Use NGPaintFragment::InlineFragmentsFor() in LayoutText::DetachAbstractInlineTextBoxesIfNeeded()

This patch changes |LayoutText::DetachAbstractInlineTextBoxesIfNeeded()| to
use |NGPaintFragment::InlineFragmentsFor()| instead of |NGInlineCursor|, because
|DetachAbstractInlineTextBoxesIfNeeded()| is called after containg block flow
of |LayoutText| changed, e.g. removing, moving, spliting, etc.

Note: This is experimatal patch because we don't know exact reproduce case.

Note: |NGInlineCursor::MoveTo(LayoutObject)| requires root paint fragment
computed from specified layout object.

Bug: 1040938
Change-Id: I7624a19e66f449182309a29ab0fc4748839d69b4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2006837
Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Auto-Submit: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#732769}

third_party/blink/renderer/core/layout/layout_text.cc

@@ -283,10 +283,17 @@ void LayoutText::DetachAbstractInlineTextBoxesIfNeeded() {
   // NGAbstractInlineTextBox for them.
   if (!has_abstract_inline_text_box_)
     return;
+  has_abstract_inline_text_box_ = false;
+  if (!RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled()) {
+    for (NGPaintFragment* fragment : NGPaintFragment::InlineFragmentsFor(this))
+      NGAbstractInlineTextBox::WillDestroy(fragment);
+    return;
+  }
+  // TODO(yosin): Make sure we call this function within valid containg block
+  // of |this|.
   NGInlineCursor cursor;
   for (cursor.MoveTo(*this); cursor; cursor.MoveToNextForSameLayoutObject())
     NGAbstractInlineTextBox::WillDestroy(cursor);
-  has_abstract_inline_text_box_ = false;
 }
 
 void LayoutText::SetFirstInlineFragment(NGPaintFragment* first_fragment) {

third_party/blink/renderer/core/layout/ng/inline/ng_abstract_inline_text_box.cc

@@ -101,6 +101,10 @@ void NGAbstractInlineTextBox::WillDestroy(const NGInlineCursor& cursor) {
   NOTREACHED();
 }
 
+void NGAbstractInlineTextBox::WillDestroy(const NGPaintFragment* fragment) {
+  NGAbstractInlineTextBoxCache<NGPaintFragment>::WillDestroy(fragment);
+}
+
 NGAbstractInlineTextBox::NGAbstractInlineTextBox(
     LineLayoutText line_layout_item,
     const NGPaintFragment& fragment)

third_party/blink/renderer/core/layout/ng/inline/ng_abstract_inline_text_box.h

@@ -22,6 +22,7 @@ class CORE_EXPORT NGAbstractInlineTextBox final : public AbstractInlineTextBox {
   static scoped_refptr<AbstractInlineTextBox> GetOrCreate(
       const NGInlineCursor& cursor);
   static void WillDestroy(const NGInlineCursor& cursor);
+  static void WillDestroy(const NGPaintFragment* fragment);
 
   friend class LayoutText;