[LayoutNG] Only use box painter for box fragments

Add debug checks to NGBoxFragmentPainter ensuring it's only used for box
fragments, as the implementation assumes the NGPhysicalFragment supplied
to the NGBoxFragmentPainter constructor is a true NGPhysicalBoxFragment.

Fixing this uncovered another issue where InlinePainter assumes that all
LayoutNG formatting contexts are boxes, using NGInlineBoxFragmentPainter
to paint them. This mostly works as the fragment types are quite similar
but involves incorrect type casts and can potentially read uninitialized
memory with unpredictable results. This change updates the InlinePainter
Paint method to use the LayoutNG painter appropriate for every fragment.

Bug: 962004, 962338
Change-Id: I28e21544da423a21a2bb41a692052feace71d90f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1610092Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Auto-Submit: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#659685}

third_party/blink/renderer/core/paint/inline_painter.cc

@@ -6,9 +6,11 @@
 
 #include "third_party/blink/renderer/core/layout/layout_block_flow.h"
 #include "third_party/blink/renderer/core/layout/layout_inline.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.h"
 #include "third_party/blink/renderer/core/paint/line_box_list_painter.h"
 #include "third_party/blink/renderer/core/paint/ng/ng_inline_box_fragment_painter.h"
 #include "third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h"
+#include "third_party/blink/renderer/core/paint/ng/ng_text_fragment_painter.h"
 #include "third_party/blink/renderer/core/paint/object_painter.h"
 #include "third_party/blink/renderer/core/paint/paint_info.h"
 #include "third_party/blink/renderer/core/paint/paint_timing_detector.h"
@@ -36,10 +38,25 @@ void InlinePainter::Paint(const PaintInfo& paint_info) {
   if (layout_inline_.IsInLayoutNGInlineFormattingContext()) {
     for (const NGPaintFragment* fragment :
          NGPaintFragment::InlineFragmentsFor(&layout_inline_)) {
-      NGInlineBoxFragmentPainter(*fragment).Paint(
-          paint_info, paint_offset + (fragment->InlineOffsetToContainerBox() -
-                                      fragment->Offset())
-                                         .ToLayoutPoint());
+      auto child_offset =
+          paint_offset +
+          (fragment->InlineOffsetToContainerBox() - fragment->Offset())
+              .ToLayoutPoint();
+
+      if (fragment->PhysicalFragment().IsText()) {
+        const auto& text_fragment =
+            To<NGPhysicalTextFragment>(fragment->PhysicalFragment());
+        NodeHolder holder;
+        if (auto* node = text_fragment.GetNode()) {
+          if (node->GetLayoutObject()->IsText())
+            holder = ToLayoutText(node->GetLayoutObject())->EnsureNodeHolder();
+        }
+        NGTextFragmentPainter(*fragment).Paint(paint_info, child_offset,
+                                               holder);
+
+      } else {
+        NGInlineBoxFragmentPainter(*fragment).Paint(paint_info, child_offset);
+      }
     }
     return;
   }

third_party/blink/renderer/core/paint/ng/ng_inline_box_fragment_painter.cc

@@ -34,7 +34,12 @@ NGInlineBoxFragmentPainter::NGInlineBoxFragmentPainter(
           static_cast<const NGPhysicalBoxFragment&>(
               inline_box_fragment.PhysicalFragment())
               .BorderEdges(),
-          style.GetWritingMode())) {}
+          style.GetWritingMode())) {
+  DCHECK_EQ(inline_box_fragment.PhysicalFragment().Type(),
+            NGPhysicalFragment::NGFragmentType::kFragmentBox);
+  DCHECK_EQ(inline_box_fragment.PhysicalFragment().BoxType(),
+            NGPhysicalFragment::NGBoxType::kInlineBox);
+}
 
 NGInlineBoxFragmentPainter::NGInlineBoxFragmentPainter(
     const NGPaintFragment& inline_box_fragment)