Make LayoutInline::ReferenceBoxForClipPath() to utilize NGInlineCursor

This patch makes |LayoutInline::ReferenceBoxForClipPath()| to utilize
|NGInlineCursor| for prepration of migrating to |NGFragmentItem|.

Bug: 982194
Change-Id: Idb4ed39dc2185033b3a0607398649e099f543506
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1909066
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#714341}

third_party/blink/renderer/core/layout/layout_inline.cc

@@ -1379,9 +1379,11 @@ PhysicalRect LayoutInline::ReferenceBoxForClipPath() const {
   // fragment in that case. We'll do the same here (but correctly with respect
   // to writing-mode - Gecko has some issues there).
   // See crbug.com/641907
-  if (const NGPaintFragment* fragment = FirstInlineFragment()) {
-    return PhysicalRect(fragment->InlineOffsetToContainerBox(),
-                        fragment->Size());
+  if (IsInLayoutNGInlineFormattingContext()) {
+    NGInlineCursor cursor;
+    cursor.MoveTo(*this);
+    if (cursor)
+      return cursor.CurrentRect();
   }
   if (const InlineFlowBox* flow_box = FirstLineBox())
     return FlipForWritingMode(flow_box->FrameRect());