Destroy paint fragment tree before destroying descendant layout objects

This patch introduces |LayoutNGMixin::WillBeDestroyed()| and changes
|LayoutBlockFlow::DeleteLineBoxTree()| to destroy paint fragment tree before
destroying descendant layout objects to allow |NGPaintFragment| destructor can
access its associated |LayoutObject|.

Before this patch, |NGAbstrctInlineTextBox::WillDestroy()|, which is called from
|NGPaintFragment| destructor, uses dead |LayoutText| == |NGPaintFragment| lives
longer than |LayoutText|.

After this patch, |LayoutText| lives longer than |NGPaintFragment|.

Bug: 874588
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: Iade5c8a51a57da2e855a194caa098e90222a7804
Reviewed-on: https://chromium-review.googlesource.com/1180828Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#584385}

third_party/blink/renderer/core/layout/layout_block_flow.cc

@@ -2637,6 +2637,9 @@ void LayoutBlockFlow::DeleteLineBoxTree() {
   if (ContainsFloats())
     floating_objects_->ClearLineBoxTreePointers();
 
+  if (!RuntimeEnabledFeatures::LayoutNGEnabled())
+    SetPaintFragment(nullptr, nullptr);
+
   line_boxes_.DeleteLineBoxTree();
 }
 

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc

@@ -329,6 +329,15 @@ void LayoutNGMixin<Base>::UpdatePaintFragmentFromCachedLayoutResult(
   paint_fragment->UpdatePhysicalFragmentFromCachedLayoutResult(fragment);
 }
 
+template <typename Base>
+void LayoutNGMixin<Base>::WillBeDestroyed() {
+  // We should destroy paint fragment tree before destroying descendant layout
+  // objects to allow paint fragment destructor to use associated layout
+  // objects, e.g. NGAbstractInlineTextBox.
+  paint_fragment_.reset();
+  Base::WillBeDestroyed();
+}
+
 template <typename Base>
 void LayoutNGMixin<Base>::InvalidateDisplayItemClients(
     PaintInvalidationReason invalidation_reason) const {

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h

@@ -80,6 +80,7 @@ class LayoutNGMixin : public Base {
   bool IsOfType(LayoutObject::LayoutObjectType) const override;
 
   void AddOverflowFromChildren() override;
+  void WillBeDestroyed() override;
 
  private:
   void AddScrollingOverflowFromChildren();