[FragmentItem] Fix NGPhysicalLineBoxFragment::ScrollableOverflow

This patch fixes computing scrollable overflow for a line
box not to skip children of culled inline boxes.

Bug: 982194
Change-Id: Ia4f2fbe1dbf008a56c3ff99cb1684483b3869943
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2038914Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#738625}

third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.cc

@@ -151,8 +151,8 @@ PhysicalRect NGPhysicalLineBoxFragment::ScrollableOverflow(
   const TextDirection container_direction = container_style.Direction();
   PhysicalRect overflow;
 
-  for (NGInlineCursor descendants = cursor.CursorForDescendants(); descendants;
-       descendants.MoveToNextSkippingChildren()) {
+  for (NGInlineCursor descendants = cursor.CursorForDescendants();
+       descendants;) {
     const NGFragmentItem* item = descendants.CurrentItem();
     DCHECK(item);
     if (item->IsText()) {
@@ -163,6 +163,7 @@ PhysicalRect NGPhysicalLineBoxFragment::ScrollableOverflow(
                                            &child_scroll_overflow);
       }
       overflow.Unite(child_scroll_overflow);
+      descendants.MoveToNextSkippingChildren();
       continue;
     }
 
@@ -174,7 +175,14 @@ PhysicalRect NGPhysicalLineBoxFragment::ScrollableOverflow(
           ComputeRelativeOffset(child_box->Style(), container_writing_mode,
                                 container_direction, container.Size());
       overflow.Unite(child_scroll_overflow);
+      descendants.MoveToNextSkippingChildren();
+      continue;
     }
+
+    // Add all children of a culled inline box; i.e., an inline box without
+    // margin/border/padding etc.
+    DCHECK_EQ(item->Type(), NGFragmentItem::kBox);
+    descendants.MoveToNext();
   }
 
   // Make sure we include the inline-size of the line-box in the overflow.

third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item

@@ -1214,7 +1214,6 @@ crbug.com/982194 jquery/manipulation.html [ Pass ]
 crbug.com/982194 jquery/offset.html [ Pass ]
 crbug.com/982194 jquery/traversing.html [ Pass ]
 crbug.com/982194 media/video-canvas-draw.html [ Failure ]
-crbug.com/982194 overflow/overflow-inline-003.html [ Failure ]
 crbug.com/982194 paint/background/background-clip-text-inline.html [ Failure ]
 crbug.com/982194 paint/invalidation/compositing/float-under-composited-inline.html [ Failure ]
 crbug.com/982194 paint/invalidation/multi-layout-one-frame.html [ Failure ]