Automatic update from web-platform-tests
[FragmentItem] Prevent dangling LayoutObject ptrs in block fragmentation.
NGInlineCursor doesn't work with block fragmentation, so we'd end up
with NGFragmentItem objects with dangling pointers to LayoutObject. To
fix this, perform a full walk through all fragment items in all
fragments, if it's likely that we're in block fragmentation.
CL:2152824 caused two tests to crash because of this, and it therefore
got reverted. Add another test now, which would also crash without the
aforementioned CL.
Bug: 1075517
Change-Id: I97e2fae63d89031ea258ba146898e7fcfe56bd45
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2165800
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#763233}
--
wpt-commits: e9ed833d0c9483012493d839434137de7e7ba00d
wpt-pr: 23279
