commit 8ab0cc40c5d9e34bd1a40fc4195a533ead6687bd
author Xiaocheng Hu <xiaochengh@chromium.org> Tue May 21 00:02:06 2019
committer Commit Bot <commit-bot@chromium.org> Tue May 21 00:02:06 2019
tree aa3bcdae28f6ea9554e6dcd1d5c7bed9e9318f16
parent 4347761af471013bcb4e68b2cbf3f41cffa55814

[LayoutNG] Downgrade unsafe access to NGOffsetMapping into a CHECK

We currently have some unsafe access to NGOffsetMapping while the block
was missed in previous layout. This patch blocks such access by adding
a CHECK.

We should fix the root cause later.

Bug: 962129
Change-Id: Ia661f29a8749a030a87658fb6060146c1a5baea0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1620773
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Cr-Commit-Position: refs/heads/master@{#661545}

third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
index 6d66215..e7462d8 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
@@ -442,6 +442,10 @@
     LayoutBlockFlow* layout_block_flow) {
   DCHECK(!layout_block_flow->GetDocument().NeedsLayoutTreeUpdate());
 
+  // TODO(crbug.com/962129): Fix the root cause of the missing layout, and turn
+  // this into a DCHECK.
+  CHECK(!layout_block_flow->NeedsLayout()) << layout_block_flow;
+
   // If |layout_block_flow| is LayoutNG, compute from |NGInlineNode|.
   if (layout_block_flow->IsLayoutNGMixin()) {
     NGInlineNode node(layout_block_flow);