[asan][Editing] Check node->layoutObject in CaretBase::caretLayoutObject

third_party/WebKit/Source/core/editing/CaretBase.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 46 matching lines @@
 {
     if (!node)
         return nullptr;
 
     LayoutObject* layoutObject = node->layoutObject();
     if (!layoutObject)
         return nullptr;
 
     // if caretNode is a block and caret is inside it then caret should be painted by that block
     bool paintedByBlock = layoutObject->isLayoutBlock() && caretRendersInsideNode(node);
+    // caretRendersInsideNode can layout
+    layoutObject = node->layoutObject();

[yosin_UTC9, 2016/05/12 06:55:31]

We can't explain what this line does.
When layout tree changed, we need to re-validate selection to make selection
holds canonical positions.
Also, |caretLayoutObject()| should be called at least
DocumentLifeCycle::LayoutClean.

[yosin_UTC9, 2016/05/24 08:40:18]

Could you change this to below?
// TODO(yoichio): blah blah blah
CHECK_EQ(layoutObject, node->layoutObject()) << "Layout tree should not
changed";

[yoichio, 2016/05/25 06:46:50]

Done.

     return paintedByBlock ? toLayoutBlock(layoutObject) : layoutObject->containingBlock();
 }
 
 static void mapCaretRectToCaretPainter(LayoutItem caretLayoutItem, LayoutBlockItem caretPainterItem, LayoutRect& caretRect)
 {
     // FIXME: This shouldn't be called on un-rooted subtrees.
     // FIXME: This should probably just use mapLocalToAncestor.
     // Compute an offset between the caretLayoutItem and the caretPainterItem.
 
     DCHECK(caretLayoutItem.isDescendantOf(caretPainterItem));
@@ skipping 44 matching lines @@
 {
     LayoutBlock* caretPainter = caretLayoutObject(node);
     if (!caretPainter)
         return IntRect();
 
     LayoutRect localRect(rect);
     caretPainter->flipForWritingMode(localRect);
     return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
 }
 
+// TODO(yoichio): |node| is FrameSelection::m_previousCaretNode and this is bad
+// design. We should use only previous layoutObject or Rectangle to invalidate
+// old caret.
 void CaretBase::invalidateLocalCaretRect(Node* node, const LayoutRect& rect)
 {
     LayoutBlockItem caretPainter = LayoutBlockItem(caretLayoutObject(node));
     if (!caretPainter)
         return;
 
     // FIXME: Need to over-paint 1 pixel to workaround some rounding problems.
     // https://bugs.webkit.org/show_bug.cgi?id=108283
     LayoutRect inflatedRect = rect;
     inflatedRect.inflate(LayoutUnit(1));
@@ skipping 53 matching lines @@
     else
         element = node->parentElement();
 
     if (element && element->layoutObject())
         caretColor = element->layoutObject()->resolveColor(CSSPropertyColor);
 
     context.fillRect(FloatRect(drawingRect), caretColor);
 }
 
 } // namespace blink