commit f457e3c32b8170a39ead84ceaf9f0fdbe0696649
Author: Michael Lippautz <mlippautz@chromium.org>
Date:   Tue Oct 15 19:27:32 2024 +0000

    Fix size assertions across Blink
    
    The ASSERT_SIZE() macro is used to check that certain object sizes do
    not grow unexpectedly. Fix a few occurrences that assumed that Member
    is always the same size as debug builds may blow up the pointer size
    to allow verifying some conditions.
    
    Bug: 373485798
    Change-Id: I243dd7d75810e2cfda0141817986a6c4a03c6392
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5934877
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Reviewed-by: Steinar H Gunderson <sesse@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#1368939}

diff --git a/third_party/blink/renderer/core/css/css_selector.cc b/third_party/blink/renderer/core/css/css_selector.cc
index e9cd483e0ce13..3d99eab57489e 100644
--- a/third_party/blink/renderer/core/css/css_selector.cc
+++ b/third_party/blink/renderer/core/css/css_selector.cc
@@ -88,7 +88,11 @@ unsigned MaximumSpecificity(
 
 struct SameSizeAsCSSSelector {
   unsigned bitfields;
-  void* pointers[1];
+  union {
+    AtomicString value_;
+    QualifiedName tag_q_name_or_attribute_;
+    Member<void*> rare_data_;
+  } pointers;
 };
 
 ASSERT_SIZE(CSSSelector, SameSizeAsCSSSelector);
diff --git a/third_party/blink/renderer/core/css/resolver/match_result.h b/third_party/blink/renderer/core/css/resolver/match_result.h
index c99bae9777094..210ef8610b808 100644
--- a/third_party/blink/renderer/core/css/resolver/match_result.h
+++ b/third_party/blink/renderer/core/css/resolver/match_result.h
@@ -34,6 +34,7 @@
 #include "third_party/blink/renderer/core/dom/tree_scope.h"
 #include "third_party/blink/renderer/platform/heap/collection_support/heap_vector.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+#include "third_party/blink/renderer/platform/wtf/size_assertions.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
@@ -88,8 +89,13 @@ struct CORE_EXPORT MatchedProperties {
   Member<CSSPropertyValueSet> properties;
   Data data_;
 };
-static_assert(sizeof(MatchedProperties) <= 12,
-              "MatchedProperties should not grow without thinking");
+
+struct SameSizeAsMatchedProperties {
+  Member<void*> properties;
+  uint8_t data_[8];
+};
+
+ASSERT_SIZE(MatchedProperties, SameSizeAsMatchedProperties);
 
 }  // namespace blink
 
diff --git a/third_party/blink/renderer/core/dom/element_data.cc b/third_party/blink/renderer/core/dom/element_data.cc
index 0e616444cbf92..6f3592bfa907b 100644
--- a/third_party/blink/renderer/core/dom/element_data.cc
+++ b/third_party/blink/renderer/core/dom/element_data.cc
@@ -46,7 +46,8 @@ struct SameSizeAsElementData final
     : public GarbageCollected<SameSizeAsElementData> {
   unsigned bitfield;
   Member<void*> willbe_member;
-  void* pointers[2];
+  SpaceSplitString class_names_;
+  void* pointers[1];
 };
 
 ASSERT_SIZE(ElementData, SameSizeAsElementData);
diff --git a/third_party/blink/renderer/platform/fonts/shaping/shape_result.cc b/third_party/blink/renderer/platform/fonts/shaping/shape_result.cc
index 98a9f6988ae3d..68b3c922cb362 100644
--- a/third_party/blink/renderer/platform/fonts/shaping/shape_result.cc
+++ b/third_party/blink/renderer/platform/fonts/shaping/shape_result.cc
@@ -75,7 +75,7 @@ struct SameSizeAsRunInfo {
     void* pointers[2];
     unsigned integer;
   } glyph_data;
-  void* pointer;
+  Member<void*> pointer;
   Vector<int> vector;
   int integers[6];
 };