Revert "Destroy paint fragment tree before destroying descendant layout objects"

This reverts commit 2a82d4ff.

Reason for revert:
This patch still causes the crash with the CL[1].

[1] [1] http://crrev.com/c/1123018 [CI] Cleanup paint invalidation flags


Original change's description:
> Destroy paint fragment tree before destroying descendant layout objects
> 
> This patch introduces |LayoutNGMixin::WillBeDestroyed()| and changes
> |LayoutBlockFlow::DeleteLineBoxTree()| to destroy paint fragment tree before
> destroying descendant layout objects to allow |NGPaintFragment| destructor can
> access its associated |LayoutObject|.
> 
> Before this patch, |NGAbstrctInlineTextBox::WillDestroy()|, which is called from
> |NGPaintFragment| destructor, uses dead |LayoutText| == |NGPaintFragment| lives
> longer than |LayoutText|.
> 
> After this patch, |LayoutText| lives longer than |NGPaintFragment|.
> 
> Bug: 874588
> Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
> Change-Id: Iade5c8a51a57da2e855a194caa098e90222a7804
> Reviewed-on: https://chromium-review.googlesource.com/1180828
> Reviewed-by: Koji Ishii <kojii@chromium.org>
> Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#584385}

TBR=yosin@chromium.org,kojii@chromium.org

Change-Id: I0fb21ceab9c1b30bbc9b2cc4d0081c04108a3db1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 874588
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Reviewed-on: https://chromium-review.googlesource.com/1180902Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#584390}

third_party/blink/renderer/core/layout/layout_block_flow.cc

@@ -2637,9 +2637,6 @@ void LayoutBlockFlow::DeleteLineBoxTree() {
   if (ContainsFloats())
     floating_objects_->ClearLineBoxTreePointers();
 
-  if (!RuntimeEnabledFeatures::LayoutNGEnabled())
-    SetPaintFragment(nullptr, nullptr);
-
   line_boxes_.DeleteLineBoxTree();
 }
 

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc

@@ -329,15 +329,6 @@ void LayoutNGMixin<Base>::UpdatePaintFragmentFromCachedLayoutResult(
   paint_fragment->UpdatePhysicalFragmentFromCachedLayoutResult(fragment);
 }
 
-template <typename Base>
-void LayoutNGMixin<Base>::WillBeDestroyed() {
-  // We should destroy paint fragment tree before destroying descendant layout
-  // objects to allow paint fragment destructor to use associated layout
-  // objects, e.g. NGAbstractInlineTextBox.
-  paint_fragment_.reset();
-  Base::WillBeDestroyed();
-}
-
 template <typename Base>
 void LayoutNGMixin<Base>::InvalidateDisplayItemClients(
     PaintInvalidationReason invalidation_reason) const {

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h

@@ -80,7 +80,6 @@ class LayoutNGMixin : public Base {
   bool IsOfType(LayoutObject::LayoutObjectType) const override;
 
   void AddOverflowFromChildren() override;
-  void WillBeDestroyed() override;
 
  private:
   void AddScrollingOverflowFromChildren();