[layoutng] Don't cache fragments that contain abspos boxes

If we are a containing block for an abspos descendent, we can't
reuse the fragment because we don't know if the list of abspos
items has changed -- we need to let them bubble up during layout.

This is an unsatisfying solution in the long-term but should work
for now, and does fix some crashes/bugs when fragment caching is on.

Bug: 635619
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_layout_ng
Change-Id: I5ea5a742ed87a8f6546a1405c5935d4d8a7686b0
Reviewed-on: https://chromium-review.googlesource.com/1015327
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Reviewed-by: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#556919}

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc

@@ -156,6 +156,14 @@ scoped_refptr<NGLayoutResult> LayoutNGMixin<Base>::CachedLayoutResult(
   // The checks above should be enough to bail if layout is incomplete, but
   // let's verify:
   DCHECK(IsBlockLayoutComplete(*cached_constraint_space_, *cached_result_));
+  // If we used to contain abspos items, we can't reuse the fragment, because
+  // we can't be sure that the list of items hasn't changed (as we bubble them
+  // up during layout). In the case of newly-added abspos items to this
+  // containing block, we will handle those by the NeedsLayout check above for
+  // now.
+  // TODO(layout-ng): Come up with a better solution for this
+  if (cached_result_->OutOfFlowPositionedDescendants().size())
+    return nullptr;
   return cached_result_->CloneWithoutOffset();
 }