[LayoutNG] Prevent breaks from escaping the containing fragmentation context.

The call sites that call NGFragmentBuilder::AddChild() also need to explicitly
propagate breaks to their container, if that's what they want. The column
layout algoirithm *doesn't* want this.

Bug: 757767
Change-Id: I203c045fc85a65303dfe4c0cdad20eb60e64fba2
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_layout_ng
Reviewed-on: https://chromium-review.googlesource.com/663859
Commit-Queue: Morten Stenshorne <mstensho@opera.com>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501444}

third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc

@@ -118,9 +118,11 @@ void PositionPendingFloats(
 
   // TODO(ikilpatrick): Add DCHECK that any positioned floats are children.
 
-  for (const auto& positioned_float : positioned_floats)
+  for (const auto& positioned_float : positioned_floats) {
     container_builder->AddChild(positioned_float.layout_result,
                                 positioned_float.logical_offset);
+    container_builder->PropagateBreak(positioned_float.layout_result);
+  }
 
   unpositioned_floats->clear();
 }
@@ -693,6 +695,7 @@ bool NGBlockLayoutAlgorithm::HandleInflow(
                             border_scrollbar_padding_.InlineSum());
 
   container_builder_.AddChild(layout_result, logical_offset);
+  container_builder_.PropagateBreak(layout_result);
 
   *previous_inflow_position =
       ComputeInflowPosition(*previous_inflow_position, child, child_data,

third_party/WebKit/Source/core/layout/ng/ng_fragment_builder.cc

@@ -72,11 +72,8 @@ NGFragmentBuilder& NGFragmentBuilder::AddChild(
     const NGLogicalOffset& child_offset) {
   switch (child->Type()) {
     case NGPhysicalBoxFragment::kFragmentBox:
-      // Update if we have fragmented in this flow.
-      if (child->BreakToken()) {
-        did_break_ |= !child->BreakToken()->IsFinished();
+      if (child->BreakToken())
         child_break_tokens_.push_back(child->BreakToken());
-      }
       break;
     case NGPhysicalBoxFragment::kFragmentLineBox:
       // NGInlineNode produces multiple line boxes in an anonymous box. Only
@@ -100,6 +97,22 @@ NGFragmentBuilder& NGFragmentBuilder::AddChild(
   return *this;
 }
 
+NGFragmentBuilder& NGFragmentBuilder::PropagateBreak(
+    RefPtr<NGLayoutResult> child_layout_result) {
+  if (!did_break_)
+    return PropagateBreak(child_layout_result->PhysicalFragment());
+  return *this;
+}
+
+NGFragmentBuilder& NGFragmentBuilder::PropagateBreak(
+    RefPtr<NGPhysicalFragment> child_fragment) {
+  if (!did_break_) {
+    const auto* token = child_fragment->BreakToken();
+    did_break_ = token && !token->IsFinished();
+  }
+  return *this;
+}
+
 NGFragmentBuilder& NGFragmentBuilder::SetBfcOffset(const NGBfcOffset& offset) {
   bfc_offset_ = offset;
   return *this;

third_party/WebKit/Source/core/layout/ng/ng_fragment_builder.h

@@ -52,6 +52,10 @@ class CORE_EXPORT NGFragmentBuilder final : public NGBaseFragmentBuilder {
   NGFragmentBuilder& AddChild(RefPtr<NGPhysicalFragment>,
                               const NGLogicalOffset&);
 
+  // Update if we have fragmented in this flow.
+  NGFragmentBuilder& PropagateBreak(RefPtr<NGLayoutResult>);
+  NGFragmentBuilder& PropagateBreak(RefPtr<NGPhysicalFragment>);
+
   NGFragmentBuilder& SetBfcOffset(const NGBfcOffset& offset);
 
   // Builder has non-trivial out-of-flow descendant methods.