[layoutng] Set the intrinsic content logical height on the old layout tree

The overflow size is the content size without being affected by width/height
and max/min properties, so it's exactly what we need here.

This is important because without this change, there are DCHECK failures
if we're a child of a flexbox as the size remains at -1.

R=eae@chromium.org,ikilpatrick@chromium.org,glebl@chromium.org
BUG=635619

Review-Url: https://codereview.chromium.org/2337763005
Cr-Commit-Position: refs/heads/master@{#418695}

third_party/WebKit/Source/core/layout/ng/ng_box.cc

@@ -10,6 +10,7 @@
 #include "core/layout/ng/ng_direction.h"
 #include "core/layout/ng/ng_fragment.h"
 #include "core/layout/ng/ng_fragment_builder.h"
+#include "core/layout/ng/ng_length_utils.h"
 #include "core/layout/ng/ng_writing_mode.h"
 
 namespace blink {
@@ -42,6 +43,15 @@ bool NGBox::Layout(const NGConstraintSpace* constraint_space,
     if (layout_box_) {
       layout_box_->setWidth(fragment_->Width());
       layout_box_->setHeight(fragment_->Height());
+      NGBoxStrut border_and_padding =
+          computeBorders(*Style()) +
+          computePadding(*constraint_space, *Style());
+      LayoutUnit intrinsic_logical_height =
+          layout_box_->style()->isHorizontalWritingMode()
+              ? fragment_->HeightOverflow()
+              : fragment_->WidthOverflow();
+      intrinsic_logical_height -= border_and_padding.BlockSum();
+      layout_box_->setIntrinsicContentLogicalHeight(intrinsic_logical_height);
 
       // Ensure the position of the children are copied across to the
       // LayoutObject tree.