Fix IsRectReachableByScroll()

If the bottom-down corner of an element's overflow rect is before
the top-left corner of the containing block, we cannot reach it
with scroll and it shoulnd't be added to overflow.
But if that happens only in one axis but not in the other,
we still need to add it to the overflow.

This patch changes the return condition to be an OR instead of AND.

The test is passing without this patch, but this has caused regressions
before LayoutNGLayoutOverflow was enabled and we were avoiding
to compute the overflow of positioned elements twice (r809272).

BUG=1150774
TEST=external/wpt/css/css-position/positon-absolute-scrollable-overflow-001.html

Change-Id: I84afd63178ae23d07b14e93add78295c2e737a60
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2562845Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Manuel Rego <rego@igalia.com>
Cr-Commit-Position: refs/heads/master@{#832295}

third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc

@@ -523,7 +523,7 @@ PhysicalRect NGPhysicalBoxFragment::ScrollableOverflowFromChildren(
           rect.offset.ConvertToLogical(writing_direction, container.Size(),
                                        rect.size) +
           rect.size.ConvertToLogical(writing_direction.GetWritingMode());
-      return rect_logical_end.inline_offset > border_inline_start &&
+      return rect_logical_end.inline_offset > border_inline_start ||
              rect_logical_end.block_offset > border_block_start;
     }