[LayoutNG] Stop NGInlineFragmentTraversal::SelfFragmentsOf() from collecting descendants of already collected inline fragments

The above function is used to compute rects of a LayoutInline, and is
especially useful when the LayoutInline doesn't generates its own boxes.

However, currently the function may collect a fragment even if there's
an inline ancestor fragment collected. For example:

<span id="culled">
  <span id="preserved" style="border: 1px solid black">
    text
  </span>
</span>

When calling SelfFragmentsOf() on SPAN#culled, it collects both the box
fragment of SPAN#preserved and the text fragment. This results in wrong
calculation of rects of culled inline elements, and also some failures
in client-rect-related tests.

This also conflicts with the legacy behavior, where if a LayoutInline has
already has an InlineBox, the legacy rect generation functions no longer
collect the descendant InlineBoxes.

This patch fixes the issue by storing a stack of currently entered
inline box fragments, and collect a fragment only if none of its
ancestor inline fragments is entered (which means all of them, if any,
are culled).

While being a standalone fix, this patch also helps preserving more inline
fragments to make hit testing inline elements easier.

Bug: 851075
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I8567f1258221c78806be1bb1628b8a63c7ea3281
Reviewed-on: https://chromium-review.googlesource.com/1091921
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#568211}
14 files changed