Fix assert failure in RenderObjectChildList::removeChildNode

Source/core/dom/NodeRenderingContext.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 57 matching lines @@
     , m_parentFlowRenderer(0)
 {
 }
 
 NodeRenderingContext::~NodeRenderingContext()
 {
 }
 
 static bool isRendererReparented(const RenderObject* renderer)
 {
-    if (!renderer->node()->isElementNode())
+    if (!renderer || !renderer->node() || !renderer->node()->isElementNode())
         return false;
     if (renderer->style() && !renderer->style()->flowThread().isEmpty())
         return true;
     if (toElement(renderer->node())->shouldBeReparentedUnderRenderView(renderer->style()))
         return true;
     return false;
 }
 
 RenderObject* NodeRenderingContext::nextRenderer() const
 {
@@ skipping 22 matching lines @@
     }
 
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
     // Avoid an O(N^2) problem with this function by not checking for
     // nextRenderer() when the parent element hasn't attached yet.
     if (m_renderingParent && !m_renderingParent->attached())
         return 0;
 
+    Element* fullScreenElement = element ? element->document()->webkitCurrentFullScreenElement() : 0;
     for (Node* sibling = NodeRenderingTraversal::nextSibling(m_node); sibling; sibling = NodeRenderingTraversal::nextSibling(sibling)) {
         RenderObject* renderer = sibling->renderer();
+        if (renderer && renderer->node() == fullScreenElement) {
+            // If the sibling node in DOM is the fullscreened element, the
+            // sibling renderer should be the RenderFullScreen object it's
+            // wrapped in.
+            renderer = element->document()->fullScreenRenderer();

[esprehn, 2013/05/14 21:32:28]

This doesn't seem like the right place to fix this, why doesn't the splitting
logic just walk up if the renderer is the full screen one?

[falken, 2013/05/15 01:46:36]

Yeah I thought optimistically that fixing it in NodeRenderingContext could fix
other errors of this class but it may be too invasive. I'll give a go at fixing
it in the splitting logic instead.

+        }
         if (renderer && !isRendererReparented(renderer))
             return renderer;
     }
 
     return 0;
 }
 
 RenderObject* NodeRenderingContext::previousRenderer() const
 {
     if (RenderObject* renderer = m_node->renderer())
@@ skipping 182 matching lines @@
     newRenderer->setFlowThreadState(parentRenderer->flowThreadState());
 
     RenderObject* nextRenderer = this->nextRenderer();
     textNode->setRenderer(newRenderer);
     // Parent takes care of the animations, no need to call setAnimatableStyle.
     newRenderer->setStyle(m_style.release());
     parentRenderer->addChild(newRenderer, nextRenderer);
 }
 
 }