Disable fragment traversal inside legacy multicol.

Fixes this test when LayoutNGFragmentTraversal is enabled (without
LayoutNGBlockFragmentation):

external/wpt/css/css-layout-api/list-item-multicol-with-custom-layout-child-crash.https.html

Bug: 1043787
Change-Id: If7056609955fe47a9ab8d93b2aae6c357498ee14
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2953146
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#893138}

third_party/blink/renderer/core/layout/layout_object.cc

@@ -207,6 +207,13 @@ inline bool MightTraversePhysicalFragments(const LayoutObject& obj) {
   // we traverse the fragment tree when hit-testing.
   if (obj.IsTextControlIncludingNG())
     return false;
+  // If this object participates in legacy block fragmentation (but still is a
+  // LayoutNG object, which may happen if we're using a layout type not
+  // supported in the legacy engine, such as custom layout), do not attempt to
+  // fragment-traverse it.
+  if (!RuntimeEnabledFeatures::LayoutNGBlockFragmentationEnabled() &&
+      obj.IsInsideFlowThread())
+    return false;
   return true;
 }