutResult> layout_result,
-                     const LogicalOffset& offset,
+                     const LogicalRect& rect,
+                     unsigned children_count) {
+      WillInsertChild(index);
+      children_.insert(index, Child(std::move(layout_result), rect,
+                                    children_count, /* bidi_level */ 0));
+    }
+    void InsertChild(unsigned index,
+                     const NGInlineItem& inline_item,
+                     const LogicalRect& rect,
                      unsigned children_count) {
       WillInsertChild(index);
-      children_.insert(index, Child{std::move(layout_result), offset,
-                                    /* inline_size */ LayoutUnit(),
-                                    children_count, /* bidi_level */ 0});
+      children_.insert(index, Child(inline_item, rect, children_count));
     }
 
     void MoveInInlineDirection(LayoutUnit);