Bug 1736000 [wpt PR 31264] - Update DCHECK for <= 1px tall fragmentainers in legacy...

Bug 1736000 [wpt PR 31264] - Update DCHECK for <= 1px tall fragmentainers in legacy write-back., a=testonly

Automatic update from web-platform-tests
Update DCHECK for <= 1px tall fragmentainers in legacy write-back.

If block_size was zero, we'd pass the DCHECK, but we should check for
any block_size <= 1px, since we don't only clamp for 0, but for any
values less than 1px. This code is in
NGBlockNode::PlaceChildrenInFlowThread(), and we'll clamp depending on
whether we have overflow or not. Some fragmentainers may have overflow,
while others may not.

This fixes external/wpt/css/css-paint-api/column-count-crash.https.html
when LayoutNGBlockFragmentation is enabled. Added two more crash tests
(the first one turned out to be an over-simplification, so I added
another one).

Bug: 829028
Change-Id: I19987f4b33df832d0298bfda81aadd1ea3ed557f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3226101
Reviewed-by: Alison Maher <almaher@microsoft.com>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#932101}

--

wpt-commits: 067d1be35ea8dd3ae5a69b72dd39f5e79e1afebc
wpt-pr: 31264