Fix |NGInlineCursor::GetLayoutBlockFlow| for column box

This patch fixes an issue where |NGInlineCursor| for a column
box starts returning |nullptr| for |GetLayoutBlockFlow| since
r822068 <crrev.com/c/2505354>.

This patch fixes flaky crash locally seen in:
virtual/layout_ng_block_frag/fast/multicol/layers-in-multicol.html

Bug: 1131405, 1061423
Change-Id: I1db14a39917fc97fc7a136cc9fa8df0064bdbccf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2507309
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#822212}

third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.cc

@@ -156,7 +156,11 @@ const LayoutBlockFlow* NGInlineCursor::GetLayoutBlockFlow() const {
   }
   if (IsItemCursor()) {
     DCHECK(root_box_fragment_);
-    return To<LayoutBlockFlow>(root_box_fragment_->GetLayoutObject());
+    const LayoutObject* layout_object =
+        root_box_fragment_->GetSelfOrContainerLayoutObject();
+    DCHECK(layout_object);
+    DCHECK(!layout_object->IsLayoutFlowThread());
+    return To<LayoutBlockFlow>(layout_object);
   }
   NOTREACHED();
   return nullptr;

third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h

@@ -252,6 +252,7 @@ class CORE_EXPORT NGInlineCursor {
   }
 
   // Returns the |LayoutBlockFlow| containing this cursor.
+  // When |this| is a column box, returns the multicol container.
   const LayoutBlockFlow* GetLayoutBlockFlow() const;
 
   // Return the index of the current physical box fragment of the containing