[FragmentItem] Invalidate paint layers when destroying |FragmentItem]s

This patch invalidates |LayoutBlockFlow| when inline
|DisplayItemClient|s (i.e., |FragmentItem|s) will be destroyed.

Currently, we invalidate |NGPaintFragment| for the root of
the inline formatting context. With [FragmentItem], the
containing |LayoutBlockFlow| is the |DisplayItemClient| for
the root box, regardless whether it has inline children or not.

Fixes ~70 crashes (DCHECK failures in paint_controller.cc).

Bug: 982194
Change-Id: If3bfaad632b0cd3d2dc7bd3fce23b5bd99aa2b1f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1943079Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#720372}

third_party/blink/renderer/core/layout/layout_box.cc

@@ -2376,10 +2376,23 @@ void LayoutBox::SetCachedLayoutResult(const NGLayoutResult& layout_result,
   if (layout_result.PhysicalFragment().BreakToken())
     return;
 
+  ClearCachedLayoutResult();
   cached_layout_result_ = &layout_result;
 }
 
 void LayoutBox::ClearCachedLayoutResult() {
+  if (!cached_layout_result_)
+    return;
+
+  // Invalidate if inline |DisplayItemClient|s will be destroyed.
+  if (const auto* box_fragment = DynamicTo<NGPhysicalBoxFragment>(
+          &cached_layout_result_->PhysicalFragment())) {
+    if (box_fragment->HasItems()) {
+      DCHECK_EQ(this, box_fragment->GetLayoutObject());
+      ObjectPaintInvalidator(*this).SlowSetPaintingLayerNeedsRepaint();
+    }
+  }
+
   cached_layout_result_ = nullptr;
 }