Fix SVGInlineTextMetricsIterator not to keep a pointer to LineLayoutItem

third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef LineLayoutSVGInlineText_h
 #define LineLayoutSVGInlineText_h
 
 #include "core/layout/api/LineLayoutText.h"
 #include "core/layout/svg/LayoutSVGInlineText.h"
 
@@ skipping 45 matching lines @@
 
     const LayoutSVGInlineText* toSVGInlineText() const
     {
         return toLayoutSVGInlineText(layoutObject());
     }
 };
 
 class SVGInlineTextMetricsIterator {
     DISALLOW_NEW();
 public:
-    SVGInlineTextMetricsIterator() { reset(nullptr); }
+    SVGInlineTextMetricsIterator() { reset(LineLayoutSVGInlineText()); }
 
-    void advanceToTextStart(LineLayoutSVGInlineText* textLineLayout, unsigned startCharacterOffset)
+    void advanceToTextStart(LineLayoutSVGInlineText textLineLayout, unsigned startCharacterOffset)
     {
+#if ENABLE(ASSERT)
+        assertCharacterOffsetFromMetricsList();
+#endif
         ASSERT(textLineLayout);
-        if (m_textLineLayout != textLineLayout) {
+        if (!m_textLineLayout || !m_textLineLayout.isEqual(textLineLayout)) {
             reset(textLineLayout);
             ASSERT(!metricsList().isEmpty());
         }
 
         if (m_characterOffset == startCharacterOffset)
             return;
 
         // TODO(fs): We could walk backwards through the metrics list in these cases.
         if (m_characterOffset > startCharacterOffset)
             reset(textLineLayout);
 
         while (m_characterOffset < startCharacterOffset)
             next();
+        ASSERT(m_characterOffset == startCharacterOffset);
     }
 
     void next()
     {
         m_characterOffset += metrics().length();
+        ASSERT(m_characterOffset <= m_textLineLayout.length());
+        ASSERT(m_metricsListOffset < metricsList().size());
         ++m_metricsListOffset;
     }
 
     const SVGTextMetrics& metrics() const
     {
         ASSERT(m_textLineLayout && m_metricsListOffset < metricsList().size());
         return metricsList()[m_metricsListOffset];
     }
-    const Vector<SVGTextMetrics>& metricsList() const { return m_textLineLayout->layoutAttributes()->textMetricsValues(); }
+    const Vector<SVGTextMetrics>& metricsList() const { return m_textLineLayout.layoutAttributes()->textMetricsValues(); }
     unsigned metricsListOffset() const { return m_metricsListOffset; }
     unsigned characterOffset() const { return m_characterOffset; }
     bool isAtEnd() const { return m_metricsListOffset == metricsList().size(); }
 
 private:
-    void reset(LineLayoutSVGInlineText* textLineLayout)
+    void reset(LineLayoutSVGInlineText textLineLayout)
     {
         m_textLineLayout = textLineLayout;
         m_characterOffset = 0;
         m_metricsListOffset = 0;
     }
 
-    LineLayoutSVGInlineText* m_textLineLayout;
+#if ENABLE(ASSERT)
+    void assertCharacterOffsetFromMetricsList()

[eae, 2015/12/28 16:41:26]

Is this really necessary? Wouldn't the length assert in next combined with the
offset assert in advance catch all cases where it's wrong?

+    {
+        if (!m_textLineLayout)
+            return;
+        const Vector<SVGTextMetrics>& metricsList = this->metricsList();
+        ASSERT(m_metricsListOffset <= metricsList.size());
+        unsigned characterOffset = 0, metricsListOffset = 0;
+        for (; metricsListOffset < m_metricsListOffset; ++metricsListOffset)
+            characterOffset += metricsList[metricsListOffset].length();
+        ASSERT(m_characterOffset == characterOffset);
+
+        for (; metricsListOffset < metricsList.size(); ++metricsListOffset)
+            characterOffset += metricsList[metricsListOffset].length();
+        ASSERT(characterOffset == m_textLineLayout.length());
+    }
+#endif
+
+    LineLayoutSVGInlineText m_textLineLayout;
     unsigned m_metricsListOffset;
     unsigned m_characterOffset;
 };
 
 } // namespace blink
 
 #endif // LineLayoutSVGInlineText_h