Fix a crash when pseudo elements are used for a shadow host

third_party/WebKit/Source/core/dom/LayoutTreeBuilderTraversal.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 33 matching lines @@
     return false;
 }
 
 void ParentDetails::didTraverseInsertionPoint(const InsertionPoint* insertionPoint)
 {
     if (!m_insertionPoint) {
         m_insertionPoint = insertionPoint;
     }
 }
 
+inline static void assertPseudoElementParent(const PseudoElement& pseudoElement)
+{
+    DCHECK(pseudoElement.parentNode());
+    DCHECK(pseudoElement.parentNode()->canParticipateInFlatTree());
+}
+
 ContainerNode* parent(const Node& node, ParentDetails* details)
 {
-    // TODO(hayato): Uncomment this once we can be sure LayoutTreeBuilderTraversal::parent() is used only for a node in a document.
+    // TODO(hayato): Uncomment this once we can be sure LayoutTreeBuilderTraversal::parent() is used only for a node which is connected.
     // DCHECK(node.isConnected());
+    if (node.isPseudoElement()) {
+        assertPseudoElementParent(toPseudoElement(node));
+        return node.parentNode();
+    }
     return FlatTreeTraversal::parent(node, details);
 }
 
 Node* nextSibling(const Node& node)
 {
     if (node.isBeforePseudoElement()) {
-        if (Node* next = FlatTreeTraversal::firstChild(*FlatTreeTraversal::parent(node)))
+        assertPseudoElementParent(toPseudoElement(node));
+        if (Node* next = FlatTreeTraversal::firstChild(*node.parentNode()))
             return next;
     } else {
+        if (node.isAfterPseudoElement())
+            return nullptr;
         if (Node* next = FlatTreeTraversal::nextSibling(node))
             return next;
-        if (node.isAfterPseudoElement())
-            return 0;
     }
 
     Node* parent = FlatTreeTraversal::parent(node);
     if (parent && parent->isElementNode())
         return toElement(parent)->pseudoElement(PseudoIdAfter);
 
-    return 0;
+    return nullptr;
 }
 
 Node* previousSibling(const Node& node)
 {
     if (node.isAfterPseudoElement()) {
-        if (Node* previous = FlatTreeTraversal::lastChild(*FlatTreeTraversal::parent(node)))
+        assertPseudoElementParent(toPseudoElement(node));
+        if (Node* previous = FlatTreeTraversal::lastChild(*node.parentNode()))
             return previous;
     } else {
+        if (node.isBeforePseudoElement())
+            return nullptr;
         if (Node* previous = FlatTreeTraversal::previousSibling(node))
             return previous;
-        if (node.isBeforePseudoElement())
-            return 0;
     }
 
     Node* parent = FlatTreeTraversal::parent(node);
     if (parent && parent->isElementNode())
         return toElement(parent)->pseudoElement(PseudoIdBefore);
 
-    return 0;
+    return nullptr;
 }
 
 static Node* lastChild(const Node& node)
 {
     return FlatTreeTraversal::lastChild(node);
 }
 
 static Node* pseudoAwarePreviousSibling(const Node& node)
 {
     Node* previousNode = previousSibling(node);
@@ skipping 136 matching lines @@
     for (size_t i = position + 1; i < topLayerElements.size(); ++i) {
         if (LayoutObject* layoutObject = topLayerElements[i]->layoutObject())
             return layoutObject;
     }
     return 0;
 }
 
 } // namespace LayoutTreeBuilderTraversal
 
 } // namespace blink