Don't add fragments for anonymous CSS boxes when hit-testing.

Fixes external/wpt/css/css-flexbox/hittest-before-pseudo.html when
LayoutNGFullPositionForPoint is enabled.

Bug: 1150362
Change-Id: I75e6e4455b5d3634be140195f12d0cd09e01f6a0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2554537Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#830915}

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -365,8 +365,8 @@ void UpdateHitTestResult(HitTestResult& result,
 
   // We may already have set an inner node, but not a box fragment, if the inner
   // node was text or non-atomic inline content. Set the containing box fragment
-  // now.
-  if (!result.BoxFragment())
+  // now, unless it's an anonymous CSS box.
+  if (!result.BoxFragment() && (!fragment.IsCSSBox() || fragment.GetNode()))
     result.SetBoxFragment(&fragment);
 
   if (!result.InnerNode())