Make SelectionTopAndBottom() for LayoutReplaced to use NGPhyiscalBoxFragment

This patch changes |SelectionTopAndBottom()| for |LayoutReplaced| to use
|NGPhyiscalBoxFragment| instead of |NGPaintFragment| for preparation of
migrating |NGFragmentItem|.

Bug: 982194
Change-Id: Icecde9639f340d61aa971e4a5c917738f62fe2cc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1877878
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#709356}

third_party/blink/renderer/core/layout/layout_replaced.cc

@@ -929,11 +929,10 @@ static std::pair<LayoutUnit, LayoutUnit> SelectionTopAndBottom(
   const std::pair<LayoutUnit, LayoutUnit> fallback(
       layout_replaced.LogicalTop(), layout_replaced.LogicalBottom());
 
-  const NGPaintFragment* inline_container =
-      layout_replaced.IsInline()
-          ? NGPaintFragment::GetForInlineContainer(&layout_replaced)
-          : nullptr;
-  if (inline_container) {
+  const NGPhysicalBoxFragment* fragmentainer =
+      layout_replaced.IsInline() ? layout_replaced.ContainingBlockFlowFragment()
+                                 : nullptr;
+  if (fragmentainer) {
     // Step 1: Find the line box containing |layout_replaced|.
     const NGPaintFragment* inline_fragment =
         *NGPaintFragment::InlineFragmentsFor(&layout_replaced).begin();
@@ -954,7 +953,7 @@ static std::pair<LayoutUnit, LayoutUnit> SelectionTopAndBottom(
         line_box_container->InlineOffsetToContainerBox();
     const PhysicalSize line_box_size = line_box_container->Size();
     const LogicalOffset logical_offset = line_box_offset.ConvertToLogical(
-        writing_mode, text_direction, inline_container->Size(),
+        writing_mode, text_direction, fragmentainer->Size(),
         line_box_container->Size());
     const LogicalSize logical_size =
         line_box_size.ConvertToLogical(writing_mode);