[LayoutNG] Fix hit test local point in text fragments

This patch fixes the local point when hit test ends up in text fragments:

When HitTestResult's inner node is a text node, the local point should be
local to the container block flow, not the text fragment being hit-tested.
We current have the latter, which is fixed in this patch.

Bug: 811502
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_layout_ng;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I3104c126b5ee3968f25dffa15042a45a051be160
Reviewed-on: https://chromium-review.googlesource.com/915041Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#538829}

third_party/WebKit/Source/core/paint/ng/ng_box_fragment_painter.cc

@@ -826,9 +826,11 @@ bool NGBoxFragmentPainter::VisibleToHitTestRequest(
 
 bool NGBoxFragmentPainter::HitTestTextFragment(
     HitTestResult& result,
-    const NGPhysicalFragment& text_fragment,
+    const NGPaintFragment& text_paint_fragment,
     const HitTestLocation& location_in_container,
     const LayoutPoint& accumulated_offset) {
+  const NGPhysicalFragment& text_fragment =
+      text_paint_fragment.PhysicalFragment();
   LayoutSize offset(text_fragment.Offset().left, text_fragment.Offset().top);
   LayoutPoint adjusted_location = accumulated_offset + offset;
   LayoutSize size(text_fragment.Size().width, text_fragment.Size().height);
@@ -851,7 +853,9 @@ bool NGBoxFragmentPainter::HitTestTextFragment(
     Node* node = text_fragment.GetNode();
     if (!result.InnerNode() && node) {
       LayoutPoint point =
-          location_in_container.Point() - ToLayoutSize(accumulated_offset);
+          location_in_container.Point() - ToLayoutSize(accumulated_offset) -
+          offset +
+          text_paint_fragment.InlineOffsetToContainerBox().ToLayoutPoint();
       result.SetNodeAndPosition(node, point);
     }
 
@@ -903,7 +907,7 @@ bool NGBoxFragmentPainter::HitTestChildren(
       // TODO(eae): Should this hit test on the text itself or the containing
       // node?
       stop_hit_testing = HitTestTextFragment(
-          result, fragment, location_in_container, accumulated_offset);
+          result, *child, location_in_container, accumulated_offset);
     }
     if (stop_hit_testing)
       return true;

third_party/WebKit/Source/core/paint/ng/ng_box_fragment_painter.h

@@ -118,7 +118,7 @@ class NGBoxFragmentPainter : public BoxPainterBase {
                        const LayoutPoint& accumulated_offset_for_legacy,
                        HitTestAction);
   bool HitTestTextFragment(HitTestResult&,
-                           const NGPhysicalFragment&,
+                           const NGPaintFragment&,
                            const HitTestLocation& location_in_container,
                            const LayoutPoint& accumulated_offset);
   bool HitTestClippedOutByBorder(const HitTestLocation&,