[FragmentItem] Add PostLayout guard to AddOutlineRectsForNormalChildren

This patch adds |PostLayout| gurad to FragmentItem codepath
in |AddOutlineRectsForNormalChildren|.

While I have not succeeded to reproduce the issue locally,
this is the most likely the reason from the stack traces.

This patch is speculative.

Bug: 1105283
Change-Id: I94813dc011e6a43a08a111ad7dfc51804d7877de
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2303417Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#789853}

third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc

@@ -112,6 +112,8 @@ void NGPhysicalContainerFragment::AddOutlineRectsForNormalChildren(
         }
         if (item.Type() == NGFragmentItem::kBox) {
           if (const NGPhysicalBoxFragment* child_box = item.BoxFragment()) {
+            if (const NGPhysicalFragment* post_layout = child_box->PostLayout())
+              child_box = To<NGPhysicalBoxFragment>(post_layout);
             DCHECK(!child_box->IsOutOfFlowPositioned());
             AddOutlineRectsForDescendant(
                 {child_box, item.OffsetInContainerBlock()}, outline_rects,