Make LayoutInline::HitTestCulledInline() faster

This patch makes |LayoutInline::HitTestCulledInline()| faster by using container
(<span>, line box, etc. instead of LayoutBlockFlow) rooted cursor instead of
containing block cursor to limit number of fragments to scan.

This is follow-up the CL[1] which changed |LayoutInline::HitTestCulledInline()|
to use containing block rooted cursor.

Here is elapsed time of hit tests with 2922 culled inline <span>'s in sample
file attach in http://crbug.com/1008523
 - Legacy:       7,772ms
 - Before this: 79,5556ms
 - After this:   2,068ms
So, this patch makes hit test on culled inline <span> 38 times.


[1] http://crrev.com/c/1862534: Make LayoutInline to utilize NGInlineCursor

Bug: 1008523
Change-Id: I93633b965fd305f81438981a236369376b151775
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1903768
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#713736}

third_party/blink/renderer/core/layout/layout_inline.cc

@@ -1070,14 +1070,9 @@ bool LayoutInline::HitTestCulledInline(
         *ContainingNGBlockFlow()->PaintFragment()));
     DCHECK(container_fragment->PhysicalFragment().IsInline() ||
            container_fragment->PhysicalFragment().IsLineBox());
-    NGInlineCursor cursor;
-    cursor.MoveTo(*this);
-    for (; cursor; cursor.MoveToNextForSameLayoutObject()) {
-      if (!cursor.CurrentPaintFragment()->IsDescendantOfNotSelf(
-              *container_fragment))
-        continue;
+    NGInlineCursor cursor(*container_fragment);
+    for (cursor.MoveTo(*this); cursor; cursor.MoveToNextForSameLayoutObject())
       yield(cursor.CurrentRect());
-    }
   } else {
     DCHECK(!ContainingNGBlockFlow());
     CollectCulledLineBoxRects(yield);