commit 4574e93002d372638f89690936741e06d93d5982
author Koji Ishii <kojii@chromium.org> Tue Jan 08 16:58:50 2019
committer Commit Bot <commit-bot@chromium.org> Tue Jan 08 16:58:50 2019
tree 1356893128662b4f5e7769055274f58868e4dbb3
parent 78b7b2d74c466e9b0f79446e5499d957970a0d56

[LayoutNG] Avoid destroying NGListMarker in DestroyLeftoverChildren

This patch avoids destroying NGListMarker, as
DestroyLeftoverChildren() does so for non-NG ListMarker.

This fix is speculative. I could not reproduce the problem,
but this seems to be the possible cause from the crash dump.

Bug: 919764
Change-Id: I50e56ecec9e68a32fcb3eed7c4ac84ae04865a43
Reviewed-on: https://chromium-review.googlesource.com/c/1399693
Commit-Queue: Koji Ishii <kojii@chromium.org>
Commit-Queue: Emil A Eklund <eae@chromium.org>
Reviewed-by: Emil A Eklund <eae@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#620760}

third_party/blink/renderer/core/layout/layout_object_child_list.cc

diff --git a/third_party/blink/renderer/core/layout/layout_object_child_list.cc b/third_party/blink/renderer/core/layout/layout_object_child_list.cc
index 444162ba..3541cca6 100644
--- a/third_party/blink/renderer/core/layout/layout_object_child_list.cc
+++ b/third_party/blink/renderer/core/layout/layout_object_child_list.cc
@@ -62,7 +62,7 @@
   while (FirstChild()) {
     // List markers are owned by their enclosing list and so don't get destroyed
     // by this container.
-    if (FirstChild()->IsListMarker()) {
+    if (FirstChild()->IsListMarkerIncludingNG()) {
       FirstChild()->Remove();
       continue;
     }