[LayoutNG] Paint RTL text selection.

Since this patch, we use ShapeResult.Direction() to get appropriate
CharacterRange to paint RTL text such as:

<div id="d1">&#x05d0&#x05d1&#x05d2</div>
<script>
  getSelection().setBaseAndExtent(d1.firstChild, 0, d1.firstChild, 1);
</script>

Bug: 708452
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Id858f508c41b7231e73b25ef11933f88b2b2993e
Reviewed-on: https://chromium-review.googlesource.com/821797
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524009}

third_party/WebKit/Source/core/paint/ng/ng_text_fragment_painter.cc

@@ -99,9 +99,8 @@ static void PaintSelection(GraphicsContext& context,
   DCHECK_GE(text_fragment.EndOffset(), selection_start);
   DCHECK_GE(text_fragment.EndOffset(), selection_end);
   const ShapeResult* shape_result = text_fragment.TextShapeResult();
-  // TODO(yoichio): Confirm passing TextDirection::kLtr is O.K or not.
   const CharacterRange& range = ShapeResultBuffer::GetCharacterRange(
-      shape_result, TextDirection::kLtr, shape_result->Width(),
+      shape_result, shape_result->Direction(), shape_result->Width(),
       selection_start - text_fragment.StartOffset(),
       selection_end - text_fragment.StartOffset());
   const FloatRect& selection_rect = PixelSnappedSelectionRect(