Move children in NGPhysicalContainerFragment ctor

This patch changes |NGPhysicalContainerFragment| constructor
to move children from |NGContainerFragmentBuilder|, instead
of calling |AddRef|. Children in |NGContainerFragmentBuilder|
will not be used after it generated a fragment.

We used to move, but changed to copy when the child list was
changed to a flexible array in r603306 crrev.com/c/1298207.

Change-Id: Iac77022c39835598b2257b24cf80e0f0f34f8a5e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2145734
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758472}

third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc

@@ -73,11 +73,18 @@ NGPhysicalContainerFragment::NGPhysicalContainerFragment(
   // storage be part of the subclass.
   wtf_size_t i = 0;
   for (auto& child : builder->children_) {
-    buffer[i].fragment = child.fragment.get();
-    buffer[i].fragment->AddRef();
     buffer[i].offset = child.offset.ConvertToPhysical(
         block_or_line_writing_mode, builder->Direction(), size,
         child.fragment->Size());
+    // Call the move constructor to move without |AddRef|. Fragments in
+    // |builder| are not used after |this| was constructed.
+    static_assert(
+        sizeof(buffer[0].fragment) ==
+            sizeof(scoped_refptr<const NGPhysicalFragment>),
+        "scoped_refptr must be the size of a pointer for this to work");
+    new (&buffer[i].fragment)
+        scoped_refptr<const NGPhysicalFragment>(std::move(child.fragment));
+    DCHECK(!child.fragment);  // Ensure it was moved.
     ++i;
   }
 }