Fix SVGInlineTextMetricsIterator not to keep a pointer to LineLayoutItem

third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h

Index: third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h
diff --git a/third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h b/third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h
index 02496d4ab935ff2495281dfb7d636f28ae06ace0..ca8d149d87d27565d5e7a4cbc8111996b227cb04 100644
--- a/third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h
+++ b/third_party/WebKit/Source/core/layout/api/LineLayoutSVGInlineText.h
@@ -63,12 +63,15 @@ private:
 class SVGInlineTextMetricsIterator {
     DISALLOW_NEW();
 public:
-    SVGInlineTextMetricsIterator() { reset(nullptr); }
+    SVGInlineTextMetricsIterator() { reset(LineLayoutSVGInlineText()); }
 
-    void advanceToTextStart(LineLayoutSVGInlineText* textLineLayout, unsigned startCharacterOffset)
+    void advanceToTextStart(LineLayoutSVGInlineText textLineLayout, unsigned startCharacterOffset)
     {
+#if ENABLE(ASSERT)
+        assertCharacterOffsetFromMetricsList();
+#endif
         ASSERT(textLineLayout);
-        if (m_textLineLayout != textLineLayout) {
+        if (!m_textLineLayout || !m_textLineLayout.isEqual(textLineLayout)) {
             reset(textLineLayout);
             ASSERT(!metricsList().isEmpty());
         }
@@ -82,11 +85,14 @@ public:
 
         while (m_characterOffset < startCharacterOffset)
             next();
+        ASSERT(m_characterOffset == startCharacterOffset);
     }
 
     void next()
     {
         m_characterOffset += metrics().length();
+        ASSERT(m_characterOffset <= m_textLineLayout.length());
+        ASSERT(m_metricsListOffset < metricsList().size());
         ++m_metricsListOffset;
     }
 
@@ -95,20 +101,38 @@ public:
         ASSERT(m_textLineLayout && m_metricsListOffset < metricsList().size());
         return metricsList()[m_metricsListOffset];
     }
-    const Vector<SVGTextMetrics>& metricsList() const { return m_textLineLayout->layoutAttributes()->textMetricsValues(); }
+    const Vector<SVGTextMetrics>& metricsList() const { return m_textLineLayout.layoutAttributes()->textMetricsValues(); }
     unsigned metricsListOffset() const { return m_metricsListOffset; }
     unsigned characterOffset() const { return m_characterOffset; }
     bool isAtEnd() const { return m_metricsListOffset == metricsList().size(); }
 
 private:
-    void reset(LineLayoutSVGInlineText* textLineLayout)
+    void reset(LineLayoutSVGInlineText textLineLayout)
     {
         m_textLineLayout = textLineLayout;
         m_characterOffset = 0;
         m_metricsListOffset = 0;
     }
 
-    LineLayoutSVGInlineText* m_textLineLayout;
+#if ENABLE(ASSERT)
+    void assertCharacterOffsetFromMetricsList()

[eae, 2015/12/28 16:41:26]

Is this really necessary? Wouldn't the length assert in next combined with the
offset assert in advance catch all cases where it's wrong?

+    {
+        if (!m_textLineLayout)
+            return;
+        const Vector<SVGTextMetrics>& metricsList = this->metricsList();
+        ASSERT(m_metricsListOffset <= metricsList.size());
+        unsigned characterOffset = 0, metricsListOffset = 0;
+        for (; metricsListOffset < m_metricsListOffset; ++metricsListOffset)
+            characterOffset += metricsList[metricsListOffset].length();
+        ASSERT(m_characterOffset == characterOffset);
+
+        for (; metricsListOffset < metricsList.size(); ++metricsListOffset)
+            characterOffset += metricsList[metricsListOffset].length();
+        ASSERT(characterOffset == m_textLineLayout.length());
+    }
+#endif
+
+    LineLayoutSVGInlineText m_textLineLayout;
     unsigned m_metricsListOffset;
     unsigned m_characterOffset;
 };