[asan][Editing] Check node->layoutObject in CaretBase::caretLayoutObject

third_party/WebKit/Source/core/editing/CaretBase.cpp

Index: third_party/WebKit/Source/core/editing/CaretBase.cpp
diff --git a/third_party/WebKit/Source/core/editing/CaretBase.cpp b/third_party/WebKit/Source/core/editing/CaretBase.cpp
index 1b4a8f0db8493ee309eaced8f6f1e16349c86d6f..3a37af5290f8c760a08312865f05a3cee73e52fe 100644
--- a/third_party/WebKit/Source/core/editing/CaretBase.cpp
+++ b/third_party/WebKit/Source/core/editing/CaretBase.cpp
@@ -64,6 +64,8 @@ LayoutBlock* CaretBase::caretLayoutObject(Node* node)
 
     // if caretNode is a block and caret is inside it then caret should be painted by that block
     bool paintedByBlock = layoutObject->isLayoutBlock() && caretRendersInsideNode(node);
+    // caretRendersInsideNode can layout
+    layoutObject = node->layoutObject();

[yosin_UTC9, 2016/05/12 06:55:31]

We can't explain what this line does.
When layout tree changed, we need to re-validate selection to make selection
holds canonical positions.
Also, |caretLayoutObject()| should be called at least
DocumentLifeCycle::LayoutClean.

[yosin_UTC9, 2016/05/24 08:40:18]

Could you change this to below?
// TODO(yoichio): blah blah blah
CHECK_EQ(layoutObject, node->layoutObject()) << "Layout tree should not
changed";

[yoichio, 2016/05/25 06:46:50]

Done.

     return paintedByBlock ? toLayoutBlock(layoutObject) : layoutObject->containingBlock();
 }
 
@@ -128,6 +130,9 @@ IntRect CaretBase::absoluteBoundsForLocalRect(Node* node, const LayoutRect& rect
     return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
 }
 
+// TODO(yoichio): |node| is FrameSelection::m_previousCaretNode and this is bad
+// design. We should use only previous layoutObject or Rectangle to invalidate
+// old caret.
 void CaretBase::invalidateLocalCaretRect(Node* node, const LayoutRect& rect)
 {
     LayoutBlockItem caretPainter = LayoutBlockItem(caretLayoutObject(node));