[LayoutNG] Remove children before NGPaintFragmnet is destructed

This patch changes NGPaintFragment to remove children before
it is destructed.

Because NGPaintFragment keeps its children as a linked list,
the destructor will deref its first child and next sibling,
which will call their destructors recursively.

This patch removes children first to avoid stack overflow
when there are many children.

Bug: 901105
Change-Id: I0bbb5745468926178ce0132208d4c07f56839cf4
Reviewed-on: https://chromium-review.googlesource.com/c/1314020
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#605189}

third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc

@@ -176,7 +176,20 @@ NGPaintFragment::NGPaintFragment(
   DCHECK(physical_fragment_);
 }
 
-NGPaintFragment::~NGPaintFragment() = default;
+NGPaintFragment::~NGPaintFragment() {
+  // The default destructor will deref |first_child_|, but because children are
+  // in a linked-list, it will call this destructor recursively. Remove children
+  // first non-recursively to avoid stack overflow when there are many chlidren.
+  RemoveChildren();
+}
+
+void NGPaintFragment::RemoveChildren() {
+  scoped_refptr<NGPaintFragment> child = std::move(first_child_);
+  DCHECK(!first_child_);
+  while (child) {
+    child = std::move(child->next_sibling_);
+  }
+}
 
 template <typename Traverse>
 NGPaintFragment& NGPaintFragment::List<Traverse>::front() const {

third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h

@@ -310,6 +310,8 @@ class CORE_EXPORT NGPaintFragment : public RefCounted<NGPaintFragment>,
       LayoutObject*,
       HashMap<const LayoutObject*, NGPaintFragment*>* last_fragment_map);
 
+  void RemoveChildren();
+
   // Helps for PositionForPoint() when |this| falls in different categories.
   PositionWithAffinity PositionForPointInText(const NGPhysicalOffset&) const;
   PositionWithAffinity PositionForPointInInlineFormattingContext(