[FragmentItem] Fix InvalidateDisplayItemClients for NGBlockFragmentation

When LayoutNGBlockFragmentation is enabled, r718532
<crrev.com/c/1930287> added a branch to use |NGPaintFragment|
directly, without using |NGInlineCursor|. This patch fixes to
use |NGInlineCursor|.

There's no virtual tests for this combination, but tests fail
if both of these two flags are enabled. Caught in a manual
review.

Bug: 982194
Change-Id: Ic22ebc68d6e9d24896c3686d5797ce248c2d0a3a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2016803
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#734929}

third_party/blink/renderer/core/layout/layout_inline.cc

@@ -1748,7 +1748,8 @@ void LayoutInline::InvalidateDisplayItemClients(
     PaintInvalidationReason invalidation_reason) const {
   ObjectPaintInvalidator paint_invalidator(*this);
 
-  if (RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled()) {
+  if (RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled() &&
+      !RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled()) {
     auto fragments = NGPaintFragment::InlineFragmentsFor(this);
     if (fragments.IsInLayoutNGInlineFormattingContext()) {
       for (NGPaintFragment* fragment : fragments) {

third_party/blink/renderer/core/layout/layout_text.cc

@@ -2461,7 +2461,8 @@ void LayoutText::InvalidateDisplayItemClients(
     PaintInvalidationReason invalidation_reason) const {
   ObjectPaintInvalidator paint_invalidator(*this);
 
-  if (RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled()) {
+  if (RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled() &&
+      !RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled()) {
     auto fragments = NGPaintFragment::InlineFragmentsFor(this);
     if (fragments.IsInLayoutNGInlineFormattingContext()) {
       for (NGPaintFragment* fragment : fragments) {