Insert CheckIsNotDestroyed() in all LayoutObject Methods

CheckIsNotDestroyed() will be used to ensure LayoutObject is not used after the Destroy() call once LayoutObject is moved to GarbageCollected.
CheckIsNotDestroyed() should be the first statement for all methods on LayoutObject and its subclasses.

Bug: 1030176
Change-Id: I4862ad8d068311b8cccf3881b21f0d62f787c333
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2409837
Commit-Queue: Keishi Hattori <keishi@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#809687}

third_party/blink/renderer/core/layout/layout_br.cc

@@ -38,6 +38,7 @@ LayoutBR::LayoutBR(Node* node) : LayoutText(node, NewlineString()) {}
 LayoutBR::~LayoutBR() = default;
 
 int LayoutBR::LineHeight(bool first_line) const {
+  CheckIsNotDestroyed();
   const ComputedStyle& style = StyleRef(
       first_line && GetDocument().GetStyleEngine().UsesFirstLineRules());
   return style.ComputedLineHeight();
@@ -45,22 +46,27 @@ int LayoutBR::LineHeight(bool first_line) const {
 
 void LayoutBR::StyleDidChange(StyleDifference diff,
                               const ComputedStyle* old_style) {
+  CheckIsNotDestroyed();
   LayoutText::StyleDidChange(diff, old_style);
 }
 
 int LayoutBR::CaretMinOffset() const {
+  CheckIsNotDestroyed();
   return 0;
 }
 
 int LayoutBR::CaretMaxOffset() const {
+  CheckIsNotDestroyed();
   return 1;
 }
 
 PositionWithAffinity LayoutBR::PositionForPoint(const PhysicalOffset&) const {
+  CheckIsNotDestroyed();
   return CreatePositionWithAffinity(0);
 }
 
 Position LayoutBR::PositionForCaretOffset(unsigned offset) const {
+  CheckIsNotDestroyed();
   DCHECK_LE(offset, 1u);
   DCHECK(GetNode());
   return offset ? Position::AfterNode(*GetNode())
@@ -69,6 +75,7 @@ Position LayoutBR::PositionForCaretOffset(unsigned offset) const {
 
 base::Optional<unsigned> LayoutBR::CaretOffsetForPosition(
     const Position& position) const {
+  CheckIsNotDestroyed();
   if (position.IsNull() || position.AnchorNode() != GetNode())
     return base::nullopt;
   DCHECK(position.IsBeforeAnchor() || position.IsAfterAnchor()) << position;

third_party/blink/renderer/core/layout/layout_br.h

@@ -32,7 +32,10 @@ class LayoutBR final : public LayoutText {
   explicit LayoutBR(Node*);
   ~LayoutBR() override;
 
-  const char* GetName() const override { return "LayoutBR"; }
+  const char* GetName() const override {
+    CheckIsNotDestroyed();
+    return "LayoutBR";
+  }
 
   // Although line breaks contain no actual text, if we're selected we need
   // to return a rect that includes space to illustrate a newline.
@@ -46,6 +49,7 @@ class LayoutBR final : public LayoutText {
               HashSet<const SimpleFontData*>* = nullptr /* fallbackFonts */,
               FloatRect* /* glyphBounds */ = nullptr,
               float /* expansion */ = false) const override {
+    CheckIsNotDestroyed();
     return 0;
   }
   float Width(unsigned /* from */,
@@ -56,12 +60,14 @@ class LayoutBR final : public LayoutText {
               HashSet<const SimpleFontData*>* = nullptr /* fallbackFonts */,
               FloatRect* /* glyphBounds */ = nullptr,
               float /* expansion */ = false) const override {
+    CheckIsNotDestroyed();
     return 0;
   }
 
   int LineHeight(bool first_line) const;
 
   bool IsOfType(LayoutObjectType type) const override {
+    CheckIsNotDestroyed();
     return type == kLayoutObjectBr || LayoutText::IsOfType(type);
   }
 

third_party/blink/renderer/core/layout/layout_button.cc

@@ -31,6 +31,7 @@ LayoutButton::~LayoutButton() = default;
 
 void LayoutButton::AddChild(LayoutObject* new_child,
                             LayoutObject* before_child) {
+  CheckIsNotDestroyed();
   if (!inner_) {
     // Create an anonymous block.
     DCHECK(!FirstChild());
@@ -42,6 +43,7 @@ void LayoutButton::AddChild(LayoutObject* new_child,
 }
 
 void LayoutButton::RemoveChild(LayoutObject* old_child) {
+  CheckIsNotDestroyed();
   if (old_child == inner_ || !inner_) {
     LayoutFlexibleBox::RemoveChild(old_child);
     inner_ = nullptr;
@@ -86,12 +88,14 @@ LayoutUnit LayoutButton::BaselinePosition(
     bool first_line,
     LineDirectionMode direction,
     LinePositionMode line_position_mode) const {
+  CheckIsNotDestroyed();
   DCHECK_EQ(line_position_mode, kPositionOnContainingLine);
   // We want to call the LayoutBlock version of firstLineBoxBaseline to
   // avoid LayoutFlexibleBox synthesizing a baseline that we don't want.
   // We use this check as a proxy for "are there any line boxes in this button"
   if (!HasLineIfEmpty() && !ShouldApplyLayoutContainment() &&
       LayoutBlock::FirstLineBoxBaseline() == -1) {
+    CheckIsNotDestroyed();
     // To ensure that we have a consistent baseline when we have no children,
     // even when we have the anonymous LayoutBlock child, we calculate the
     // baseline for the empty case manually here.

third_party/blink/renderer/core/layout/layout_button.h

@@ -36,8 +36,12 @@ class LayoutButton final : public LayoutFlexibleBox {
   explicit LayoutButton(Element*);
   ~LayoutButton() override;
 
-  const char* GetName() const override { return "LayoutButton"; }
+  const char* GetName() const override {
+    CheckIsNotDestroyed();
+    return "LayoutButton";
+  }
   bool IsOfType(LayoutObjectType type) const override {
+    CheckIsNotDestroyed();
     return type == kLayoutObjectLayoutButton ||
            LayoutFlexibleBox::IsOfType(type);
   }
@@ -45,8 +49,13 @@ class LayoutButton final : public LayoutFlexibleBox {
   void AddChild(LayoutObject* new_child,
                 LayoutObject* before_child = nullptr) override;
   void RemoveChild(LayoutObject*) override;
-  void RemoveLeftoverAnonymousBlock(LayoutBlock*) override {}
-  bool CreatesAnonymousWrapper() const override { return true; }
+  void RemoveLeftoverAnonymousBlock(LayoutBlock*) override {
+    CheckIsNotDestroyed();
+  }
+  bool CreatesAnonymousWrapper() const override {
+    CheckIsNotDestroyed();
+    return true;
+  }
 
   LayoutUnit BaselinePosition(FontBaseline,
                               bool first_line,

third_party/blink/renderer/core/layout/layout_counter.cc

@@ -495,6 +495,7 @@ LayoutCounter::LayoutCounter(PseudoElement& pseudo,
 LayoutCounter::~LayoutCounter() = default;
 
 void LayoutCounter::WillBeDestroyed() {
+  CheckIsNotDestroyed();
   if (counter_node_) {
     counter_node_->RemoveLayoutObject(this);
     DCHECK(!counter_node_);
@@ -505,6 +506,7 @@ void LayoutCounter::WillBeDestroyed() {
 }
 
 scoped_refptr<StringImpl> LayoutCounter::OriginalText() const {
+  CheckIsNotDestroyed();
   // Child will be the base of our text that we report. First, we need to find
   // an appropriate child.
   CounterNode* child = nullptr;
@@ -605,10 +607,12 @@ scoped_refptr<StringImpl> LayoutCounter::OriginalText() const {
 }
 
 void LayoutCounter::UpdateCounter() {
+  CheckIsNotDestroyed();
   SetTextIfNeeded(OriginalText());
 }
 
 void LayoutCounter::Invalidate() {
+  CheckIsNotDestroyed();
   counter_node_->RemoveLayoutObject(this);
   DCHECK(!counter_node_);
   if (DocumentBeingDestroyed())

third_party/blink/renderer/core/layout/layout_counter.h

@@ -71,13 +71,17 @@ class LayoutCounter final : public LayoutText {
 
   void UpdateCounter();
 
-  const char* GetName() const override { return "LayoutCounter"; }
+  const char* GetName() const override {
+    CheckIsNotDestroyed();
+    return "LayoutCounter";
+  }
 
  protected:
   void WillBeDestroyed() override;
 
  private:
   bool IsOfType(LayoutObjectType type) const override {
+    CheckIsNotDestroyed();
     return type == kLayoutObjectCounter || LayoutText::IsOfType(type);
   }
   scoped_refptr<StringImpl> OriginalText() const override;

third_party/blink/renderer/core/layout/layout_custom_scrollbar_part.h

@@ -41,9 +41,15 @@ class CORE_EXPORT LayoutCustomScrollbarPart final : public LayoutReplaced {
                                                     CustomScrollbar* = nullptr,
                                                     ScrollbarPart = kNoPart);
 
-  const char* GetName() const override { return "LayoutCustomScrollbarPart"; }
+  const char* GetName() const override {
+    CheckIsNotDestroyed();
+    return "LayoutCustomScrollbarPart";
+  }
 
-  PaintLayerType LayerTypeRequired() const override { return kNoPaintLayer; }
+  PaintLayerType LayerTypeRequired() const override {
+    CheckIsNotDestroyed();
+    return kNoPaintLayer;
+  }
 
   // Computes thickness of the scrollbar (which defines thickness of all parts).
   // For kScrollbarBGPart only. This can be called during style update.
@@ -64,10 +70,14 @@ class CORE_EXPORT LayoutCustomScrollbarPart final : public LayoutReplaced {
   LayoutUnit MarginRight() const override;
 
   bool IsOfType(LayoutObjectType type) const override {
+    CheckIsNotDestroyed();
     return type == kLayoutObjectLayoutCustomScrollbarPart ||
            LayoutReplaced::IsOfType(type);
   }
-  ScrollableArea* GetScrollableArea() const { return scrollable_area_; }
+  ScrollableArea* GetScrollableArea() const {
+    CheckIsNotDestroyed();
+    return scrollable_area_;
+  }
 
  private:
   LayoutCustomScrollbarPart(ScrollableArea*, CustomScrollbar*, ScrollbarPart);
@@ -79,22 +89,40 @@ class CORE_EXPORT LayoutCustomScrollbarPart final : public LayoutReplaced {
   // A scrollbar part's Location() and PhysicalLocation() are relative to the
   // scrollbar (instead of relative to any LayoutBox ancestor), and both are
   // in physical coordinates.
-  LayoutBox* LocationContainer() const override { return nullptr; }
+  LayoutBox* LocationContainer() const override {
+    CheckIsNotDestroyed();
+    return nullptr;
+  }
 
   // A scrollbar part is not in the layout tree and is not laid out like other
   // layout objects. CustomScrollbar will call scrollbar parts' SetFrameRect()
   // from its SetFrameRect() when needed.
-  void UpdateLayout() override { NOTREACHED(); }
+  void UpdateLayout() override {
+    CheckIsNotDestroyed();
+    NOTREACHED();
+  }
 
   // Have all padding getters return 0. The important point here is to avoid
   // resolving percents against the containing block, since scroll bar corners
   // don't always have one (so it would crash). Scroll bar corners are not
   // actually laid out, and they don't have child content, so what we return
   // here doesn't really matter.
-  LayoutUnit PaddingTop() const override { return LayoutUnit(); }
-  LayoutUnit PaddingBottom() const override { return LayoutUnit(); }
-  LayoutUnit PaddingLeft() const override { return LayoutUnit(); }
-  LayoutUnit PaddingRight() const override { return LayoutUnit(); }
+  LayoutUnit PaddingTop() const override {
+    CheckIsNotDestroyed();
+    return LayoutUnit();
+  }
+  LayoutUnit PaddingBottom() const override {
+    CheckIsNotDestroyed();
+    return LayoutUnit();
+  }
+  LayoutUnit PaddingLeft() const override {
+    CheckIsNotDestroyed();
+    return LayoutUnit();
+  }
+  LayoutUnit PaddingRight() const override {
+    CheckIsNotDestroyed();
+    return LayoutUnit();
+  }
 
   void SetNeedsPaintInvalidation();
 

third_party/blink/renderer/core/layout/layout_list_marker_image.h

@@ -18,6 +18,7 @@ class CORE_EXPORT LayoutListMarkerImage final : public LayoutImage {
   static LayoutListMarkerImage* CreateAnonymous(Document*);
 
   bool IsLayoutNGObject() const override {
+    CheckIsNotDestroyed();
     return IsLayoutNGObjectForListMarkerImage();
   }
   LayoutSize DefaultSize() const;

third_party/blink/renderer/core/layout/layout_slider_track.cc

@@ -41,6 +41,7 @@ LayoutSliderTrack::LayoutSliderTrack(Element* element)
     : LayoutBlockFlow(element) {}
 
 void LayoutSliderTrack::UpdateLayout() {
+  CheckIsNotDestroyed();
   auto* input = To<HTMLInputElement>(GetNode()->OwnerShadowHost());
   const bool is_vertical = !StyleRef().IsHorizontalWritingMode();