It turns out that:

- When hit-testing in one paint layer, if the root LayoutObject is inline, we can't reach its fragment(s) directly because LayoutNGMixin is the only entrance to NG fragment tree

- When traversing in the fragment tree, we are entering child fragments regardless of whether they have self paint layers.

 * This allows us to enter inline children with self paint layers and get correct result there (e.g., fast/inline/relative-positioned-overflow.html)

 * This leads to incorrect hit test result when there are block children with self paint layers, which are entered when hit-testing a different layer (e.g., https://jsfiddle.net/f7yv34e9/1/)

A dirty hack to "fix" this is that we enter child fragment with self paint layer only when it's not block flow...

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4b9ef810f091b200d82fc6db150099043b132d73

commit 4b9ef810f091b200d82fc6db150099043b132d73
Author: Xiaocheng Hu <xiaochengh@chromium.org>
Date: Wed May 23 20:45:46 2018

[LayoutNG] Respect paint layers in hit testing

Currently, NG hit test code enters children with self painting layers
when traversing the fragment tree. As a result, we may end up hitting
an element in a wrong layer.

To fix this issue, this patch removes the above hack, and allows
LayoutInline::NodeAtPoint, which is called from PaintLayer directly
when this LayoutInline has self painting layer, to initiate hit testing
on its fragments directly.

Bug:  844746 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_layout_ng;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I21a7f599e7f8aaaa3f6b66388871d5eee087bc14
Reviewed-on: https://chromium-review.googlesource.com/1066938
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#561245}
[modify] https://crrev.com/4b9ef810f091b200d82fc6db150099043b132d73/third_party/blink/renderer/core/layout/layout_inline.cc
[modify] https://crrev.com/4b9ef810f091b200d82fc6db150099043b132d73/third_party/blink/renderer/core/layout/layout_inline_test.cc
[modify] https://crrev.com/4b9ef810f091b200d82fc6db150099043b132d73/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc