List marker pseudo elements.

Source/core/rendering/RenderObjectChildList.cpp

 /*
  * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 10 matching lines @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "core/rendering/RenderObjectChildList.h"
 
 #include "core/dom/AXObjectCache.h"
+#include "core/dom/MarkerPseudoElement.h"
 #include "core/layout/LayoutCounter.h"
 #include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderObject.h"
 #include "core/rendering/RenderView.h"
 #include "core/rendering/style/RenderStyle.h"
 
 namespace blink {
 
 void RenderObjectChildList::trace(Visitor* visitor)
 {
     visitor->trace(m_firstChild);
     visitor->trace(m_lastChild);
 }
 
 void RenderObjectChildList::destroyLeftoverChildren()
 {
     while (firstChild()) {
         // List markers are owned by their enclosing list and so don't get destroyed by this container.
         if (firstChild()->isListMarker()) {
-            firstChild()->remove();
+            if (RuntimeEnabledFeatures::listMarkerPseudoElementEnabled()) {

[Julien - ping for review, 2015/02/04 01:56:34]

Adding a branch here is not a great idea. It would be better if
MarkerPseudoElement handled it instead of in this general function.

[dsinclair, 2015/02/04 04:41:33]

The problem is, MarkerPseudoElement isn't invoked. The Marker can be inserted
into child renderers down the tree. That child renderer gets removed from the
tree. When we cleanup the RenderListMarker (which is the
MarkerPseudoElement->renderer()) we have to tell the MarkerPseudoElement that
we're going away. Otherwise, we end up destroying the RenderListMarker but
MarkerPseudoElement points at a renderer without a parent() which causes crashes
later.

Suggestions on a better way to handle this?

+                if (firstChild()->node() && firstChild()->node()->isMarkerPseudoElement() && firstChild()->node()->parentNode()) {
+                    toMarkerPseudoElement(firstChild()->node())->removeListMarker();
+                    firstChild()->destroy();
+                } else {
+                    firstChild()->remove();
+                }
+            } else {
+                firstChild()->remove();
+            }
             continue;
         }
 
         // Destroy any anonymous children remaining in the render tree, as well as implicit (shadow) DOM elements like those used in the engine-based text fields.
         if (firstChild()->node())
             firstChild()->node()->setRenderer(0);
         firstChild()->destroy();
     }
 }
 
@@ skipping 119 matching lines @@
         return;
     if (oldChild.isBody()) {
         oldChild.view()->setShouldDoFullPaintInvalidation();
         return;
     }
     DisableCompositingQueryAsserts disabler;
     oldChild.invalidatePaintUsingContainer(oldChild.containerForPaintInvalidation(), oldChild.previousPaintInvalidationRect(), PaintInvalidationRendererRemoval);
 }
 
 } // namespace blink