Make NGInlineCursor::GetLayoutBlockFlow() to work with line scoped cursor

This patch changes |NGInlineCursor::GetLayoutBlockFlow()| to work with line
scoped cursor for preparation of the patch[1].

Before this patch, |NGPaintFragment| version of |GetLayoutBlockFlow()| crashes
when root paint fragment is line box, because we can't use |NGPhysicalFragment::
GetLayoutObject()| returns null for |NGPhysicalLineBoxFragment|.

[1] http://crrev.com/c/1888242 Utilize NGInlineCursor for inline box traversal

Bug: 982194
Change-Id: I427627de885469712f3d526fccf297d4e94d6fe7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1896478
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#711999}

third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.cc

@@ -107,7 +107,13 @@ bool NGInlineCursor::operator==(const NGInlineCursor& other) const {
 const LayoutBlockFlow* NGInlineCursor::GetLayoutBlockFlow() const {
   if (IsPaintFragmentCursor()) {
     // |root_paint_fragment_| is either |LayoutBlockFlow| or |LayoutInline|.
-    const LayoutObject* layout_object = root_paint_fragment_->GetLayoutObject();
+    const NGPhysicalFragment& physical_fragment =
+        root_paint_fragment_->PhysicalFragment();
+    const LayoutObject* layout_object =
+        physical_fragment.IsLineBox()
+            ? To<NGPhysicalLineBoxFragment>(physical_fragment)
+                  .ContainerLayoutObject()
+            : physical_fragment.GetLayoutObject();
     if (const LayoutBlockFlow* block_flow =
             DynamicTo<LayoutBlockFlow>(layout_object))
       return block_flow;

third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor_test.cc

@@ -66,6 +66,13 @@ INSTANTIATE_TEST_SUITE_P(NGInlineCursorTest,
                          NGInlineCursorTest,
                          testing::Bool());
 
+TEST_P(NGInlineCursorTest, GetLayoutBlockFlowWithScopedCursor) {
+  NGInlineCursor line = SetupCursor("<div id=root>line1<br>line2</div>");
+  ASSERT_TRUE(line.IsLineBox()) << line;
+  NGInlineCursor cursor = line.CursorForDescendants();
+  EXPECT_EQ(line.GetLayoutBlockFlow(), cursor.GetLayoutBlockFlow());
+}
+
 TEST_P(NGInlineCursorTest, ContainingLine) {
   // TDOO(yosin): Remove <style> once NGFragmentItem don't do culled inline.
   InsertStyleElement("a, b { background: gray; }");