[FragmentItem] Propagate out-of-flow objects

This patch propagates out-of-flow objects when FragmentItem
is enabled.

Out-of-flow objects need a different propagation up to their
containing block. This patch makes sure out-of-flow objects
in inline formatting context are handled the same way.

Because objects in inline formatting context are no longer
full |NGPhysicalFragment|, this patch splits |AddChild| to
the logic we need to do for all new child, and to actually
add to the child list, so that objects in inline formatting
context can call the former part.

Regresses ~30 tests by revealing hidden failrues or turning
crashes into failures, but fixes ~1300.

It is very likely that we need more tweaks for how to handle
them with FragmentItem, I will invesigate other failures in
following patches.

Bug: 982194
Change-Id: I89523efe68e0558916cb47f6c0216dca2d2327b5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1899229
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#713344}

third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc

@@ -975,7 +975,7 @@ scoped_refptr<const NGLayoutResult> NGInlineLayoutAlgorithm::Layout() {
 
   if (NGFragmentItemsBuilder* items_builder = context_->ItemsBuilder()) {
     DCHECK(RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled());
-    container_builder_.AddOutOfFlowChildren(line_box_);
+    container_builder_.PropagateChildrenData(line_box_);
     scoped_refptr<const NGLayoutResult> layout_result =
         container_builder_.ToLineBoxFragment();
     if (items_builder->TextContent(false).IsNull())

third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.cc

@@ -108,9 +108,12 @@ void NGLineBoxFragmentBuilder::AddChildren(ChildList& children) {
   }
 }
 
-void NGLineBoxFragmentBuilder::AddOutOfFlowChildren(ChildList& children) {
+void NGLineBoxFragmentBuilder::PropagateChildrenData(ChildList& children) {
   for (auto& child : children) {
-    if (child.out_of_flow_positioned_box) {
+    if (child.layout_result) {
+      DCHECK(!child.fragment);
+      PropagateChildData(child.layout_result->PhysicalFragment(), child.offset);
+    } else if (child.out_of_flow_positioned_box) {
       AddOutOfFlowChildCandidate(
           NGBlockNode(ToLayoutBox(child.out_of_flow_positioned_box)),
           child.offset, child.container_direction);

third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.h

@@ -253,10 +253,10 @@ class CORE_EXPORT NGLineBoxFragmentBuilder final
   // Add all items in ChildList. Skips null Child if any.
   void AddChildren(ChildList&);
 
-  // Add only out-of-flow items in ChildList. TODO(kojii): When |NGFragmentItem|
-  // is on, all objects should go to |NGFragmentItems| but OOF still uses
-  // fragments to propagate while in transition.
-  void AddOutOfFlowChildren(ChildList&);
+  // Propagate data in |ChildList| without adding them to this builder. When
+  // adding children as fragment items, they appear in the container, but there
+  // are some data that should be propagated through line box fragments.
+  void PropagateChildrenData(ChildList&);
 
   // Creates the fragment. Can only be called once.
   scoped_refptr<const NGLayoutResult> ToLineBoxFragment();

third_party/blink/renderer/core/layout/ng/ng_block_node.cc

@@ -312,6 +312,9 @@ scoped_refptr<const NGLayoutResult> NGBlockNode::Layout(
   // TODO(crbug.com/992953): Add a simplified layout pass for custom layout.
   if (cache_status == NGLayoutCacheStatus::kNeedsSimplifiedLayout &&
       block_flow && !GetFlowThread(block_flow) &&
+      // TODO(kojii): Enable simplified layout for fragment items.
+      !(block_flow->ChildrenInline() &&
+        RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled()) &&
       !block_flow->IsLayoutNGCustom()) {
     // A child may have changed size while performing "simplified" layout (it
     // may have gained or removed scrollbars, changing its size). In these

third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.cc

@@ -28,6 +28,16 @@ void NGContainerFragmentBuilder::AddChild(
     const NGPhysicalContainerFragment& child,
     const LogicalOffset& child_offset,
     const LayoutInline* inline_container) {
+  PropagateChildData(child, child_offset, inline_container);
+  AddChildInternal(&child, child_offset);
+}
+
+// Propagate data in |child| to this fragment. The |child| will then be added as
+// a child fragment or a child fragment item.
+void NGContainerFragmentBuilder::PropagateChildData(
+    const NGPhysicalContainerFragment& child,
+    const LogicalOffset& child_offset,
+    const LayoutInline* inline_container) {
   // Collect the child's out of flow descendants.
   // child_offset is offset of inline_start/block_start vertex.
   // Candidates need offset of top/left vertex.
@@ -138,8 +148,6 @@ void NGContainerFragmentBuilder::AddChild(
       }
     }
   }
-
-  AddChildInternal(&child, child_offset);
 }
 
 void NGContainerFragmentBuilder::AddChildInternal(

third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.h

@@ -193,6 +193,10 @@ class CORE_EXPORT NGContainerFragmentBuilder : public NGFragmentBuilder {
     layout_object_ = node.GetLayoutBox();
   }
 
+  void PropagateChildData(const NGPhysicalContainerFragment& child,
+                          const LogicalOffset& child_offset,
+                          const LayoutInline* inline_container = nullptr);
+
   void AddChildInternal(scoped_refptr<const NGPhysicalFragment>,
                         const LogicalOffset&);