[FragmentItem] Add dirty-tree guard to AddOutlineRects

Similar to what r784356 crrev.com/c/2275281 did to
|ScrollableOverflow|, this patch adds dirty-tree guard to
|AddOutlineRects|. This is another operation that walks
though post-layout fragment tree.

We already use |PostLayoutChildren| since r662988
<crrev.com/c/1624010>, but skipping |NGFragmentItem| was
not done yet. This patch adds this.

Bug: 1101086
Change-Id: Iac9ef846a03ea6e2a9fbd6aad196b13e14991e87
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2299320
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#788554}

third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc

@@ -104,6 +104,8 @@ void NGPhysicalContainerFragment::AddOutlineRectsForNormalChildren(
       for (NGInlineCursor cursor(*items); cursor; cursor.MoveToNext()) {
         DCHECK(cursor.Current().Item());
         const NGFragmentItem& item = *cursor.Current().Item();
+        if (UNLIKELY(item.IsLayoutObjectDestroyedOrMoved()))
+          continue;
         if (item.Type() == NGFragmentItem::kLine) {
           AddOutlineRectsForDescendant(
               {item.LineBoxFragment(), item.OffsetInContainerBlock()},
@@ -256,6 +258,7 @@ void NGPhysicalContainerFragment::AddOutlineRectsForDescendant(
     const PhysicalOffset& additional_offset,
     NGOutlineType outline_type,
     const LayoutBoxModelObject* containing_block) const {
+  DCHECK(!descendant->IsLayoutObjectDestroyedOrMoved());
   if (descendant->IsText() || descendant->IsListMarker())
     return;