[FragmentItem] Paint floats in self-painting inline

This patch fixes painting floats in self-painting inline.

To support this, this changes |PaintFloatingItems| to use
|NGInlineCursor| to traverse descendants.

Bug: 982194
Change-Id: I234ec7f32f895add62fe782aef133705fa7a7e61
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2078379
Commit-Queue: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#745486}

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -592,9 +592,11 @@ void NGBoxFragmentPainter::PaintBlockChildren(const PaintInfo& paint_info) {
   }
 }
 
-void NGBoxFragmentPainter::PaintFloatingItems(const NGFragmentItems& items,
-                                              const PaintInfo& paint_info) {
-  for (const std::unique_ptr<NGFragmentItem>& item : items.Items()) {
+void NGBoxFragmentPainter::PaintFloatingItems(const PaintInfo& paint_info,
+                                              NGInlineCursor* cursor) {
+  for (; *cursor; cursor->MoveToNext()) {
+    const NGFragmentItem* item = cursor->Current().Item();
+    DCHECK(item);
     const NGPhysicalBoxFragment* child_fragment = item->BoxFragment();
     if (!child_fragment || child_fragment->HasSelfPaintingLayer() ||
         !child_fragment->IsFloating())
@@ -620,9 +622,18 @@ void NGBoxFragmentPainter::PaintFloatingChildren(
   if (const NGPhysicalBoxFragment* box =
           DynamicTo<NGPhysicalBoxFragment>(&container)) {
     if (const NGFragmentItems* items = box->Items()) {
-      PaintFloatingItems(*items, float_paint_info);
+      NGInlineCursor cursor(*items);
+      PaintFloatingItems(float_paint_info, &cursor);
+      return;
+    }
+    if (inline_box_cursor_) {
+      DCHECK(box->IsInlineBox());
+      NGInlineCursor descendants = inline_box_cursor_->CursorForDescendants();
+      PaintFloatingItems(float_paint_info, &descendants);
       return;
     }
+    DCHECK(!RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled() ||
+           !box->IsInlineBox());
   }
 
   for (const NGLink& child : container.Children()) {

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.h

@@ -151,7 +151,7 @@ class NGBoxFragmentPainter : public BoxPainterBase {
                     const NGInlineCursor& cursor,
                     const PaintInfo& paint_info,
                     const PhysicalOffset& paint_offset);
-  void PaintFloatingItems(const NGFragmentItems& items, const PaintInfo&);
+  void PaintFloatingItems(const PaintInfo&, NGInlineCursor* cursor);
   void PaintFloatingChildren(const NGPhysicalContainerFragment&,
                              const PaintInfo& paint_info,
                              const PaintInfo& float_paint_info);

third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item

@@ -48,7 +48,6 @@ crbug.com/982194 external/wpt/css/css-writing-modes/inline-table-alignment-003.x
 crbug.com/982194 external/wpt/css/css-writing-modes/inline-table-alignment-005.xht [ Failure ]
 crbug.com/982194 external/wpt/css/cssom-view/offsetTopLeft-trailing-space-inline.html [ Pass ]
 crbug.com/982194 external/wpt/css/csui/text-overflow-002.html [ Failure ]
-crbug.com/982194 external/wpt/css/filter-effects/filtered-inline-applies-to-float.html [ Failure ]
 crbug.com/982194 external/wpt/css/filter-effects/filtered-inline-is-container.html [ Failure ]
 crbug.com/846656 external/wpt/css/selectors/focus-visible-002-manual.html [ Pass ]
 crbug.com/982194 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/counter-styles-3/dependent-builtin.html [ Failure ]