List marker pseudo elements.

Source/core/rendering/RenderObjectChildList.cpp

Index: Source/core/rendering/RenderObjectChildList.cpp
diff --git a/Source/core/rendering/RenderObjectChildList.cpp b/Source/core/rendering/RenderObjectChildList.cpp
index 6369bdcd2a1e2f594e8cf63297a3cbb12a3514c1..bee520d00a8627032c23944cdc2bcf18466fb6a9 100644
--- a/Source/core/rendering/RenderObjectChildList.cpp
+++ b/Source/core/rendering/RenderObjectChildList.cpp
@@ -28,6 +28,7 @@
 #include "core/rendering/RenderObjectChildList.h"
 
 #include "core/dom/AXObjectCache.h"
+#include "core/dom/MarkerPseudoElement.h"
 #include "core/layout/LayoutCounter.h"
 #include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderObject.h"
@@ -47,7 +48,16 @@ void RenderObjectChildList::destroyLeftoverChildren()
     while (firstChild()) {
         // List markers are owned by their enclosing list and so don't get destroyed by this container.
         if (firstChild()->isListMarker()) {
-            firstChild()->remove();
+            if (RuntimeEnabledFeatures::listMarkerPseudoElementEnabled()) {

[Julien - ping for review, 2015/02/04 01:56:34]

Adding a branch here is not a great idea. It would be better if
MarkerPseudoElement handled it instead of in this general function.

[dsinclair, 2015/02/04 04:41:33]

The problem is, MarkerPseudoElement isn't invoked. The Marker can be inserted
into child renderers down the tree. That child renderer gets removed from the
tree. When we cleanup the RenderListMarker (which is the
MarkerPseudoElement->renderer()) we have to tell the MarkerPseudoElement that
we're going away. Otherwise, we end up destroying the RenderListMarker but
MarkerPseudoElement points at a renderer without a parent() which causes crashes
later.

Suggestions on a better way to handle this?

+                if (firstChild()->node() && firstChild()->node()->isMarkerPseudoElement() && firstChild()->node()->parentNode()) {
+                    toMarkerPseudoElement(firstChild()->node())->removeListMarker();
+                    firstChild()->destroy();
+                } else {
+                    firstChild()->remove();
+                }
+            } else {
+                firstChild()->remove();
+            }
             continue;
         }