[LayoutNG] Fix hit test visibility check on text fragments

When hit testing a text fragment, current code checks the hit test
request against its containing box fragment to decide if the text is
visible to hit test request. This gives wrong result when there are
culled inlines between the two fragments, for example:

<div><span inert>foo</span></div>

This patch fixes the issue by using the text fragment itself for the
visibility check.

Bug: 851075
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng;luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2b318260c6a108c091d66b30e46d3d64d5f8a408
Reviewed-on: https://chromium-review.googlesource.com/1110524Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569555}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -440,7 +440,6 @@ crbug.com/714962 fast/dom/Range/getBoundingClientRect-linebreak-character.html [
 crbug.com/591099 fast/dom/Window/window-lookup-precedence.html [ Failure ]
 crbug.com/714962 fast/dom/elementFromPoint-relative-to-viewport.html [ Failure ]
 crbug.com/714962 fast/dom/elementsFromPoint/elementsFromPoint-inline.html [ Failure ]
-crbug.com/714962 fast/dom/inert/inert-inlines.html [ Failure ]
 crbug.com/591099 fast/dom/nodesFromRect/nodesFromRect-basic.html [ Failure ]
 crbug.com/714962 fast/dom/nodesFromRect/nodesFromRect-culled-inline-with-linebreak.html [ Failure ]
 crbug.com/714962 fast/dom/nodesFromRect/nodesFromRect-culled-inlines.html [ Failure ]

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -72,6 +72,14 @@ LayoutPoint FallbackAccumulatedOffset(const NGPaintFragment& child,
          LayoutSize(parent_inline_offset.X(), parent_inline_offset.Y());
 }
 
+bool FragmentVisibleToHitTestRequest(const NGPaintFragment& fragment,
+                                     const HitTestRequest& request) {
+  return fragment.Style().Visibility() == EVisibility::kVisible &&
+         (request.IgnorePointerEventsNone() ||
+          fragment.Style().PointerEvents() != EPointerEvents::kNone) &&
+         !(fragment.GetNode() && fragment.GetNode()->IsInert());
+}
+
 }  // anonymous namespace
 
 NGBoxFragmentPainter::NGBoxFragmentPainter(const NGPaintFragment& box)
@@ -900,10 +908,7 @@ bool NGBoxFragmentPainter::NodeAtPoint(
 
 bool NGBoxFragmentPainter::VisibleToHitTestRequest(
     const HitTestRequest& request) const {
-  return box_fragment_.Style().Visibility() == EVisibility::kVisible &&
-         (request.IgnorePointerEventsNone() ||
-          box_fragment_.Style().PointerEvents() != EPointerEvents::kNone) &&
-         !(box_fragment_.GetNode() && box_fragment_.GetNode()->IsInert());
+  return FragmentVisibleToHitTestRequest(box_fragment_, request);
 }
 
 bool NGBoxFragmentPainter::HitTestTextFragment(
@@ -930,7 +935,8 @@ bool NGBoxFragmentPainter::HitTestTextFragment(
 
   // TODO(layout-dev): Clip to line-top/bottom.
   LayoutRect rect = LayoutRect(PixelSnappedIntRect(border_rect));
-  if (VisibleToHitTestRequest(result.GetHitTestRequest()) &&
+  if (FragmentVisibleToHitTestRequest(text_paint_fragment,
+                                      result.GetHitTestRequest()) &&
       location_in_container.Intersects(rect)) {
     Node* node = text_paint_fragment.NodeForHitTest();
     if (!result.InnerNode() && node) {