[NGFragmentItem] Detach NGAbstractInlineTextBox when inserting/removing child layout object

This patch makes accessibility/aom-relation-list-properties.html to pass test
instead of hitting |DCHECK()| about |LayoutText| has |NGAbstractInlineTextBox|.

Before this patch, detaching |NGAbstractInlineTextBox| from |NGFragmentItem|
associated to |LayoutText| is happened at |LayoutObjectChildList::
InsertChildNode()| after changing parent of |LayoutText| to new parent. This
prevents us to use next for same layout object list because start of list is
hold by previous containg block flow of |LayoutText| and new parent doesn't
have it.

After this patch, we call |InvalidateInlineItems()| to detach
|NGAbstractInlineTextBox| in |LayoutObjectChildList::{Insert,Remove}ChildNode()|
before changing parent to use next for same layout object list.

Bug: 982194
Change-Id: If36223d434cfda16f8270e2e7759249e4bcdc015
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2024389
Commit-Queue: Kent Tamura <tkent@chromium.org>
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/master@{#735786}

third_party/blink/renderer/core/layout/layout_object_child_list.cc

@@ -58,7 +58,11 @@ void InvalidateInlineItems(LayoutObject* object) {
     }
   }
 
-  if (NGPaintFragment* fragment = object->FirstInlineFragment()) {
+  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled()) {
+    // TODO(yosin): Tells |NGFragmentItem| about they become not to associate
+    // to layout object.
+    object->ClearFirstInlineFragmentItemIndex();
+  } else if (NGPaintFragment* fragment = object->FirstInlineFragment()) {
     // This LayoutObject is not technically destroyed, but further access should
     // be prohibited when moved to different parent as if it were destroyed.
     fragment->LayoutObjectWillBeDestroyed();
@@ -129,6 +133,8 @@ LayoutObject* LayoutObjectChildList::RemoveChildNode(
 
     if (old_child->IsInLayoutNGInlineFormattingContext()) {
       owner->SetChildNeedsCollectInlines();
+      if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
+        InvalidateInlineItems(old_child);
     }
   }
 
@@ -184,6 +190,12 @@ void LayoutObjectChildList::InsertChildNode(LayoutObject* owner,
     return;
   }
 
+  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled() &&
+      !owner->DocumentBeingDestroyed() &&
+      new_child->IsInLayoutNGInlineFormattingContext()) {
+    InvalidateInlineItems(new_child);
+  }
+
   new_child->SetParent(owner);
 
   if (FirstChild() == before_child)