[FragmentItem] Fix text snap-to-pixel behavior for culled inline box

This patch modifies the snap-to-pixel behavior implemented in
r736251 <crrev.com/c/2024133>.

The CL changed to snap the top of the padding box of the
parent box to match legacy and |NGPaintFragment| behavior.
It did so even for culled inline boxes too, but this part
was not compatible.

This patch changes the logic to ignore culled inline boxes
for the snap-to-pixel behavior, matching legacy and
|NGPaintFragment|.

Bug: 982194
Change-Id: I667f35d4b55909505502633b2d7e70b058191c8b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2106044
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#751062}

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -1153,7 +1153,7 @@ void NGBoxFragmentPainter::PaintInlineItems(const PaintInfo& paint_info,
         break;
       case NGFragmentItem::kBox:
         if (!item->IsHiddenForPaint())
-          PaintBoxItem(*item, *cursor, paint_info, paint_offset);
+          PaintBoxItem(*item, *cursor, paint_info, paint_offset, parent_offset);
         cursor->MoveToNextSkippingChildren();
         break;
       case NGFragmentItem::kLine:
@@ -1309,7 +1309,8 @@ void NGBoxFragmentPainter::PaintLineBoxChildItems(
     if (const NGPhysicalBoxFragment* child_fragment =
             child_item->BoxFragment()) {
       if (child_fragment->IsListMarker()) {
-        PaintBoxItem(*child_item, *children, paint_info, paint_offset);
+        PaintBoxItem(*child_item, *child_fragment, *children, paint_info,
+                     paint_offset);
         continue;
       }
     }
@@ -1452,39 +1453,56 @@ NGBoxFragmentPainter::MoveTo NGBoxFragmentPainter::PaintLineBoxItem(
   return kDontSkipChildren;
 }
 
-void NGBoxFragmentPainter::PaintBoxItem(const NGFragmentItem& item,
-                                        const NGInlineCursor& cursor,
-                                        const PaintInfo& paint_info,
-                                        const PhysicalOffset& paint_offset) {
+// Paint non-culled box item.
+void NGBoxFragmentPainter::PaintBoxItem(
+    const NGFragmentItem& item,
+    const NGPhysicalBoxFragment& child_fragment,
+    const NGInlineCursor& cursor,
+    const PaintInfo& paint_info,
+    const PhysicalOffset& paint_offset) {
   DCHECK_EQ(item.Type(), NGFragmentItem::kBox);
   DCHECK_EQ(&item, cursor.Current().Item());
+  DCHECK_EQ(item.BoxFragment(), &child_fragment);
+  DCHECK(!child_fragment.IsHiddenForPaint());
+  if (child_fragment.HasSelfPaintingLayer() || child_fragment.IsFloating())
+    return;
 
-  if (const NGPhysicalBoxFragment* child_fragment = item.BoxFragment()) {
-    DCHECK(!child_fragment->IsHiddenForPaint());
-    if (child_fragment->HasSelfPaintingLayer() || child_fragment->IsFloating())
-      return;
-
-    // TODO(kojii): Check CullRect.
+  // TODO(kojii): Check CullRect.
 
-    if (child_fragment->IsAtomicInline() || child_fragment->IsListMarker()) {
-      if (FragmentRequiresLegacyFallback(*child_fragment)) {
-        PaintInlineChildBoxUsingLegacyFallback(*child_fragment, paint_info);
-        return;
-      }
-      NGBoxFragmentPainter(*child_fragment)
-          .PaintAllPhasesAtomically(paint_info);
+  if (child_fragment.IsAtomicInline() || child_fragment.IsListMarker()) {
+    if (FragmentRequiresLegacyFallback(child_fragment)) {
+      PaintInlineChildBoxUsingLegacyFallback(child_fragment, paint_info);
       return;
     }
+    NGBoxFragmentPainter(child_fragment).PaintAllPhasesAtomically(paint_info);
+    return;
+  }
+
+  DCHECK(child_fragment.IsInlineBox());
+  NGInlineBoxFragmentPainter(cursor, item, child_fragment)
+      .Paint(paint_info, paint_offset);
+}
+
+void NGBoxFragmentPainter::PaintBoxItem(const NGFragmentItem& item,
+                                        const NGInlineCursor& cursor,
+                                        const PaintInfo& paint_info,
+                                        const PhysicalOffset& paint_offset,
+                                        const PhysicalOffset& parent_offset) {
+  DCHECK_EQ(item.Type(), NGFragmentItem::kBox);
+  DCHECK_EQ(&item, cursor.Current().Item());
 
-    DCHECK(child_fragment->IsInlineBox());
-    NGInlineBoxFragmentPainter(cursor, item, *child_fragment)
-        .Paint(paint_info, paint_offset);
+  if (const NGPhysicalBoxFragment* child_fragment = item.BoxFragment()) {
+    PaintBoxItem(item, *child_fragment, cursor, paint_info, paint_offset);
     return;
   }
 
+  // This |item| is a culled inline box.
+  DCHECK(item.GetLayoutObject()->IsLayoutInline());
   NGInlineCursor children = cursor.CursorForDescendants();
-  PaintInlineItems(paint_info, paint_offset, item.OffsetInContainerBlock(),
-                   &children);
+  // Pass the given |parent_offset| because culled inline boxes do not affect
+  // the sub-pixel snapping behavior. TODO(kojii): This is for the
+  // compatibility, we may want to revisit in future.
+  PaintInlineItems(paint_info, paint_offset, parent_offset, &children);
 }
 
 bool NGBoxFragmentPainter::IsPaintingScrollingBackground(

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.h

@@ -148,9 +148,15 @@ class NGBoxFragmentPainter : public BoxPainterBase {
                           const PaintInfo& paint_info,
                           const PhysicalOffset& paint_offset);
   void PaintBoxItem(const NGFragmentItem& item,
+                    const NGPhysicalBoxFragment& child_fragment,
                     const NGInlineCursor& cursor,
                     const PaintInfo& paint_info,
                     const PhysicalOffset& paint_offset);
+  void PaintBoxItem(const NGFragmentItem& item,
+                    const NGInlineCursor& cursor,
+                    const PaintInfo& paint_info,
+                    const PhysicalOffset& paint_offset,
+                    const PhysicalOffset& parent_offset);
   void PaintFloatingItems(const PaintInfo&, NGInlineCursor* cursor);
   void PaintFloatingChildren(const NGPhysicalContainerFragment&,
                              const PaintInfo& paint_info,

third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item

@@ -224,8 +224,6 @@ crbug.com/718155 virtual/android/fullscreen/full-screen-iframe-not-allowed.html
 crbug.com/982194 virtual/audio-service/http/tests/media/video-frame-size-change.html [ Failure Pass ]
 crbug.com/874695 crbug.com/936165 virtual/audio-service/media/autoplay-muted.html [ Crash Pass Timeout ]
 crbug.com/982194 compositing/overflow/composited-scroll-with-fractional-translation.html [ Pass ]
-crbug.com/982194 css2.1/t100801-c544-valgn-00-a-ag.html [ Failure ]
-crbug.com/982194 css2.1/t100801-c544-valgn-03-d-agi.html [ Failure ]
 crbug.com/982194 css3/filters/backdrop-filter-svg.html [ Failure ]
 crbug.com/982194 custom-elements/form-submission-file.html [ Crash Pass ]
 crbug.com/982194 external/wpt/compat/webkit-text-fill-color-property-005.html [ Failure ]

third_party/blink/web_tests/TestExpectations

@@ -1497,6 +1497,8 @@ crbug.com/711805 virtual/layout_ng_fragment_traversal/external/wpt/css/CSS2/posi
 crbug.com/829028 virtual/layout_ng_fragment_traversal/fast/block/float/4145535Crash.html [ Failure Pass ]
 
 crbug.com/591099 [ Mac ] virtual/layout_ng_fragment_traversal/external/wpt/css/CSS2/text/white-space-bidirectionality-001.xht [ Failure ]
+crbug.com/982194 [ Mac ] virtual/layout_ng_fragment_traversal/fast/table/027-vertical.html [ Failure ]
+crbug.com/982194 [ Mac ] virtual/layout_ng_fragment_traversal/fast/table/border-collapsing/003-vertical.html [ Failure ]
 
 # From NeverFixTests:
 virtual/layout_ng_fragment_traversal/external/wpt/css/CSS2/linebox/inline-formatting-context-002.xht [ Skip ]