Fix alignment issue of ContiguousContainer

third_party/WebKit/Source/platform/graphics/paint/DisplayItem.h

Index: third_party/WebKit/Source/platform/graphics/paint/DisplayItem.h
diff --git a/third_party/WebKit/Source/platform/graphics/paint/DisplayItem.h b/third_party/WebKit/Source/platform/graphics/paint/DisplayItem.h
index 94f60a12dee44e45e192353f555380960b9e3ff7..0b6982f06a15c0def42ebe1dc86271ad6b7e33a5 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/DisplayItem.h
+++ b/third_party/WebKit/Source/platform/graphics/paint/DisplayItem.h
@@ -198,10 +198,11 @@ public:
         TableCollapsedBorderLeft = 1 << 3,
     };
 
-    DisplayItem(const DisplayItemClient& client, Type type, size_t derivedSize)
+    DisplayItem(const DisplayItemClient& client, Type type, size_t derivedSize, size_t derivedAlignment)
         : m_client(&client)
         , m_type(type)
         , m_derivedSize(derivedSize)
+        , m_derivedAlignment(derivedAlignment)
         , m_skippedCache(false)
 #ifndef NDEBUG
         , m_clientDebugString(client.debugName())
@@ -209,8 +210,10 @@ public:
     {
         // derivedSize must fit in m_derivedSize.
         // If it doesn't, enlarge m_derivedSize and fix this assert.
-        ASSERT_WITH_SECURITY_IMPLICATION(derivedSize < (1 << 8));
-        ASSERT_WITH_SECURITY_IMPLICATION(derivedSize >= sizeof(*this));
+        SECURITY_CHECK(derivedSize == m_derivedSize);
+        SECURITY_CHECK(derivedSize >= sizeof(*this));
+        // derivedAlignment must fit in m_derivedAlignment.
+        SECURITY_CHECK(derivedAlignment == m_derivedAlignment);
     }
 
     virtual ~DisplayItem() { }
@@ -261,6 +264,9 @@ public:
     // supply this to the DisplayItem constructor.
     size_t derivedSize() const { return m_derivedSize; }
 
+    // Alignment (in bytes) of this object when this object is allocated in memory.
+    size_t derivedAlignment() const { return m_derivedAlignment; }
+
     // For PaintController only. Painters should use DisplayItemCacheSkipper instead.
     void setSkippedCache() { m_skippedCache = true; }
     bool skippedCache() const { return m_skippedCache; }
@@ -334,6 +340,7 @@ public:
         return m_client == other.m_client
             && m_type == other.m_type
             && m_derivedSize == other.m_derivedSize
+            && m_derivedAlignment == other.m_derivedAlignment
             && m_skippedCache == other.m_skippedCache;
     }
 #endif
@@ -361,19 +368,21 @@ private:
     // The default DisplayItem constructor is only used by
     // ContiguousContainer::appendByMoving where an invalid DisplaItem is
     // constructed at the source location.
-    template <typename T, unsigned alignment> friend class ContiguousContainer;
+    template <typename T> friend class ContiguousContainer;
 
     DisplayItem()
         : m_client(nullptr)
         , m_type(UninitializedType)
         , m_derivedSize(sizeof(*this))
+        , m_derivedAlignment(WTF_ALIGN_OF(DisplayItem))
         , m_skippedCache(false)
     { }
 
     const DisplayItemClient* m_client;
-    static_assert(TypeLast < (1 << 16), "DisplayItem::Type should fit in 16 bits");
-    const Type m_type : 16;
+    static_assert(TypeLast < (1 << 11), "DisplayItem::Type should fit in 16 bits");
+    const Type m_type : 11;
     const unsigned m_derivedSize : 8; // size of the actual derived class
+    const unsigned m_derivedAlignment : 5; // alignment of the actual derived class
     unsigned m_skippedCache : 1;
 
 #ifndef NDEBUG
@@ -381,17 +390,28 @@ private:
 #endif
 };
 
-class PLATFORM_EXPORT PairedBeginDisplayItem : public DisplayItem {
+template <typename T>
+class DisplayItemBase : public DisplayItem {
+protected:
+    DisplayItemBase(const DisplayItemClient& client, Type type)
+        : DisplayItem(client, type, sizeof(T), WTF_ALIGN_OF(T)) { }
+};
+
+template <typename T>
+class PairedBeginDisplayItem : public DisplayItemBase<T> {
 protected:
-    PairedBeginDisplayItem(const DisplayItemClient& client, Type type, size_t derivedSize) : DisplayItem(client, type, derivedSize) { }
+    PairedBeginDisplayItem(const DisplayItemClient& client, DisplayItem::Type type)
+        : DisplayItemBase<T>(client, type) { }
 
 private:
     bool isBegin() const final { return true; }
 };
 
-class PLATFORM_EXPORT PairedEndDisplayItem : public DisplayItem {
+template <typename T>
+class PairedEndDisplayItem : public DisplayItemBase<T> {
 protected:
-    PairedEndDisplayItem(const DisplayItemClient& client, Type type, size_t derivedSize) : DisplayItem(client, type, derivedSize) { }
+    PairedEndDisplayItem(const DisplayItemClient& client, DisplayItem::Type type)
+        : DisplayItemBase<T>(client, type) { }
 
 #if ENABLE(ASSERT)
     bool isEndAndPairedWith(DisplayItem::Type otherType) const override = 0;