Use smart pointers for LegacyRootInlineBox and RenderFragmentedFlow

https://bugs.webkit.org/show_bug.cgi?id=263203
rdar://117027337

Reviewed by Antti Koivisto.

* Source/WebCore/layout/integration/inline/InlineIteratorLineBoxLegacyPath.h:
* Source/WebCore/rendering/RenderFragmentContainer.h:
(WebCore::RenderFragmentContainer::fragmentedFlow const):
* Source/WebCore/rendering/RenderMultiColumnSet.cpp:
(WebCore::RenderMultiColumnSet::containsRendererInFragmentedFlow const):
* Source/WebCore/rendering/line/LineLayoutState.h:
(WebCore::LineLayoutState::endLine const):
(WebCore::LineLayoutState::fragmentedFlow const):

Canonical link: https://commits.webkit.org/269488@main

Source/WebCore/layout/integration/inline/InlineIteratorLineBoxLegacyPath.h

@@ -114,7 +114,7 @@ class LineBoxIteratorLegacyPath {
     }
 
 private:
-    const LegacyRootInlineBox* m_rootInlineBox;
+    WeakPtr<const LegacyRootInlineBox> m_rootInlineBox;
 };
 
 }

Source/WebCore/rendering/RenderFragmentContainer.h

@@ -31,6 +31,7 @@
 
 #include "LayerFragment.h"
 #include "RenderBlockFlow.h"
+#include "RenderFragmentedFlow.h"
 #include "VisiblePosition.h"
 #include <memory>
 
@@ -55,7 +56,7 @@ class RenderFragmentContainer : public RenderBlockFlow {
     virtual void attachFragment();
     virtual void detachFragment();
 
-    RenderFragmentedFlow* fragmentedFlow() const { return m_fragmentedFlow; }
+    RenderFragmentedFlow* fragmentedFlow() const { return m_fragmentedFlow.get(); }
 
     // Valid fragments do not create circular dependencies with other flows.
     bool isValid() const { return m_isValid; }
@@ -144,7 +145,7 @@ class RenderFragmentContainer : public RenderBlockFlow {
     LayoutPoint mapFragmentPointIntoFragmentedFlowCoordinates(const LayoutPoint&);
 
 protected:
-    RenderFragmentedFlow* m_fragmentedFlow;
+    WeakPtr<RenderFragmentedFlow> m_fragmentedFlow;
 
 private:
     LayoutRect m_fragmentedFlowPortionRect;

Source/WebCore/rendering/RenderMultiColumnSet.cpp

@@ -108,7 +108,7 @@ bool RenderMultiColumnSet::containsRendererInFragmentedFlow(const RenderObject&
 {
     if (!previousSiblingMultiColumnSet() && !nextSiblingMultiColumnSet()) {
         // There is only one set. This is easy, then.
-        return renderer.isDescendantOf(m_fragmentedFlow);
+        return renderer.isDescendantOf(m_fragmentedFlow.get());
     }
 
     RenderObject* firstRenderer = firstRendererInFragmentedFlow();

Source/WebCore/rendering/line/LineLayoutState.h

@@ -35,6 +35,7 @@
 
 #include "LayoutRect.h"
 #include "RenderBlockFlow.h"
+#include "RenderFragmentedFlow.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
@@ -116,14 +117,13 @@ class LineLayoutState {
     LayoutUnit endLineLogicalTop() const { return m_endLineLogicalTop; }
     void setEndLineLogicalTop(LayoutUnit logicalTop) { m_endLineLogicalTop = logicalTop; }
 
-    LegacyRootInlineBox* endLine() const { return m_endLine; }
+    LegacyRootInlineBox* endLine() const { return m_endLine.get(); }
     void setEndLine(LegacyRootInlineBox* line) { m_endLine = line; }
 
     LayoutUnit adjustedLogicalLineTop() const { return m_adjustedLogicalLineTop; }
     void setAdjustedLogicalLineTop(LayoutUnit value) { m_adjustedLogicalLineTop = value; }
 
-    RenderFragmentedFlow* fragmentedFlow() const { return m_fragmentedFlow; }
-    void setFragmentedFlow(RenderFragmentedFlow* thread) { m_fragmentedFlow = thread; }
+    RenderFragmentedFlow* fragmentedFlow() const { return m_fragmentedFlow.get(); }
 
     bool endLineMatched() const { return m_endLineMatched; }
     void setEndLineMatched(bool endLineMatched) { m_endLineMatched = endLineMatched; }
@@ -156,11 +156,11 @@ class LineLayoutState {
 private:
     LineInfo m_lineInfo;
     LayoutUnit m_endLineLogicalTop;
-    LegacyRootInlineBox* m_endLine { nullptr };
+    WeakPtr<LegacyRootInlineBox> m_endLine;
 
     LayoutUnit m_adjustedLogicalLineTop;
 
-    RenderFragmentedFlow* m_fragmentedFlow { nullptr };
+    WeakPtr<RenderFragmentedFlow> m_fragmentedFlow;
 
     FloatList m_floatList;
     // FIXME: Should this be a range object instead of two ints?