Fix a crash when pseudo elements are used for a shadow host

third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp

Index: third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
diff --git a/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp b/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
index 06b2b29cee3bbf52179c973a42b3182b1a85eba4..691889b889681cea47cf44e3f54bdc5b526b72ad 100644
--- a/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/FlatTreeTraversal.cpp
@@ -100,6 +100,10 @@ static HTMLSlotElement* finalDestinationSlotFor(const Node& node)
 // document flat tree.  See FlatTreeTraversalTest's redistribution test for details.
 Node* FlatTreeTraversal::traverseSiblings(const Node& node, TraversalDirection direction)
 {
+    // TODO(hayato): Stop this hack for a pseudo element because a pseudo element should not be in a document flat tree.
+    if (node.isPseudoElement())
+        return direction == TraversalDirectionForward ? node.nextSibling() : node.previousSibling();

[rune, 2016/08/18 23:54:54]

Shouldn't LayoutTreeBuilderTraversal handle pseudo elements before
FlatTreeTraversal is called if pseudo elements are not part of the flat tree?

I don't understand why FlatTreeTraversal::nextSibling() is called _before_ the
check for isAfterPseudoElement() in LayoutTreeBuilderTraversal::nextSibling().

Would moving isAfterPseudoElement before the nextSibling call fix this issue?

[hayato, 2016/08/19 03:58:47]

Good point! I missed LayoutTreeBuilderTraversal.

I have updated the CL.

+
     if (node.isChildOfV1ShadowHost())
         return traverseSiblingsForV1HostChild(node, direction);