Adding stylesheet candidates should not crash when the parser reorders the tree

Adding stylesheet candidates should not crash when the parser reorders the tree

The HTML parsing rules means nodes may get re-ordered. In the testcase the table
element is being seen in "in table mode", but the link inside it defaults to
"in body" mode. So the link ends up being inserted in the body and before
the style element in the table. DocumentOrderedList::parserAdd expects a new
node in the list to appear in the document after the last in the current list,
so calling that will trigger the ASSERT. Instead only call parserAdd when
the new node has no next sibling, if it has call DocumentOrderedList::add
which will find the correct position in the list.

BUG=334691
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=188181

[rwlbuis, 2015-01-09 23:28:04]

rob.buis@samsung.com changed reviewers:
+ esprehn@chromium.org

[rwlbuis, 2015-01-09 23:28:05]

PTAL

[esprehn, 2015-01-10 01:50:44]

lgtm

https://codereview.chromium.org/839303003/diff/20001/Source/core/dom/TreeScop...
File Source/core/dom/TreeScopeStyleSheetCollection.cpp (right):

https://codereview.chromium.org/839303003/diff/20001/Source/core/dom/TreeScop...
Source/core/dom/TreeScopeStyleSheetCollection.cpp:58: if (createdByParser &&
document().body() && !node->nextSibling())
I suspect this is wrong if there's mutation events, but I suspect there's no
hope there.

[rwlbuis, 2015-01-10 02:31:47]

The CQ bit was checked by rob.buis@samsung.com

[commit-bot: I haz the power, 2015-01-10 02:32:08]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/839303003/20001

[commit-bot: I haz the power, 2015-01-10 05:47:43]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=188181