[LayoutNG] Null-dereference in LayoutNGListItem::OrdinalValueChanged()
When LayoutNGListItem::OrdinalValueChanged() is called on an ":after"
list item element, |marker_| is a nullptr.
Similar to LayoutNGListItem::ListStyleTypeChanged(), we need to check
that |marker_| is not nullptr before invalidation to avoid
null-dereferences in this case.
Bug: 1020669
Change-Id: I66913cde0420a3612e881dab9e44a006c276ec64
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1902666
Commit-Queue: Alison Maher <almaher@microsoft.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#713894}
diff --git a/css/css-lists/ol-change-display-type-ref.html b/css/css-lists/ol-change-display-type-ref.html
new file mode 100644
index 0000000..a10bc17
--- /dev/null
+++ b/css/css-lists/ol-change-display-type-ref.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel=help href="https://crbug.com/1020669">
+<style>
+ .item {
+ display: list-item;
+ }
+ .item:after {
+ content: counter(section);
+ display: list-item;
+ }
+ .table-header {
+ display: table-header-group;
+ }
+</style>
+<body>
+ <ol reversed="reversed">
+ <span class="table-header">
+ <figure class="item"></figure>
+ </span>
+ </ol>
+</body>
+</html>
diff --git a/css/css-lists/ol-change-display-type.html b/css/css-lists/ol-change-display-type.html
new file mode 100644
index 0000000..e711cfe
--- /dev/null
+++ b/css/css-lists/ol-change-display-type.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Lists: Change display type of reverse ol list element.</title>
+<link rel=help href="https://crbug.com/1020669">
+<link rel=match href="ol-change-display-type-ref.html">
+<style>
+ .item {
+ display: list-item;
+ }
+ .item:after {
+ content: counter(section);
+ display: list-item;
+ }
+ .table-header {
+ display: table-header-group;
+ }
+</style>
+<body>
+ <ol reversed="reversed">
+ <span id="span">
+ <figure class="item"></figure>
+ </span>
+ </ol>
+</body>
+<script>
+ document.body.offsetTop;
+ document.getElementById('span').setAttribute('class', 'table-header');
+</script>
+</html>
