Fix a crash when pseudo elements are used for a shadow host

third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 82 matching lines @@
     for (HTMLSlotElement* next = slot->assignedSlot(); next; next = next->assignedSlot()) {
         slot = next;
     }
     return slot;
 }
 
 // TODO(hayato): This may return a wrong result for a node which is not in a
 // document flat tree.  See FlatTreeTraversalTest's redistribution test for details.
 Node* FlatTreeTraversal::traverseSiblings(const Node& node, TraversalDirection direction)
 {
+    // TODO(hayato): Stop this hack for a pseudo element because a pseudo element should not be in a document flat tree.
+    if (node.isPseudoElement())
+        return direction == TraversalDirectionForward ? node.nextSibling() : node.previousSibling();

[rune, 2016/08/18 23:54:54]

Shouldn't LayoutTreeBuilderTraversal handle pseudo elements before
FlatTreeTraversal is called if pseudo elements are not part of the flat tree?

I don't understand why FlatTreeTraversal::nextSibling() is called _before_ the
check for isAfterPseudoElement() in LayoutTreeBuilderTraversal::nextSibling().

Would moving isAfterPseudoElement before the nextSibling call fix this issue?

[hayato, 2016/08/19 03:58:47]

Good point! I missed LayoutTreeBuilderTraversal.

I have updated the CL.

+
     if (node.isChildOfV1ShadowHost())
         return traverseSiblingsForV1HostChild(node, direction);
 
     if (shadowWhereNodeCanBeDistributed(node))
         return traverseSiblingsForV0Distribution(node, direction);
 
     if (Node* found = resolveDistributionStartingAt(direction == TraversalDirectionForward ? node.nextSibling() : node.previousSibling(), direction))
         return found;
 
     if (!node.isInV0ShadowTree())
@@ skipping 239 matching lines @@
 Node& FlatTreeTraversal::lastWithinOrSelf(const Node& node)
 {
     assertPrecondition(node);
     Node* lastDescendant = lastWithin(node);
     Node& result = lastDescendant ? *lastDescendant : const_cast<Node&>(node);
     assertPostcondition(&result);
     return result;
 }
 
 } // namespace blink