Cherry pick 94857

[android-x86/external-webkit.git] / Source / WebCore / rendering / RenderObjectChildList.cpp

diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 4df7180..b6c7992 100644 (file)
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -129,8 +129,7 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
     oldChild->setNextSibling(0);
     oldChild->setParent(0);
 
-    if (oldChild->m_hasCounterNodeMap)
-        RenderCounter::destroyCounterNodes(oldChild);
+    RenderCounter::rendererRemovedFromTree(oldChild);
     RenderQuote::rendererRemovedFromTree(oldChild);
 
     if (AXObjectCache::accessibilityEnabled())
@@ -259,32 +258,7 @@ static RenderObject* findBeforeAfterParent(RenderObject* object)
     RenderObject* beforeAfterParent = object;
     while (beforeAfterParent && !(beforeAfterParent->isText() || beforeAfterParent->isImage()))
         beforeAfterParent = beforeAfterParent->firstChild();
-    return beforeAfterParent;
-}
-
-static void invalidateCountersInContainer(RenderObject* container, const AtomicString& identifier)
-{
-    if (!container)
-        return;
-    container = findBeforeAfterParent(container);
-    if (!container)
-        return;
-    // Sometimes the counter is attached directly on the container.
-    if (container->isCounter()) {
-        toRenderCounter(container)->invalidate(identifier);
-        return;
-    }
-    for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
-        if (content->isCounter())
-            toRenderCounter(content)->invalidate(identifier);
-    }
-}
-
-void RenderObjectChildList::invalidateCounters(const RenderObject* owner, const AtomicString& identifier)
-{
-    ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforePseudoElementRenderer(owner), identifier);
-    invalidateCountersInContainer(afterPseudoElementRenderer(owner), identifier);
+    return beforeAfterParent ? beforeAfterParent->parent() : 0;
 }
 
 RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObject* owner) const
@@ -297,7 +271,12 @@ RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObj
     do {
         // Skip list markers and generated run-ins
         first = first->firstChild();
-        while (first && (first->isListMarker() || (first->isRenderInline() && first->isRunIn() && first->isAnonymous())))
+        while (first && first->isListMarker()) {
+            if (first->parent() != owner && first->parent()->isAnonymousBlock())
+                first = first->parent();
+            first = first->nextSibling();
+        }
+        while (first && first->isRenderInline() && first->isRunIn())
             first = first->nextSibling();
     } while (first && first->isAnonymous() && first->style()->styleType() == NOPSEUDO);
 
@@ -319,7 +298,7 @@ RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObj
         // We still need to skip any list markers that could exist before the run-in.
         while (first && first->isListMarker())
             first = first->nextSibling();
-        if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn() && first->isAnonymous())
+        if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn())
             return first;
     }
     return 0;
@@ -481,6 +460,12 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                 ASSERT(styledObject->node()); // The styled object cannot be anonymous or else it could not have ':before' or ':after' pseudo elements.
                 generatedContentContainer->setNode(styledObject->node()); // This allows access to the generatingNode.
                 generatedContentContainer->setStyle(pseudoElementStyle);
+                if (!owner->isChildAllowed(generatedContentContainer, pseudoElementStyle)) {
+                    // The generated content container is not allowed here -> abort.
+                    generatedContentContainer->destroy();
+                    renderer->destroy();
+                    return;
+                }
                 owner->addChild(generatedContentContainer, insertBefore);
             }
             if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))