[asan][Editing] Check node->layoutObject in CaretBase::caretLayoutObject

third_party/WebKit/Source/core/editing/CaretBase.cpp

Index: third_party/WebKit/Source/core/editing/CaretBase.cpp
diff --git a/third_party/WebKit/Source/core/editing/CaretBase.cpp b/third_party/WebKit/Source/core/editing/CaretBase.cpp
index 0a75091c2c0c9988db03e251b9784d3d733c55f2..dc32b36d6c78caee7cc82cead2d4722df380afb9 100644
--- a/third_party/WebKit/Source/core/editing/CaretBase.cpp
+++ b/third_party/WebKit/Source/core/editing/CaretBase.cpp
@@ -70,6 +70,11 @@ LayoutBlock* CaretBase::caretLayoutObject(Node* node)
 
     // if caretNode is a block and caret is inside it then caret should be painted by that block
     bool paintedByBlock = layoutObject->isLayoutBlock() && caretRendersInsideNode(node);
+    // TODO(yoichio): This function is called at least
+    // DocumentLifeCycle::LayoutClean but caretRendersInsideNode above can
+    // layout. Thus |node->layoutObject()| can be changed then this is bad
+    // design. We should make caret painting algorithm clean.
+    CHECK_EQ(layoutObject, node->layoutObject()) << "Layout tree should not changed";
     return paintedByBlock ? toLayoutBlock(layoutObject) : layoutObject->containingBlock();
 }
 
@@ -134,6 +139,9 @@ IntRect CaretBase::absoluteBoundsForLocalRect(Node* node, const LayoutRect& rect
     return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
 }
 
+// TODO(yoichio): |node| is FrameSelection::m_previousCaretNode and this is bad
+// design. We should use only previous layoutObject or Rectangle to invalidate
+// old caret.
 void CaretBase::invalidateLocalCaretRect(Node* node, const LayoutRect& rect)
 {
     LayoutBlockItem caretPainter = LayoutBlockItem(caretLayoutObject(node));