[FragmentItem] Use PostLayoutChildren to compute ink overflow

This patch changes |RecalcFloatingDescendantsVisualOverflow|
to use |PostLayoutChildren| when traversing fragment tree,
to avoid reading stale |NGPhysicalFragment|.

This patch is speculative.

Bug: 965639, 1095577
Change-Id: I86d8f054832f921d91bb8949f3aa956e940de7e4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2249281Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#779382}

third_party/blink/renderer/core/layout/layout_block_flow.cc

@@ -4549,7 +4549,7 @@ void LayoutBlockFlow::RecalcFloatingDescendantsVisualOverflow(
     const NGPhysicalContainerFragment& fragment) {
   DCHECK(fragment.HasFloatingDescendantsForPaint());
 
-  for (const NGLink& child : fragment.Children()) {
+  for (const NGLink& child : fragment.PostLayoutChildren()) {
     if (child->IsFloating()) {
       child->GetMutableLayoutObject()
           ->RecalcNormalFlowChildVisualOverflowIfNeeded();