Add dirty tree guard to ScrollableOverflow

This patch adds the guard against dirty tree to
|ScrollableOverflow|, similar to r779382
<crrev.com/c/2249281> and r784297 <crrev.com/c/2275373>.

Bug: 1101141
Change-Id: Id428cd408dfd36869e83170ff534339235ed3984
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2275281Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#784356}

third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc

@@ -204,6 +204,10 @@ PhysicalRect NGPhysicalBoxFragment::OverflowClipRect(
 PhysicalRect NGPhysicalBoxFragment::ScrollableOverflow(
     TextHeightType height_type) const {
   DCHECK(GetLayoutObject());
+  if (UNLIKELY(IsLayoutObjectDestroyedOrMoved())) {
+    NOTREACHED();
+    return PhysicalRect();
+  }
   const LayoutObject* layout_object = GetLayoutObject();
   if (layout_object->IsBox()) {
     if (HasOverflowClip())
@@ -217,7 +221,7 @@ PhysicalRect NGPhysicalBoxFragment::ScrollableOverflow(
       overflow = PhysicalRect({}, Size());
     WritingMode container_writing_mode = Style().GetWritingMode();
     TextDirection container_direction = Style().Direction();
-    for (const auto& child_fragment : Children()) {
+    for (const auto& child_fragment : PostLayoutChildren()) {
       PhysicalRect child_overflow =
           child_fragment->ScrollableOverflowForPropagation(*this, height_type);
       if (child_fragment->Style() != Style()) {

third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc

@@ -176,6 +176,11 @@ void NGPhysicalContainerFragment::AddScrollableOverflowForInlineChild(
        descendants;) {
     const NGFragmentItem* item = descendants.CurrentItem();
     DCHECK(item);
+    if (UNLIKELY(item->IsLayoutObjectDestroyedOrMoved())) {
+      NOTREACHED();
+      descendants.MoveToNextSkippingChildren();
+      continue;
+    }
     if (item->IsText()) {
       PhysicalRect child_scroll_overflow = item->RectInContainerBlock();
       if (height_type == TextHeightType::kEmHeight) {

third_party/blink/renderer/core/layout/ng/ng_physical_fragment.cc

@@ -436,6 +436,10 @@ void NGPhysicalFragment::AdjustScrollableOverflowForPropagation(
   DCHECK(!IsLineBox());
   if (!IsCSSBox())
     return;
+  if (UNLIKELY(IsLayoutObjectDestroyedOrMoved())) {
+    NOTREACHED();
+    return;
+  }
 
   const LayoutObject* layout_object = GetLayoutObject();
   DCHECK(layout_object);