[LayoutNG] Skip hit-testing of culled inline children of columns.

The first idea was to allow |limit| in HitTestCulledInlineAncestors() to
be nullptr and just exit when we reach the first LayoutBox ancestor, but
that wasn't good enough, as that would still trigger DCHECK failures in
LayoutInline::HitTestCulledInline(), because neither
ContainingNGBlockFlow() nor NGInlineCursor work if the container is a
fragmentainer.

Therefore, just skip hit-testing of culled inlines that are contained by
a fragmentainer / column for now.

This is needed by CL:2134294

Bug: 829028, 1043787
Change-Id: I22348d69b5159de56614fe28ce5456b87643afe6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2170000Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#763556}

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -2205,6 +2205,12 @@ bool NGBoxFragmentPainter::HitTestItemsChildren(
         hit_test.action == kHitTestForeground) {
       // Hit test culled inline boxes between |fragment| and its parent
       // fragment.
+      if (container.IsColumnBox()) {
+        // TODO(crbug.com/829028): Currently skipping culled inline hit-testing
+        // if we're contained by a fragmentainer, as NGInlineCursor doesn't work
+        // correctly with those.
+        continue;
+      }
       const PhysicalOffset child_offset =
           hit_test.inline_root_offset + item->OffsetInContainerBlock();
       if (HitTestCulledInlineAncestors(*hit_test.result, container, children,