[LayoutNG] Check consistency between NGPhysicalFragment and LayoutObject

This patch adds DCHECKs to check consistency between
NGPhysicalFragment and LayoutObject in construction, when
read from cache, and when NGPaintFragment is constructed.

These DCHECKs should catch when we have old fragments after
LayoutObject was changed, such as r671460
(crrev.com/c/1670146).

Change-Id: I65cb1d9080ca79d6ce904fd544500ab6d5909207
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1669916Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#671937}

third_party/blink/renderer/core/layout/layout_box.cc

@@ -2448,6 +2448,8 @@ scoped_refptr<const NGLayoutResult> LayoutBox::CachedLayoutResult(
   if (*out_cache_status == NGLayoutCacheStatus::kNeedsSimplifiedLayout)
     return nullptr;
 
+  physical_fragment.CheckType();
+
   DCHECK_EQ(*out_cache_status, NGLayoutCacheStatus::kHit);
 
   // We can safely re-use this fragment if we are positioned, and only our

third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.cc

@@ -261,6 +261,7 @@ scoped_refptr<const NGLayoutResult> NGBoxFragmentBuilder::ToBoxFragment(
 
   scoped_refptr<const NGPhysicalBoxFragment> fragment =
       NGPhysicalBoxFragment::Create(this, block_or_line_writing_mode);
+  fragment->CheckType();
 
   return base::AdoptRef(new NGLayoutResult(std::move(fragment), this));
 }

third_party/blink/renderer/core/layout/ng/ng_physical_fragment.cc

@@ -357,6 +357,58 @@ const NGPhysicalFragment* NGPhysicalFragment::PostLayout() const {
 }
 
 #if DCHECK_IS_ON()
+void NGPhysicalFragment::CheckType() const {
+  switch (Type()) {
+    case kFragmentBox:
+    case kFragmentRenderedLegend:
+      if (IsInlineBox()) {
+        DCHECK(layout_object_.IsLayoutInline());
+      } else {
+        DCHECK(layout_object_.IsBox());
+      }
+      if (IsColumnBox()) {
+        // TODO(kojii): Column box can fail following checks, needs review.
+        break;
+      }
+      if (layout_object_.IsLayoutNGListMarker()) {
+        // List marker is an atomic inline if it appears in a line box, or a
+        // block box.
+        DCHECK(!IsFloating());
+        DCHECK(!IsOutOfFlowPositioned());
+        DCHECK(IsAtomicInline() || (IsBox() && BoxType() == kBlockFlowRoot));
+        break;
+      }
+      DCHECK_EQ(IsFloating(), layout_object_.IsFloating());
+      DCHECK_EQ(IsOutOfFlowPositioned(),
+                layout_object_.IsOutOfFlowPositioned());
+      DCHECK_EQ(IsAtomicInline(), layout_object_.IsInline() &&
+                                      layout_object_.IsAtomicInlineLevel());
+      break;
+    case kFragmentText:
+      if (To<NGPhysicalTextFragment>(this)->IsGeneratedText()) {
+        // Ellipsis has the truncated in-flow LayoutObject.
+        DCHECK(layout_object_.IsText() ||
+               (layout_object_.IsInline() &&
+                layout_object_.IsAtomicInlineLevel()) ||
+               layout_object_.IsLayoutInline());
+      } else {
+        DCHECK(layout_object_.IsText());
+      }
+      DCHECK(!IsFloating());
+      DCHECK(!IsOutOfFlowPositioned());
+      DCHECK(!IsInlineBox());
+      DCHECK(!IsAtomicInline());
+      break;
+    case kFragmentLineBox:
+      DCHECK(layout_object_.IsLayoutBlockFlow());
+      DCHECK(!IsFloating());
+      DCHECK(!IsOutOfFlowPositioned());
+      DCHECK(!IsInlineBox());
+      DCHECK(!IsAtomicInline());
+      break;
+  }
+}
+
 void NGPhysicalFragment::CheckCanUpdateInkOverflow() const {
   if (!GetLayoutObject())
     return;

third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h

@@ -242,6 +242,7 @@ class CORE_EXPORT NGPhysicalFragment
 
   String ToString() const;
 
+  void CheckType() const;
   void CheckCanUpdateInkOverflow() const;
 
   enum DumpFlag {
@@ -335,6 +336,7 @@ struct CORE_EXPORT NGPhysicalFragmentWithOffset {
 };
 
 #if !DCHECK_IS_ON()
+inline void NGPhysicalFragment::CheckType() const {}
 inline void NGPhysicalFragment::CheckCanUpdateInkOverflow() const {}
 #endif
 

third_party/blink/renderer/core/paint/ng/ng_paint_fragment.cc

@@ -415,6 +415,8 @@ void NGPaintFragment::PopulateDescendants(CreateContext* parent_context) {
       !box_physical_fragment || box_physical_fragment->ChildrenInline();
 
   for (const NGLink& child_fragment : container.Children()) {
+    child_fragment->CheckType();
+
     // OOF objects are not needed because they always have self painting layer.
     if (UNLIKELY(child_fragment->IsOutOfFlowPositioned()))
       continue;