Revert "Make NGPaintFragment ref-counted"

This reverts commit 7dd4e161.

Reason for revert: Leak tests on Linux are failing since

https://ci.chromium.org/buildbot/chromium.webkit/WebKit%20Linux%20Trusty%20Leak/23587

Original change's description:
> Make NGPaintFragment ref-counted
> 
> This patch change |NGPaintFragmet| ref-counted instead of managed by
> |std::unique_ptr<T>| to resolve life time issue between |LayoutText|
> and |NGPaintFragment|.
> 
> Before this patch, paint fragment can live longer than |LayoutText|
> and causes heap-use-after tree in |NGAbstractTextBox::WillDestroy()|.
> 
> 
> Bug: 874588
> Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng;luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: Id2b59d9d8b257e7cf67ad841cd2fe5ad312951b0
> Reviewed-on: https://chromium-review.googlesource.com/1190625
> Commit-Queue: Yoshifumi Inoue <yosin@chromium.org>
> Reviewed-by: Koji Ishii <kojii@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#586658}

TBR=yosin@chromium.org,kojii@chromium.org

Change-Id: I2eb89ec4cf7aaf773189437dfe76d76ef49544b9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 874588
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng;luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1193864Reviewed-by: Markus Heintz <markusheintz@chromium.org>
Commit-Queue: Markus Heintz <markusheintz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#586681}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -63,9 +63,134 @@ crbug.com/591099 fast/dom/inner-text-first-letter.html [ Pass ]
 crbug.com/591099 fast/dom/nodesFromRect/nodesFromRect-basic.html [ Pass ]
 
 # New failures are appended below by the script.
-crbug.com/714962 accessibility/aria-roles.html [ Crash ]
-crbug.com/714962 accessibility/inline-text-changes.html [ Failure ]
-crbug.com/714962 accessibility/inline-text-bounds-for-range.html [ Failure ]
+crbug.com/874588 accessibility/adjacent-continuations-cause-assertion-failure.html [ Crash ]
+crbug.com/874588 accessibility/anonymous-render-block-in-continuation-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/aom-click-action.html [ Crash ]
+crbug.com/874588 accessibility/aom-computed-accessible-node.html [ Crash ]
+crbug.com/874588 accessibility/aom-computed-boolean-properties.html [ Crash ]
+crbug.com/874588 accessibility/aom-computed-int-properties.html [ Crash ]
+crbug.com/874588 accessibility/aom-computed-relation-accessors.html [ Crash ]
+crbug.com/874588 accessibility/aom-computed-string-properties.html [ Crash ]
+crbug.com/874588 accessibility/aom-relation-list-properties.html [ Crash ]
+crbug.com/874588 accessibility/aom-relation-properties.html [ Crash ]
+crbug.com/874588 accessibility/aom-string-properties.html [ Crash ]
+crbug.com/874588 accessibility/aom.html [ Crash ]
+crbug.com/874588 accessibility/appearance-affects-role.html [ Crash ]
+crbug.com/874588 accessibility/aria-checkbox-checked-mixed.html [ Crash ]
+crbug.com/874588 accessibility/aria-combo-box-with-delay-add.html [ Crash ]
+crbug.com/874588 accessibility/aria-combo-box-with-delay.html [ Crash ]
+crbug.com/874588 accessibility/aria-combo-box.html [ Crash ]
+crbug.com/874588 accessibility/aria-controls.html [ Crash ]
+crbug.com/874588 accessibility/aria-disabled.html [ Crash ]
+crbug.com/874588 accessibility/aria-flowto.html [ Crash ]
+crbug.com/874588 accessibility/aria-grid-readonly-propagation.html [ Crash ]
+crbug.com/874588 accessibility/aria-hidden-children-not-in-text-from-content.html [ Crash ]
+crbug.com/874588 accessibility/aria-hidden-hides-all-elements.html [ Crash ]
+crbug.com/874588 accessibility/aria-hidden-update.html [ Crash ]
+crbug.com/874588 accessibility/aria-hidden-updates-alldescendants.html [ Crash ]
+crbug.com/874588 accessibility/aria-hidden-with-elements.html [ Crash ]
+crbug.com/874588 accessibility/aria-hidden.html [ Crash ]
+crbug.com/874588 accessibility/aria-label.html [ Crash ]
+crbug.com/874588 accessibility/aria-labelledby-overrides-label.html [ Crash ]
+crbug.com/874588 accessibility/aria-modal.html [ Crash ]
+crbug.com/874588 accessibility/aria-option-role.html [ Crash ]
+crbug.com/874588 accessibility/aria-orientation.html [ Crash ]
+crbug.com/874588 accessibility/aria-owns-dynamic-changes.html [ Crash ]
+crbug.com/874588 accessibility/aria-owns-ignores-leafs.html [ Crash ]
+crbug.com/874588 accessibility/aria-owns-sends-notification.html [ Crash ]
+crbug.com/874588 accessibility/aria-owns.html [ Crash ]
+crbug.com/874588 accessibility/aria-relations-should-ignore-hidden-targets.html [ Crash ]
+crbug.com/874588 accessibility/aria-roles.html [ Crash ]
+crbug.com/874588 accessibility/aria-row-name.html [ Crash ]
+crbug.com/874588 accessibility/aria-tab-roles.html [ Crash ]
+crbug.com/874588 accessibility/aria-tables.html [ Crash ]
+crbug.com/874588 accessibility/aria-tree.html [ Crash ]
+crbug.com/874588 accessibility/aria-treeitem-checkable.html [ Crash ]
+crbug.com/874588 accessibility/aria1.1-combo-box-with-delay.html [ Crash ]
+crbug.com/874588 accessibility/aria1.1-combo-box.html [ Crash ]
+crbug.com/874588 accessibility/bounds-calc.html [ Crash ]
+crbug.com/874588 accessibility/br-element-has-correct-title.html [ Crash ]
+crbug.com/874588 accessibility/canvas-fallback-content-labels.html [ Crash ]
+crbug.com/874588 accessibility/container-node-delete-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/css-first-letter-children.html [ Crash ]
+crbug.com/874588 accessibility/css-generated-content.html [ Crash ]
+crbug.com/874588 accessibility/css-styles.html [ Crash ]
+crbug.com/874588 accessibility/default-language.html [ Crash ]
+crbug.com/874588 accessibility/description-calc-aria-describedby.html [ Crash ]
+crbug.com/874588 accessibility/description-calc-inputs.html [ Crash ]
+crbug.com/874588 accessibility/description-calc-summary.html [ Crash ]
+crbug.com/874588 accessibility/description-calc-table-caption.html [ Crash ]
+crbug.com/874588 accessibility/disabled-controls.html [ Crash ]
+crbug.com/874588 accessibility/disabled-not-selectable.html [ Crash ]
+crbug.com/874588 accessibility/dl-role.html [ Crash ]
+crbug.com/874588 accessibility/element-role-mapping-focusable.html [ Crash ]
+crbug.com/874588 accessibility/first-letter-text-transform-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/focus-action-clicks-element-in-active-descendant.html [ Crash ]
+crbug.com/874588 accessibility/idref-newlines.html [ Crash ]
+crbug.com/874588 accessibility/image-map-title-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/image-map-update-parent-crash.html [ Crash ]
+crbug.com/874588 accessibility/img-fallsback-to-title.html [ Crash ]
+crbug.com/874588 accessibility/in-page-link-target.html [ Crash ]
+crbug.com/874588 accessibility/inline-text-bidi-bounds-for-range.html [ Crash ]
+crbug.com/874588 accessibility/inline-text-bounds-for-range-br.html [ Crash ]
+crbug.com/874588 accessibility/inline-text-change-style.html [ Crash ]
+crbug.com/874588 accessibility/inline-text-changes.html [ Crash ]
+crbug.com/874588 accessibility/inline-text-word-boundaries.html [ Crash ]
+crbug.com/874588 accessibility/inline-text-word-boundary-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/input-aria-required.html [ Crash ]
+crbug.com/874588 accessibility/input-mixed.html [ Crash ]
+crbug.com/874588 accessibility/input-type-range-aria-value.html [ Crash ]
+crbug.com/874588 accessibility/input-type-range-value-change.html [ Crash ]
+crbug.com/874588 accessibility/input-type-text-caret-position.html [ Crash ]
+crbug.com/874588 accessibility/insert-adjacent-html-causes-crash.xhtml [ Crash ]
+crbug.com/874588 accessibility/insert-selected-option-into-select-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/label-for-control-hittest.html [ Crash ]
+crbug.com/874588 accessibility/language-meta-tag-dynamically-changing.html [ Crash ]
+crbug.com/874588 accessibility/link-inside-button-accessible-text.html [ Crash ]
+crbug.com/874588 accessibility/menu-item-crash.html [ Crash ]
+crbug.com/874588 accessibility/menu-list-popup-reuses-objects.html [ Crash ]
+crbug.com/874588 accessibility/menu-list-selection-changed.html [ Crash ]
+crbug.com/874588 accessibility/meter-value.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-aria-hidden.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-aria-label.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-aria-labelledby.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-figure.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-group-inside-treeitem.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-inputs.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-native-markup-buttons.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-native-markup-input-buttons.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-summary.html [ Crash ]
+crbug.com/874588 accessibility/name-calc-visibility.html [ Crash ]
+crbug.com/874588 accessibility/nochildren-elements.html [ Crash ]
+crbug.com/874588 accessibility/other-aria-attribute-change-sends-notification.html [ Crash ]
+crbug.com/874588 accessibility/presentation-owned-elements.html [ Crash ]
+crbug.com/874588 accessibility/presentational-leaf.html [ Crash Pass ]
+crbug.com/874588 accessibility/press-works-on-text-fields.html [ Crash ]
+crbug.com/874588 accessibility/removed-anonymous-block-child-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/render-counter-text.html [ Crash ]
+crbug.com/874588 accessibility/role-attribute.html [ Crash ]
+crbug.com/874588 accessibility/role-change.html [ Crash ]
+crbug.com/874588 accessibility/selection-change-notification-aria-textbox.html [ Crash ]
+crbug.com/874588 accessibility/selection-change-notification-input.html [ Crash ]
+crbug.com/874588 accessibility/selection-change-notification-statictext.html [ Crash ]
+crbug.com/874588 accessibility/selection-change-notification-textarea.html [ Crash ]
+crbug.com/874588 accessibility/selection-follows-focus.html [ Crash ]
+crbug.com/874588 accessibility/set-selection-child-offset.html [ Crash ]
+crbug.com/874588 accessibility/table-caption.html [ Crash ]
+crbug.com/874588 accessibility/table-cells-with-colspan.html [ Crash ]
+crbug.com/874588 accessibility/table-destroyed-crash.html [ Crash ]
+crbug.com/874588 accessibility/table-header-column-row.html [ Crash ]
+crbug.com/874588 accessibility/table-headers.html [ Crash ]
+crbug.com/874588 accessibility/table-row-with-aria-role.html [ Crash ]
+crbug.com/874588 accessibility/table-with-empty-thead-causes-crash.html [ Crash ]
+crbug.com/874588 accessibility/table-with-grid-roles.html [ Crash ]
+crbug.com/874588 accessibility/table-with-hidden-head-section.html [ Crash ]
+crbug.com/874588 accessibility/text-change-notification.html [ Crash ]
+crbug.com/874588 accessibility/text-changes-with-relations.html [ Crash ]
+crbug.com/874588 accessibility/textarea-caret-position.html [ Crash ]
+crbug.com/874588 accessibility/textarea-selection.html [ Crash ]
+crbug.com/874588 accessibility/title-ui-element-correctness.html [ Crash ]
+crbug.com/874588 accessibility/whitespace-in-name-calc.html [ Crash ]
 crbug.com/591099 animations/rotate-transform-equivalent.html [ Failure ]
 crbug.com/728378 compositing/culling/tile-occlusion-boundaries.html [ Failure ]
 crbug.com/591099 compositing/iframes/floating-self-painting-frame.html [ Failure ]

third_party/blink/renderer/core/layout/layout_inline.cc

@@ -75,14 +75,14 @@ LayoutInline::LayoutInline(Element* element)
   SetChildrenInline(true);
 }
 
-LayoutInline::~LayoutInline() {
 #if DCHECK_IS_ON()
+LayoutInline::~LayoutInline() {
   if (IsInLayoutNGInlineFormattingContext())
     DCHECK(!first_paint_fragment_);
   else
     line_boxes_.AssertIsEmpty();
-#endif
 }
+#endif
 
 LayoutInline* LayoutInline::CreateAnonymous(Document* document) {
   LayoutInline* layout_inline = new LayoutInline(nullptr);

third_party/blink/renderer/core/layout/layout_inline.h

@@ -116,7 +116,9 @@ class CORE_EXPORT LayoutInline : public LayoutBoxModelObject {
  public:
   explicit LayoutInline(Element*);
 
+#if DCHECK_IS_ON()
   ~LayoutInline() override;
+#endif
 
   static LayoutInline* CreateAnonymous(Document*);
 
@@ -375,7 +377,7 @@ class CORE_EXPORT LayoutInline : public LayoutBoxModelObject {
     LineBoxList line_boxes_;
     // The first fragment of inline boxes associated with this object.
     // Valid only when IsInLayoutNGInlineFormattingContext().
-    scoped_refptr<NGPaintFragment> first_paint_fragment_;
+    NGPaintFragment* first_paint_fragment_;
   };
 };
 
@@ -385,7 +387,7 @@ inline LineBoxList* LayoutInline::MutableLineBoxes() {
 }
 
 inline NGPaintFragment* LayoutInline::FirstInlineFragment() const {
-  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_.get()
+  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_
                                                : nullptr;
 }
 

third_party/blink/renderer/core/layout/layout_text.cc

@@ -143,14 +143,14 @@ LayoutText::LayoutText(Node* node, scoped_refptr<StringImpl> str)
     GetFrameView()->IncrementVisuallyNonEmptyCharacterCount(text_.length());
 }
 
-LayoutText::~LayoutText() {
 #if DCHECK_IS_ON()
+LayoutText::~LayoutText() {
   if (IsInLayoutNGInlineFormattingContext())
     DCHECK(!first_paint_fragment_);
   else
     text_boxes_.AssertIsEmpty();
-#endif
 }
+#endif
 
 LayoutText* LayoutText::CreateEmptyAnonymous(
     Document& doc,
@@ -251,15 +251,9 @@ void LayoutText::DeleteTextBoxes() {
     MutableTextBoxes().DeleteLineBoxes();
 }
 
-void LayoutText::SetFirstInlineFragment(NGPaintFragment* first_fragment) {
+void LayoutText::SetFirstInlineFragment(NGPaintFragment* fragment) {
   CHECK(IsInLayoutNGInlineFormattingContext());
-  // TODO(layout-dev): Because We should call |WillDestroy()| once for
-  // associated fragments, when you reuse fragments, you should construct
-  // NGAbstractInlineTextBox for them.
-  for (NGPaintFragment* fragment = first_paint_fragment_.get(); fragment;
-       fragment = fragment->Next())
-    NGAbstractInlineTextBox::WillDestroy(fragment);
-  first_paint_fragment_ = first_fragment;
+  first_paint_fragment_ = fragment;
 }
 
 void LayoutText::InLayoutNGInlineFormattingContextWillChange(bool new_value) {

third_party/blink/renderer/core/layout/layout_text.h

@@ -77,7 +77,9 @@ class CORE_EXPORT LayoutText : public LayoutObject {
   // doesn't re-transform the string.
   LayoutText(Node*, scoped_refptr<StringImpl>);
 
+#if DCHECK_IS_ON()
   ~LayoutText() override;
+#endif
 
   static LayoutText* CreateEmptyAnonymous(Document&,
                                           scoped_refptr<ComputedStyle>);
@@ -432,7 +434,7 @@ class CORE_EXPORT LayoutText : public LayoutObject {
     InlineTextBoxList text_boxes_;
     // The first fragment of text boxes associated with this object.
     // Valid only when IsInLayoutNGInlineFormattingContext().
-    scoped_refptr<NGPaintFragment> first_paint_fragment_;
+    NGPaintFragment* first_paint_fragment_;
   };
 };
 
@@ -442,7 +444,7 @@ inline InlineTextBoxList& LayoutText::MutableTextBoxes() {
 }
 
 inline NGPaintFragment* LayoutText::FirstInlineFragment() const {
-  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_.get()
+  return IsInLayoutNGInlineFormattingContext() ? first_paint_fragment_
                                                : nullptr;
 }
 

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.cc

@@ -262,7 +262,7 @@ LayoutNGMixin<Base>::CachedLayoutResultForTesting() {
 template <typename Base>
 void LayoutNGMixin<Base>::SetPaintFragment(
     NGPaintFragment* last_paint_fragment,
-    scoped_refptr<NGPaintFragment> paint_fragment) {
+    std::unique_ptr<NGPaintFragment> paint_fragment) {
   if (paint_fragment) {
     // When paint fragment is replaced, the subtree needs paint invalidation to
     // re-compute paint properties in NGPaintFragment.

third_party/blink/renderer/core/layout/ng/layout_ng_mixin.h

@@ -84,7 +84,7 @@ class LayoutNGMixin : public Base {
  private:
   void AddScrollingOverflowFromChildren();
   void SetPaintFragment(NGPaintFragment* last_paint_fragment,
-                        scoped_refptr<NGPaintFragment>);
+                        std::unique_ptr<NGPaintFragment>);
 
  protected:
   void AddOutlineRects(
@@ -100,7 +100,7 @@ class LayoutNGMixin : public Base {
 
   scoped_refptr<NGLayoutResult> cached_result_;
   scoped_refptr<const NGConstraintSpace> cached_constraint_space_;
-  scoped_refptr<NGPaintFragment> paint_fragment_;
+  std::unique_ptr<NGPaintFragment> paint_fragment_;
 
   friend class NGBaseLayoutAlgorithmTest;
 };

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -370,7 +370,7 @@ void NGBoxFragmentPainter::PaintBlockChildren(const PaintInfo& paint_info) {
 }
 
 void NGBoxFragmentPainter::PaintFloatingChildren(
-    const Vector<scoped_refptr<NGPaintFragment>>& children,
+    const Vector<std::unique_ptr<NGPaintFragment>>& children,
     const PaintInfo& paint_info) {
   for (const auto& child : children) {
     const NGPhysicalFragment& fragment = child->PhysicalFragment();
@@ -570,7 +570,7 @@ void NGBoxFragmentPainter::PaintAllPhasesAtomically(
 }
 
 void NGBoxFragmentPainter::PaintLineBoxChildren(
-    const Vector<scoped_refptr<NGPaintFragment>>& line_boxes,
+    const Vector<std::unique_ptr<NGPaintFragment>>& line_boxes,
     const PaintInfo& paint_info,
     const LayoutPoint& paint_offset) {
   DCHECK(!ShouldPaintSelfOutline(paint_info.phase) &&
@@ -613,7 +613,7 @@ void NGBoxFragmentPainter::PaintLineBoxChildren(
 }
 
 void NGBoxFragmentPainter::PaintInlineChildren(
-    const Vector<scoped_refptr<NGPaintFragment>>& inline_children,
+    const Vector<std::unique_ptr<NGPaintFragment>>& inline_children,
     const PaintInfo& paint_info,
     const LayoutPoint& paint_offset) {
   for (const auto& child : inline_children) {
@@ -628,7 +628,7 @@ void NGBoxFragmentPainter::PaintInlineChildren(
 }
 
 void NGBoxFragmentPainter::PaintInlineChildrenOutlines(
-    const Vector<scoped_refptr<NGPaintFragment>>& line_boxes,
+    const Vector<std::unique_ptr<NGPaintFragment>>& line_boxes,
     const PaintInfo& paint_info,
     const LayoutPoint& paint_offset) {
   // TODO(layout-dev): Implement.
@@ -1055,12 +1055,12 @@ bool NGBoxFragmentPainter::HitTestChildBoxFragment(
 
 bool NGBoxFragmentPainter::HitTestChildren(
     HitTestResult& result,
-    const Vector<scoped_refptr<NGPaintFragment>>& children,
+    const Vector<std::unique_ptr<NGPaintFragment>>& children,
     const HitTestLocation& location_in_container,
     const LayoutPoint& accumulated_offset,
     HitTestAction action) {
   for (auto iter = children.rbegin(); iter != children.rend(); iter++) {
-    const scoped_refptr<NGPaintFragment>& child = *iter;
+    const std::unique_ptr<NGPaintFragment>& child = *iter;
     if (child->HasSelfPaintingLayer())
       continue;
 

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.h

@@ -74,14 +74,14 @@ class NGBoxFragmentPainter : public BoxPainterBase {
   void PaintAllPhasesAtomically(const PaintInfo&,
                                 bool is_self_painting);
   void PaintBlockChildren(const PaintInfo&);
-  void PaintLineBoxChildren(const Vector<scoped_refptr<NGPaintFragment>>&,
+  void PaintLineBoxChildren(const Vector<std::unique_ptr<NGPaintFragment>>&,
                             const PaintInfo&,
                             const LayoutPoint& paint_offset);
-  void PaintInlineChildren(const Vector<scoped_refptr<NGPaintFragment>>&,
+  void PaintInlineChildren(const Vector<std::unique_ptr<NGPaintFragment>>&,
                            const PaintInfo&,
                            const LayoutPoint& paint_offset);
   void PaintInlineChildrenOutlines(
-      const Vector<scoped_refptr<NGPaintFragment>>&,
+      const Vector<std::unique_ptr<NGPaintFragment>>&,
       const PaintInfo&,
       const LayoutPoint& paint_offset);
   void PaintInlineChildBoxUsingLegacyFallback(const NGPhysicalFragment&,
@@ -95,7 +95,7 @@ class NGBoxFragmentPainter : public BoxPainterBase {
   void PaintTextChild(const NGPaintFragment&,
                       const PaintInfo&,
                       const LayoutPoint& paint_offset);
-  void PaintFloatingChildren(const Vector<scoped_refptr<NGPaintFragment>>&,
+  void PaintFloatingChildren(const Vector<std::unique_ptr<NGPaintFragment>>&,
                              const PaintInfo&);
   void PaintFloats(const PaintInfo&);
   void PaintMask(const PaintInfo&, const LayoutPoint& paint_offset);
@@ -120,7 +120,7 @@ class NGBoxFragmentPainter : public BoxPainterBase {
   // box in paint layer. Note that this includes scrolling offset when the
   // container has 'overflow: scroll'.
   bool HitTestChildren(HitTestResult&,
-                       const Vector<scoped_refptr<NGPaintFragment>>&,
+                       const Vector<std::unique_ptr<NGPaintFragment>>&,
                        const HitTestLocation& location_in_container,
                        const LayoutPoint& physical_offset,
                        HitTestAction);

third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc

@@ -13,6 +13,7 @@
 #include "third_party/blink/renderer/core/layout/layout_inline.h"
 #include "third_party/blink/renderer/core/layout/ng/geometry/ng_logical_rect.h"
 #include "third_party/blink/renderer/core/layout/ng/geometry/ng_physical_offset_rect.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/ng_abstract_inline_text_box.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/ng_caret_position.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.h"
@@ -157,14 +158,16 @@ NGPaintFragment::NGPaintFragment(
   DCHECK(physical_fragment_);
 }
 
-NGPaintFragment::~NGPaintFragment() = default;
+NGPaintFragment::~NGPaintFragment() {
+  NGAbstractInlineTextBox::WillDestroy(this);
+}
 
-scoped_refptr<NGPaintFragment> NGPaintFragment::Create(
+std::unique_ptr<NGPaintFragment> NGPaintFragment::Create(
     scoped_refptr<const NGPhysicalFragment> fragment) {
   DCHECK(fragment);
 
-  scoped_refptr<NGPaintFragment> paint_fragment =
-      base::AdoptRef(new NGPaintFragment(std::move(fragment), nullptr));
+  std::unique_ptr<NGPaintFragment> paint_fragment =
+      std::make_unique<NGPaintFragment>(std::move(fragment), nullptr);
 
   HashMap<const LayoutObject*, NGPaintFragment*> last_fragment_map;
   paint_fragment->PopulateDescendants(NGPhysicalOffset(),
@@ -210,7 +213,7 @@ NGPaintFragment* NGPaintFragment::Last() {
   }
 }
 
-void NGPaintFragment::SetNext(scoped_refptr<NGPaintFragment> fragment) {
+void NGPaintFragment::SetNext(std::unique_ptr<NGPaintFragment> fragment) {
   next_fragmented_ = std::move(fragment);
 }
 
@@ -260,8 +263,8 @@ void NGPaintFragment::PopulateDescendants(
   children_.ReserveCapacity(container.Children().size());
 
   for (const auto& child_fragment : container.Children()) {
-    scoped_refptr<NGPaintFragment> child =
-        base::AdoptRef(new NGPaintFragment(child_fragment, this));
+    std::unique_ptr<NGPaintFragment> child =
+        std::make_unique<NGPaintFragment>(child_fragment, this);
 
     if (!child_fragment->IsFloating() &&
         !child_fragment->IsOutOfFlowPositioned() &&

third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h

@@ -34,13 +34,12 @@ struct PaintInfo;
 //   (See https://drafts.csswg.org/css-backgrounds-3/#the-background-image)
 // - image (<img>, svg <image>) or video (<video>) elements that are
 //   placeholders for displaying them.
-class CORE_EXPORT NGPaintFragment : public RefCounted<NGPaintFragment>,
-                                    public DisplayItemClient,
+class CORE_EXPORT NGPaintFragment : public DisplayItemClient,
                                     public ImageResourceObserver {
  public:
   NGPaintFragment(scoped_refptr<const NGPhysicalFragment>, NGPaintFragment*);
   ~NGPaintFragment() override;
-  static scoped_refptr<NGPaintFragment> Create(
+  static std::unique_ptr<NGPaintFragment> Create(
       scoped_refptr<const NGPhysicalFragment>);
 
   const NGPhysicalFragment& PhysicalFragment() const {
@@ -52,15 +51,15 @@ class CORE_EXPORT NGPaintFragment : public RefCounted<NGPaintFragment>,
 
   // Next/last fragment for  when this is fragmented.
   NGPaintFragment* Next() { return next_fragmented_.get(); }
-  void SetNext(scoped_refptr<NGPaintFragment>);
+  void SetNext(std::unique_ptr<NGPaintFragment>);
   NGPaintFragment* Last();
   NGPaintFragment* Last(const NGBreakToken&);
 
   // The parent NGPaintFragment. This is nullptr for a root; i.e., when parent
   // is not for NGPaint. In the first phase, this means that this is a root of
   // an inline formatting context.
-  NGPaintFragment* Parent() const { return parent_.get(); }
-  const Vector<scoped_refptr<NGPaintFragment>>& Children() const {
+  NGPaintFragment* Parent() const { return parent_; }
+  const Vector<std::unique_ptr<NGPaintFragment>>& Children() const {
     return children_;
   }
   // Note, as the name implies, |IsDescendantOfNotSelf| returns false for the
@@ -178,7 +177,7 @@ class CORE_EXPORT NGPaintFragment : public RefCounted<NGPaintFragment>,
       NGPaintFragment* operator->() const { return current_; }
       iterator& operator++() {
         CHECK(current_);
-        current_ = current_->next_fragment_.get();
+        current_ = current_->next_fragment_;
         return *this;
       }
       bool operator==(const iterator& other) const {
@@ -251,13 +250,13 @@ class CORE_EXPORT NGPaintFragment : public RefCounted<NGPaintFragment>,
 
   scoped_refptr<const NGPhysicalFragment> physical_fragment_;
 
-  scoped_refptr<NGPaintFragment> parent_;
-  Vector<scoped_refptr<NGPaintFragment>> children_;
+  NGPaintFragment* parent_;
+  Vector<std::unique_ptr<NGPaintFragment>> children_;
 
   // The next fragment for when this is fragmented.
-  scoped_refptr<NGPaintFragment> next_fragmented_;
+  std::unique_ptr<NGPaintFragment> next_fragmented_;
 
-  scoped_refptr<NGPaintFragment> next_fragment_;
+  NGPaintFragment* next_fragment_ = nullptr;
   NGPhysicalOffset inline_offset_to_container_box_;
 
   //

third_party/blink/renderer/core/paint/ng/ng_paint_fragment_traversal_test.cc

@@ -27,7 +27,7 @@ class NGPaintFragmentTraversalTest : public RenderingTest,
     root_fragment_ = layout_block_flow_->PaintFragment();
   }
 
-  const Vector<scoped_refptr<NGPaintFragment>>& RootChildren() const {
+  const Vector<std::unique_ptr<NGPaintFragment>>& RootChildren() const {
     return root_fragment_->Children();
   }