[LayoutNG] Reset associated paint fragment list in LayoutObject::InsertedIntoTree()

This is a speculative fix for bug http://crbug.com/924449 to avoid using
destroyed paint fragment in |NGPaintFragment::LastForSameLayoutObject()| by
changing |LayoutObject::InsertedIntoTree()| to reset moved child layout object's
assocated paint fragment list.

From this patch, we reset associated fragment list for both fast and slow path
in |LayoutObjectChildList::InsertChildNode()|.

Bug: 924449
Change-Id: Iea1142ba5b91fb43a3c6a06e9bc3f45d03330e57
Reviewed-on: https://chromium-review.googlesource.com/c/1454164
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#629099}

third_party/blink/renderer/core/layout/layout_object.cc

@@ -3267,6 +3267,12 @@ void LayoutObject::InsertedIntoTree() {
       layer->DirtyVisibleContentStatus();
   }
 
+  if (IsInLayoutNGInlineFormattingContext()) {
+    // In case of |this| layout object is moved, to avoid paint fragments in old
+    // tree live longer than |this|, we reset associated paint fragment list.
+    SetFirstInlineFragment(nullptr);
+  }
+
   if (Parent()->ChildrenInline())
     Parent()->DirtyLinesFromChangedChild(this);