[LayoutNG] Fix physical offset calculation in LayoutNGMixin::NodeAtPoint()

In LayoutNGMixin::NodeAtPoint(), parameter |accumulated_offset|
satisfies that, |accumulated_offset + Location()| equals the physical
offset of the current LayoutBox in the paint layer, regardless of
writing mode or whether the box was placed by NG or legacy.

This patches fixes the physical offset calculation utilizing the
above invariant. It also renames variable |adjusted_location| into
|physical_offset| to be more accurate.

Bug: 855279
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I73311ad17c56cf1f300e627966904fac3430a5d9
Reviewed-on: https://chromium-review.googlesource.com/1117881
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#571608}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -545,7 +545,6 @@ crbug.com/591099 fast/doctypes/004.html [ Failure ]
 crbug.com/591099 fast/dom/HTMLAreaElement/area-download.html [ Failure ]
 crbug.com/714962 fast/dom/Range/getBoundingClientRect-linebreak-character.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-lookup-precedence.html [ Failure ]
-crbug.com/714962 fast/dom/elementFromPoint-relative-to-viewport.html [ Failure ]
 crbug.com/591099 fast/dom/nodesFromRect/nodesFromRect-basic.html [ Failure ]
 crbug.com/591099 fast/dynamic/first-letter-after-list-marker.html [ Failure ]
 crbug.com/591099 fast/dynamic/text-combine.html [ Failure ]

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc

@@ -326,27 +326,28 @@ bool LayoutNGMixin<Base>::NodeAtPoint(
     return LayoutBlockFlow::NodeAtPoint(result, location_in_container,
                                         accumulated_offset, action);
   }
-  LayoutPoint offset = PaintFragment()->PhysicalFragment().IsPlacedByLayoutNG()
-                           ? PaintFragment()->Offset().ToLayoutPoint()
-                           : Base::Location();
-  LayoutPoint adjusted_location = accumulated_offset + offset;
+  // In LayoutBox::NodeAtPoint() and subclass overrides, it is guaranteed that
+  // |accumulated_offset + Location()| equals the physical offset of the current
+  // LayoutBox in the paint layer, regardless of writing mode or whether the box
+  // was placed by NG or legacy.
+  const LayoutPoint physical_offset = accumulated_offset + Base::Location();
   if (!RootScrollerUtil::IsEffective(*this)) {
     // Check if we need to do anything at all.
     // If we have clipping, then we can't have any spillout.
     LayoutRect overflow_box = Base::HasOverflowClip()
                                   ? Base::BorderBoxRect()
                                   : Base::VisualOverflowRect();
-    overflow_box.MoveBy(adjusted_location);
+    overflow_box.MoveBy(physical_offset);
     if (!location_in_container.Intersects(overflow_box))
       return false;
   }
   if (Base::IsInSelfHitTestingPhase(action) && Base::HasOverflowClip() &&
       Base::HitTestOverflowControl(result, location_in_container,
-                                   adjusted_location))
+                                   physical_offset))
     return true;
 
   return NGBlockFlowPainter(*this).NodeAtPoint(result, location_in_container,
-                                               adjusted_location, action);
+                                               physical_offset, action);
 }
 
 template <typename Base>