Add DCHECK that validates |LayoutBox::layout_results_|

This patch adds |DCHECK|s that check all |NGFragmentItem| in
|LayoutBox::layout_results_| are valid (i.e., not destroyed
nor removed from the tree.)

5 tests in |virtual/layout_ng_block_frag| fail, marked as
failures.

Bug: 829028, 982194
Change-Id: I4e3bdadaa129945fa2e5444d1c4fcb7002ee3347
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2291566
Commit-Queue: Koji Ishii <kojii@chromium.org>
Auto-Submit: Koji Ishii <kojii@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#788583}

third_party/blink/renderer/core/layout/layout_box.cc

@@ -2590,6 +2590,12 @@ void LayoutBox::AddLayoutResult(scoped_refptr<const NGLayoutResult> result,
   }
   const auto& fragment = To<NGPhysicalBoxFragment>(result->PhysicalFragment());
   layout_results_.push_back(std::move(result));
+#if DCHECK_IS_ON()
+  for (const NGPhysicalBoxFragment& fragment : PhysicalFragments()) {
+    if (const NGFragmentItems* fragment_items = fragment.Items())
+      fragment_items->CheckAllItemsAreValid();
+  }
+#endif
   // If this is the last fragment for the node, and its node establishes an
   // inline formatting context, we have some finalization to do.
   if (!fragment.BreakToken() && fragment.Items())
@@ -2622,6 +2628,12 @@ void LayoutBox::ReplaceLayoutResult(scoped_refptr<const NGLayoutResult> result,
     }
   }
   layout_results_[index] = std::move(result);
+#if DCHECK_IS_ON()
+  for (const NGPhysicalBoxFragment& fragment : PhysicalFragments()) {
+    if (const NGFragmentItems* fragment_items = fragment.Items())
+      fragment_items->CheckAllItemsAreValid();
+  }
+#endif
   // If this is the last fragment for the node, and its node establishes an
   // inline formatting context, we have some finalization to do.
   if (!fragment.BreakToken() && fragment.Items() && (index || got_new_fragment))

third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.cc

@@ -334,4 +334,11 @@ void NGFragmentItems::LayoutObjectWillBeDestroyed(
   }
 }
 
+#if DCHECK_IS_ON()
+void NGFragmentItems::CheckAllItemsAreValid() const {
+  for (const NGFragmentItem& item : Items())
+    DCHECK(!item.IsLayoutObjectDestroyedOrMoved());
+}
+#endif
+
 }  // namespace blink

third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.h

@@ -77,6 +77,10 @@ class CORE_EXPORT NGFragmentItems {
   }
   wtf_size_t ByteSize() const { return ByteSizeFor(Size()); }
 
+#if DCHECK_IS_ON()
+  void CheckAllItemsAreValid() const;
+#endif
+
  private:
   const NGFragmentItem* ItemsData() const { return items_; }
 

third_party/blink/web_tests/TestExpectations

@@ -1038,8 +1038,13 @@ crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/composited-opacity-2
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/composited-with-overflow-in-next-column.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/doubly-nested-with-top-padding-crossing-row-boundaries.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/dynamic/change-second-row-height.html [ Failure ]
+crbug.com/1105758 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-before-content.html [ Crash ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-into-stf-constrained-width.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-into-stf-unconstrained-width.html [ Failure ]
+crbug.com/1105758 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-pseudo-after-then-content.html [ Crash ]
+crbug.com/1105758 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-pseudo-before-after-in-content.html [ Crash ]
+crbug.com/1105758 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-pseudo-before-following-content.html [ Crash ]
+crbug.com/1105758 virtual/layout_ng_block_frag/fast/multicol/dynamic/insert-spanner-pseudo-before.html [ Crash ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/dynamic/relpos-becomes-static-has-abspos.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/dynamic/remove-column-content-next-to-abspos-between-spanners.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_block_frag/fast/multicol/dynamic/static-becomes-relpos-has-abspos.html [ Failure ]