Relax DCHECKS in LayoutNGMixin<Base>::Paint and similar methods

These DCHECKs are intended to verify conditions for NG block fragmented
nodes, so relax it by testing whether the node does not forbid breaks
with the NG block fragmentation engine. This addresses the use case of
MathML embedded inside SVG.

Bug: 6606, 829028, 1262555
Change-Id: Idaa09cc61c03358ebdf0a6275f4b83f6a5caca49
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3237215
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Frédéric Wang <fwang@igalia.com>
Cr-Commit-Position: refs/heads/main@{#934449}
diff --git a/third_party/blink/renderer/core/layout/ng/layout_ng_block_flow_mixin.cc b/third_party/blink/renderer/core/layout/ng/layout_ng_block_flow_mixin.cc
index 5ce2d0f..a0309f7 100644
--- a/third_party/blink/renderer/core/layout/ng/layout_ng_block_flow_mixin.cc
+++ b/third_party/blink/renderer/core/layout/ng/layout_ng_block_flow_mixin.cc
@@ -162,8 +162,10 @@
 template <typename Base>
 LayoutUnit LayoutNGBlockFlowMixin<Base>::InlineBlockBaseline(
     LineDirectionMode line_direction) const {
-  // Please see |Paint()| for these DCHECKs.
-  DCHECK(!Base::CanTraversePhysicalFragments() ||
+  // Please see |LayoutNGMixin<Base>::Paint()| for these DCHECKs.
+  DCHECK(Base::GetNGPaginationBreakability() ==
+             LayoutNGBlockFlow::kForbidBreaks ||
+         !Base::CanTraversePhysicalFragments() ||
          !Base::Parent()->CanTraversePhysicalFragments());
   DCHECK_LE(Base::PhysicalFragmentCount(), 1u);
 
@@ -198,11 +200,10 @@
     const HitTestLocation& hit_test_location,
     const PhysicalOffset& accumulated_offset,
     HitTestAction action) {
-  // When |this| is NG block fragmented, the painter should traverse fragemnts
-  // instead of |LayoutObject|, because this function cannot handle block
-  // fragmented objects. We can come here only when |this| cannot traverse
-  // fragments, or the parent is legacy.
-  DCHECK(!Base::CanTraversePhysicalFragments() ||
+  // Please see |LayoutNGMixin<Base>::Paint()| for these DCHECKs.
+  DCHECK(Base::GetNGPaginationBreakability() ==
+             LayoutNGBlockFlow::kForbidBreaks ||
+         !Base::CanTraversePhysicalFragments() ||
          !Base::Parent()->CanTraversePhysicalFragments());
   DCHECK_LE(Base::PhysicalFragmentCount(), 1u);
 
diff --git a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
index ec7ed12..f7eaeae 100644
--- a/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
+++ b/third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc
@@ -50,7 +50,9 @@
   // instead of |LayoutObject|, because this function cannot handle block
   // fragmented objects. We can come here only when |this| cannot traverse
   // fragments, or the parent is legacy.
-  DCHECK(!Base::CanTraversePhysicalFragments() ||
+  DCHECK(Base::GetNGPaginationBreakability() ==
+             LayoutNGBlockFlow::kForbidBreaks ||
+         !Base::CanTraversePhysicalFragments() ||
          !Base::Parent()->CanTraversePhysicalFragments());
   DCHECK_LE(Base::PhysicalFragmentCount(), 1u);
 
@@ -78,7 +80,9 @@
                                       const PhysicalOffset& accumulated_offset,
                                       HitTestAction action) {
   // See |Paint()|.
-  DCHECK(!Base::CanTraversePhysicalFragments() ||
+  DCHECK(Base::GetNGPaginationBreakability() ==
+             LayoutNGBlockFlow::kForbidBreaks ||
+         !Base::CanTraversePhysicalFragments() ||
          !Base::Parent()->CanTraversePhysicalFragments());
   DCHECK_LE(Base::PhysicalFragmentCount(), 1u);
 
diff --git a/third_party/blink/web_tests/external/wpt/mathml/crashtests/mathml-in-svg-001.html b/third_party/blink/web_tests/external/wpt/mathml/crashtests/mathml-in-svg-001.html
new file mode 100644
index 0000000..94a905f
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/mathml/crashtests/mathml-in-svg-001.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1262555">
+<svg><foreignObject><math><mn>42</mn></math></foreignObject></svg>