tree e6973234707c7ea779e8f588de09f1ed28332623
parent ea0f42a7f7c6d89b39c155486bc97968fff5093d
author Koji Ishii <kojii@chromium.org> 1651143199 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1651144116 -0700

Fix |FramePainter| to reset |DisplayItemFragment|

In-process IFRAME can create NG --> legacy --> NG paint calls.

The fragment ID is currently used for 3 purposes in NG:
1. NG block fragmentation.
2. NG inline box fragmentation (line wrapping.)
3. NG line box.

When an in-process IFRAME in a non-culled inline box has self-
painting layer inline boxes:
1. The outer inline box sets the fragment ID.
2. The IFRAME is painted by a legacy |FramePainter|.
3. It calls |NGInlineBoxPainter| for the self-painting layer
   inline boxes.

Then at 3, the fragment ID has incorrect value. This patch
fixes it to 0.

Bug: 1320310
Change-Id: I2ebed9503d9e048a24ed3cb68909dcef6f508ec2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3610681
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#997145}