[asan][Editing] Check node->layoutObject in CaretBase::caretLayoutObject

third_party/WebKit/Source/core/editing/CaretBase.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 52 matching lines @@
 {
     if (!node)
         return nullptr;
 
     LayoutObject* layoutObject = node->layoutObject();
     if (!layoutObject)
         return nullptr;
 
     // if caretNode is a block and caret is inside it then caret should be painted by that block
     bool paintedByBlock = layoutObject->isLayoutBlock() && caretRendersInsideNode(node);
+    // TODO(yoichio): This function is called at least
+    // DocumentLifeCycle::LayoutClean but caretRendersInsideNode above can
+    // layout. Thus |node->layoutObject()| can be changed then this is bad
+    // design. We should make caret painting algorithm clean.
+    CHECK_EQ(layoutObject, node->layoutObject()) << "Layout tree should not changed";
     return paintedByBlock ? toLayoutBlock(layoutObject) : layoutObject->containingBlock();
 }
 
 static void mapCaretRectToCaretPainter(LayoutItem caretLayoutItem, LayoutBlockItem caretPainterItem, LayoutRect& caretRect)
 {
     // FIXME: This shouldn't be called on un-rooted subtrees.
     // FIXME: This should probably just use mapLocalToAncestor.
     // Compute an offset between the caretLayoutItem and the caretPainterItem.
 
     DCHECK(caretLayoutItem.isDescendantOf(caretPainterItem));
@@ skipping 44 matching lines @@
 {
     LayoutBlock* caretPainter = caretLayoutObject(node);
     if (!caretPainter)
         return IntRect();
 
     LayoutRect localRect(rect);
     caretPainter->flipForWritingMode(localRect);
     return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
 }
 
+// TODO(yoichio): |node| is FrameSelection::m_previousCaretNode and this is bad
+// design. We should use only previous layoutObject or Rectangle to invalidate
+// old caret.
 void CaretBase::invalidateLocalCaretRect(Node* node, const LayoutRect& rect)
 {
     LayoutBlockItem caretPainter = LayoutBlockItem(caretLayoutObject(node));
     if (!caretPainter)
         return;
 
     // FIXME: Need to over-paint 1 pixel to workaround some rounding problems.
     // https://bugs.webkit.org/show_bug.cgi?id=108283
     LayoutRect inflatedRect = rect;
     inflatedRect.inflate(LayoutUnit(1));
@@ skipping 53 matching lines @@
     else
         element = node->parentElement();
 
     if (element && element->layoutObject())
         caretColor = element->layoutObject()->resolveColor(CSSPropertyColor);
 
     context.fillRect(FloatRect(drawingRect), caretColor);
 }
 
 } // namespace blink