Use PostLayout() fragment in HitTestResult::GetPosition().

We may re-layout between hit-testing and calculating PositionForPoint(),
which may mean that the fragment stored in HitTestResult is from an
older fragment tree generation.

Fixes the following browser test when LayoutNGFullPositionForPoint is
enabled:
  PasswordAutofillAgentTest.NoRefillOfUserInput

And the following web tests:
  fast/css-generated-content/pseudo-triple-click.html
  fast/dom/MutationObserver/end-of-task-delivery.html
  fast/forms/search/search-hide-cancel-on-cancel.html
  fast/forms/text/input-text-self-emptying-click.html

Bug: 1150362
Change-Id: I2717702da635613edb5dea4191a1dffa3cea8422
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2552865
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#830980}

third_party/blink/renderer/core/layout/hit_test_result.cc

@@ -181,9 +181,13 @@ PositionWithAffinity HitTestResult::GetPosition() const {
     return PositionWithAffinity(
         MostForwardCaretPosition(Position::FirstPositionInNode(*inner_node_)));
   }
+  // TODO(crbug.com/1152696): We have to use PostLayout() here, but maybe it
+  // should rather be illegal to call GetPosition() on a HitTestResult after
+  // relayout?
   if (box_fragment_ &&
-      RuntimeEnabledFeatures::LayoutNGFullPositionForPointEnabled())
-    return box_fragment_->PositionForPoint(LocalPoint());
+      RuntimeEnabledFeatures::LayoutNGFullPositionForPointEnabled() &&
+      !box_fragment_->IsLayoutObjectDestroyedOrMoved())
+    return box_fragment_->PostLayout()->PositionForPoint(LocalPoint());
   return layout_object->PositionForPoint(LocalPoint());
 }