[LayoutNG] Change list markers to out-of-flow for tree building

Following CL:919443, this patch implements list-item further for
block-level content, and unifies the positioning logic with the
logic for inline content.

The anonymous blocks that wrap list markers were not easy that
this patch changes the tree building (LayoutBlockFlow::AddChild)
to handle LayoutNGListMarker as out-of-flow. However, setting
the out-of-flow properties (e.g., position: absolute) affects
many parts of the code base that it is limited only for the
tree building purpose.

Also, in order for the list item block to position its list
marker, NGInlineLayoutAlgorithm no longer positions it. Instead,
the |unpositioned_list_marker_| is moved to NGLayoutResult,
which propagates from line box to the nearest list item block.

Other logic are still in NGInlineLayoutAlgorithm because list
markers forces the line box not empty.

NGBoxFragmentPainter needs a minor change because by adding
list markers to list items, it may appear along with line boxes.

20 tests turned to pass, including some rebaselines for text
rendering differences. 4 tests regressed, that are
1. 'display: contents'; the tree building change needs to take
   this into account.
2. When inside/outside are changed from JS, we fail to compute
   the baseline.
I will investigate them, along with tests that still don't pass
in following patches.

Bug: 725277
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_layout_ng;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I09eb80b3a24a17b8841b4b200ff5d4a249c81853
Reviewed-on: https://chromium-review.googlesource.com/925381Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539144}

third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -942,12 +942,15 @@ crbug.com/591099 external/wpt/css/css-backgrounds/box-shadow-syntax-001.xht [ Fa
 crbug.com/591099 external/wpt/css/css-display/display-contents-details.html [ Crash ]
 crbug.com/714962 external/wpt/css/css-display/display-contents-dynamic-before-after-001.html [ Failure ]
 crbug.com/714962 external/wpt/css/css-display/display-contents-dynamic-before-after-first-letter-001.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-display/display-contents-dynamic-list-001-inline.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-display/display-contents-dynamic-list-001-none.html [ Failure ]
 crbug.com/714962 external/wpt/css/css-display/display-contents-dynamic-multicol-001-inline.html [ Failure ]
 crbug.com/714962 external/wpt/css/css-display/display-contents-dynamic-multicol-001-none.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-display/display-contents-dynamic-table-001-inline.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-display/display-contents-dynamic-table-002-inline.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-display/display-contents-dynamic-table-002-none.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-display/display-contents-fieldset-nested-legend.html [ Pass ]
+crbug.com/591099 external/wpt/css/css-display/display-contents-list-001.html [ Failure ]
 crbug.com/714962 external/wpt/css/css-display/display-contents-multicol-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-display/display-contents-text-inherit.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-flexbox/flex-aspect-ratio-img-column-002.html [ Pass ]
@@ -1927,15 +1930,8 @@ crbug.com/591099 external/wpt/html/rendering/replaced-elements/svg-inline-sizing
 crbug.com/714962 external/wpt/html/rendering/the-css-user-agent-style-sheet-and-presentational-hints/body-bgcolor-attribute-change.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/document-metadata/the-link-element/stylesheet-change-href.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/embedded-content/media-elements/track/track-element/track-webvtt-non-snap-to-lines.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-002.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-list-owner-menu.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-list-owner-skip-no-boxes.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-rev-reftest-001.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-start-reftest-001.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-start-reftest-002.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-type-reftest-001.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-type-reftest-002.html [ Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-type-reftest-003.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-dialog-element/abspos-dialog-layout.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-dialog-element/centering.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/scripting-1/the-script-element/execution-timing/078.html [ Timeout ]
@@ -3196,37 +3192,25 @@ crbug.com/591099 fast/layers/scroll-rect-to-visible.html [ Failure ]
 crbug.com/591099 fast/lists/001-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/001.html [ Failure ]
 crbug.com/591099 fast/lists/002-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/002.html [ Failure ]
 crbug.com/591099 fast/lists/003-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/003.html [ Failure ]
 crbug.com/591099 fast/lists/004.html [ Failure ]
 crbug.com/591099 fast/lists/005-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/006-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/007-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/007.html [ Failure ]
 crbug.com/591099 fast/lists/008-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/008.html [ Failure ]
 crbug.com/591099 fast/lists/009-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/009.html [ Failure ]
-crbug.com/591099 fast/lists/alpha-boundary-values.html [ Failure ]
-crbug.com/591099 fast/lists/alpha-list-wrap.html [ Failure ]
 crbug.com/591099 fast/lists/calc-width-with-space.html [ Failure ]
 crbug.com/591099 fast/lists/drag-into-marker.html [ Failure ]
-crbug.com/591099 fast/lists/dynamic-marker-crash.html [ Failure ]
 crbug.com/591099 fast/lists/inline-before-content-after-list-marker.html [ Failure ]
-crbug.com/591099 fast/lists/list-and-grid.html [ Failure ]
+crbug.com/591099 fast/lists/li-with-overflow-hidden-change-list-style-position.html [ Failure ]
 crbug.com/591099 fast/lists/list-color-change-no-layout.html [ Failure ]
 crbug.com/591099 fast/lists/list-inside-columns-crash.html [ Crash ]
 crbug.com/591099 fast/lists/list-item-line-height.html [ Failure ]
 crbug.com/591099 fast/lists/list-marker-before-content-table.html [ Failure ]
-crbug.com/591099 fast/lists/list-marker-before-float-nested-rtl.html [ Failure ]
-crbug.com/591099 fast/lists/list-marker-before-float-nested.html [ Failure ]
-crbug.com/591099 fast/lists/list-marker-before-float-rtl.html [ Failure ]
-crbug.com/591099 fast/lists/list-marker-before-float.html [ Failure ]
-crbug.com/591099 fast/lists/list-marker-inside-overflow-hidden.html [ Failure ]
 crbug.com/591099 fast/lists/marker-before-empty-inline.html [ Failure ]
 crbug.com/591099 fast/lists/markers-in-selection.html [ Failure ]
-crbug.com/591099 fast/lists/ordered-list-with-no-ol-tag.html [ Failure ]
 crbug.com/591099 fast/loader/child-frame-add-after-back-forward.html [ Failure ]
 crbug.com/591099 fast/loader/frame-creation-removal.html [ Failure ]
 crbug.com/591099 fast/loader/local-CSS-from-local.html [ Failure ]

third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.txt

@@ -37,10 +37,10 @@ layer at (0,0) size 785x849 backgroundClip at (0,0) size 785x600 clip at (0,0) s
           LayoutText {#text} at (0,0) size 189x19
             text run at (0,0) width 189: "This list item should be blue..."
         LayoutNGListItem {LI} at (40,20) size 729x80 [color=#0000FF]
+          LayoutNGListMarker (anonymous) at (-18,0) size 10x20
+            LayoutText (anonymous) at (0,0) size 10x19
+              text run at (0,0) width 10: "\x{2022} "
           LayoutNGBlockFlow (anonymous) at (0,0) size 729x20
-            LayoutNGListMarker (anonymous) at (-18,0) size 10x20
-              LayoutText (anonymous) at (0,0) size 10x19
-                text run at (0,0) width 10: "\x{2022} "
             LayoutText {#text} at (0,0) size 289x19
               text run at (0,0) width 289: "...and so should this; neither should be purple."
           LayoutNGBlockFlow {UL} at (0,20) size 729x60
@@ -114,10 +114,10 @@ layer at (0,0) size 785x849 backgroundClip at (0,0) size 785x600 clip at (0,0) s
                   LayoutText {#text} at (0,0) size 189x19
                     text run at (0,0) width 189: "This list item should be blue..."
                 LayoutNGListItem {LI} at (40,20) size 643x80 [color=#0000FF]
+                  LayoutNGListMarker (anonymous) at (-18,0) size 10x20
+                    LayoutText (anonymous) at (0,0) size 10x19
+                      text run at (0,0) width 10: "\x{2022} "
                   LayoutNGBlockFlow (anonymous) at (0,0) size 643x20
-                    LayoutNGListMarker (anonymous) at (-18,0) size 10x20
-                      LayoutText (anonymous) at (0,0) size 10x19
-                        text run at (0,0) width 10: "\x{2022} "
                     LayoutText {#text} at (0,0) size 289x19
                       text run at (0,0) width 289: "...and so should this; neither should be purple."
                   LayoutNGBlockFlow {UL} at (0,20) size 643x60

third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/alpha-boundary-values-expected.txt

+A
+B
+Y
+Z
+AA
+AB
+YZ
+ZA
+ZB
+ZZ
+AAA
+AAB
+ZZY
+ZZZ
+AAAA
+AAAB
+AAAC
+

third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/alpha-list-wrap-expected.txt

+V
+W
+X
+Y
+Z
+AA
+AB
+AC
+AD
+AE
+AF
+AG
+AH
+AI
+AJ
+AK
+AL
+AM
+AN
+AO
+AP
+AQ
+AR
+AS
+AT
+AU
+AV
+AW
+AX
+AY
+AZ
+BA
+BB
+BC
+BD
+BE
+BF
+BG
+BH
+BI
+BJ
+BK
+BL
+BM
+BN
+BO
+BP
+BQ
+BR
+BS
+BT
+BU
+BV
+BW
+BX
+BY
+BZ
+CA
+CB
+

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

@@ -3113,7 +3113,9 @@ void LayoutBlockFlow::AddChild(LayoutObject* new_child,
       return;
     }
 
-    if (new_child->IsInline()) {
+    // LayoutNGListMarker is out-of-flow for the tree building purpose, and that
+    // is not inline level, but IsInline().
+    if (new_child->IsInline() && !new_child->IsLayoutNGListMarker()) {
       // No suitable existing anonymous box - create a new one.
       LayoutBlockFlow* new_block = ToLayoutBlockFlow(CreateAnonymousBlock());
       LayoutBox::AddChild(new_block, before_child);
@@ -3444,6 +3446,12 @@ static void GetInlineRun(LayoutObject* start,
 
   // Start by skipping as many non-inlines as we can.
   LayoutObject* curr = start;
+
+  // LayoutNGListMarker is out-of-flow for the tree building purpose. Skip here
+  // because it's the first child.
+  if (curr && curr->IsLayoutNGListMarker())
+    curr = curr->NextSibling();
+
   bool saw_inline;
   do {
     while (curr &&
@@ -3505,7 +3513,7 @@ void LayoutBlockFlow::MakeChildrenNonInline(LayoutObject* insertion_point) {
 
 #if DCHECK_IS_ON()
   for (LayoutObject* c = FirstChild(); c; c = c->NextSibling())
-    DCHECK(!c->IsInline());
+    DCHECK(!c->IsInline() || c->IsLayoutNGListMarker());
 #endif
 
   SetShouldDoFullPaintInvalidation();

third_party/WebKit/Source/core/layout/ng/inline/ng_inline_layout_algorithm.cc

@@ -108,7 +108,6 @@ void NGInlineLayoutAlgorithm::CreateLine(NGLineInfo* line_info,
 
   NGTextFragmentBuilder text_builder(Node(),
                                      ConstraintSpace().GetWritingMode());
-  Optional<unsigned> list_marker_index;
 
   // Compute heights of all inline items by placing the dominant baseline at 0.
   // The baseline is adjusted after the height of the line box is computed.
@@ -165,9 +164,7 @@ void NGInlineLayoutAlgorithm::CreateLine(NGLineInfo* line_info,
     } else if (item.Type() == NGInlineItem::kAtomicInline) {
       box = PlaceAtomicInline(item, &item_result, *line_info);
     } else if (item.Type() == NGInlineItem::kListMarker) {
-      list_marker_index = line_box_.size();
       PlaceListMarker(item, &item_result, *line_info);
-      DCHECK_GT(line_box_.size(), list_marker_index.value());
     } else if (item.Type() == NGInlineItem::kOutOfFlowPositioned) {
       line_box_.AddChild(
           item.GetLayoutObject(),
@@ -185,7 +182,7 @@ void NGInlineLayoutAlgorithm::CreateLine(NGLineInfo* line_info,
                           IsLtr(line_info->BaseDirection()) ? 0 : 1, box);
   }
 
-  if (line_box_.IsEmpty()) {
+  if (line_box_.IsEmpty() && !container_builder_.UnpositionedListMarker()) {
     return;  // The line was empty.
   }
 
@@ -205,7 +202,8 @@ void NGInlineLayoutAlgorithm::CreateLine(NGLineInfo* line_info,
 
   // Handle out-of-flow positioned objects. They need inline offsets for their
   // static positions.
-  if (!PlaceOutOfFlowObjects(*line_info, line_box_metrics)) {
+  if (!PlaceOutOfFlowObjects(*line_info, line_box_metrics) &&
+      !container_builder_.UnpositionedListMarker()) {
     // If we have out-of-flow objects but nothing else, we don't have line box
     // metrics nor BFC offset. Exit early.
     return;
@@ -235,12 +233,6 @@ void NGInlineLayoutAlgorithm::CreateLine(NGLineInfo* line_info,
   if (IsLtr(line_info->BaseDirection()))
     line_bfc_offset.line_offset += line_info->TextIndent();
 
-  if (list_marker_index.has_value()) {
-    NGListLayoutAlgorithm::SetListMarkerPosition(
-        constraint_space_, *line_info, inline_size,
-        &line_box_[list_marker_index.value()]);
-  }
-
   container_builder_.AddChildren(line_box_);
   container_builder_.SetInlineSize(inline_size);
   container_builder_.SetMetrics(line_box_metrics);
@@ -358,13 +350,8 @@ void NGInlineLayoutAlgorithm::PlaceListMarker(const NGInlineItem& item,
                                                   baseline_type_);
   }
 
-  item_result->layout_result =
-      NGBlockNode(ToLayoutBox(item.GetLayoutObject()))
-          .LayoutAtomicInline(constraint_space_, line_info.UseFirstLineStyle());
-  DCHECK(item_result->layout_result->PhysicalFragment());
-
-  // The inline position is adjusted later, when we knew the line width.
-  PlaceLayoutResult(item_result, nullptr);
+  container_builder_.SetUnpositionedListMarker(
+      NGBlockNode(ToLayoutBox(item.GetLayoutObject())));
 }
 
 // Justify the line. This changes the size of items by adding spacing.

third_party/WebKit/Source/core/layout/ng/inline/ng_line_box_fragment_builder.cc

@@ -139,8 +139,8 @@ scoped_refptr<NGLayoutResult> NGLineBoxFragmentBuilder::ToLineBoxFragment() {
 
   return base::AdoptRef(new NGLayoutResult(
       std::move(fragment), oof_positioned_descendants_, positioned_floats_,
-      unpositioned_floats_, std::move(exclusion_space_), bfc_offset_,
-      end_margin_strut_,
+      unpositioned_floats_, unpositioned_list_marker_,
+      std::move(exclusion_space_), bfc_offset_, end_margin_strut_,
       /* intrinsic_block_size */ LayoutUnit(),
       /* minimal_space_shortage */ LayoutUnit::Max(), EBreakBetween::kAuto,
       EBreakBetween::kAuto, /* has_forced_break */ false, is_pushed_by_floats_,

third_party/WebKit/Source/core/layout/ng/list/ng_list_layout_algorithm.cc

@@ -7,6 +7,7 @@
 #include "core/layout/LayoutListMarker.h"
 #include "core/layout/ng/inline/ng_inline_box_state.h"
 #include "core/layout/ng/inline/ng_inline_item_result.h"
+#include "core/layout/ng/inline/ng_physical_line_box_fragment.h"
 #include "core/layout/ng/ng_box_fragment.h"
 #include "core/layout/ng/ng_constraint_space.h"
 #include "core/layout/ng/ng_fragment_builder.h"
@@ -46,7 +47,7 @@ void NGListLayoutAlgorithm::SetListMarkerPosition(
 void NGListLayoutAlgorithm::AddListMarkerForBlockContent(
     NGBlockNode list_marker_node,
     const NGConstraintSpace& constraint_space,
-    const NGPhysicalBoxFragment& content,
+    const NGPhysicalFragment& content,
     NGLogicalOffset offset,
     NGFragmentBuilder* container_builder) {
   // Layout the list marker.
@@ -59,9 +60,11 @@ void NGListLayoutAlgorithm::AddListMarkerForBlockContent(
       ToNGPhysicalBoxFragment(*list_marker_layout_result->PhysicalFragment()));
 
   // Compute the inline offset of the marker from its margins.
+  // The marker is relative to the border box of the list item and has nothing
+  // to do with the content offset.
   auto margins =
       InlineMarginsForOutside(list_marker_fragment, constraint_space);
-  offset.inline_offset += margins.first;
+  offset.inline_offset = margins.first;
 
   // Compute the block offset of the marker by aligning the baseline of the
   // marker to the first baseline of the content.
@@ -73,9 +76,15 @@ void NGListLayoutAlgorithm::AddListMarkerForBlockContent(
       list_marker_fragment.BaselineMetrics(
           {NGBaselineAlgorithmType::kAtomicInline, baseline_type},
           constraint_space);
-  NGBoxFragment content_fragment(constraint_space.GetWritingMode(), content);
-  NGLineHeightMetrics content_metrics = content_fragment.BaselineMetrics(
-      {NGBaselineAlgorithmType::kFirstLine, baseline_type}, constraint_space);
+  NGLineHeightMetrics content_metrics;
+  if (content.IsLineBox()) {
+    content_metrics = ToNGPhysicalLineBoxFragment(content).Metrics();
+  } else {
+    NGBoxFragment content_fragment(constraint_space.GetWritingMode(),
+                                   ToNGPhysicalBoxFragment(content));
+    content_metrics = content_fragment.BaselineMetrics(
+        {NGBaselineAlgorithmType::kFirstLine, baseline_type}, constraint_space);
+  }
 
   // |offset.block_offset| is at the top of the content. Adjust it to the top of
   // the list marker by adding the differences of the ascent between content's

third_party/WebKit/Source/core/layout/ng/list/ng_list_layout_algorithm.h

@@ -31,7 +31,7 @@ class CORE_EXPORT NGListLayoutAlgorithm final {
   // Add a fragment for an outside list marker for a block content.
   static void AddListMarkerForBlockContent(NGBlockNode,
                                            const NGConstraintSpace&,
-                                           const NGPhysicalBoxFragment&,
+                                           const NGPhysicalFragment&,
                                            NGLogicalOffset,
                                            NGFragmentBuilder*);
 };

third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc

@@ -110,8 +110,7 @@ NGBlockLayoutAlgorithm::NGBlockLayoutAlgorithm(NGBlockNode node,
                                                NGBlockBreakToken* break_token)
     : NGLayoutAlgorithm(node, space, break_token),
       is_resuming_(break_token && !break_token->IsBreakBefore()),
-      exclusion_space_(new NGExclusionSpace(space.ExclusionSpace())),
-      unpositioned_list_marker_(nullptr) {}
+      exclusion_space_(new NGExclusionSpace(space.ExclusionSpace())) {}
 
 Optional<MinMaxSize> NGBlockLayoutAlgorithm::ComputeMinMaxSize(
     const MinMaxSizeInput& input) const {
@@ -385,9 +384,8 @@ scoped_refptr<NGLayoutResult> NGBlockLayoutAlgorithm::Layout() {
     } else if (child.IsFloating()) {
       HandleFloat(previous_inflow_position, ToNGBlockNode(child),
                   ToNGBlockBreakToken(child_break_token));
-    } else if (child.IsListMarkerWrapperForBlockContent()) {
-      DCHECK(!unpositioned_list_marker_);
-      unpositioned_list_marker_ = ToNGBlockNode(child);
+    } else if (child.IsListMarker()) {
+      container_builder_.SetUnpositionedListMarker(ToNGBlockNode(child));
     } else {
       // We need to propagate the initial break-before value up our container
       // chain, until we reach a container that's not a first child. If we get
@@ -721,8 +719,7 @@ bool NGBlockLayoutAlgorithm::HandleNewFormattingContext(
       std::max(intrinsic_block_size_,
                logical_offset.block_offset + fragment.BlockSize());
 
-  if (unpositioned_list_marker_)
-    PositionListMarker(physical_fragment, logical_offset);
+  PositionListMarker(*layout_result, logical_offset);
 
   container_builder_.AddChild(layout_result, logical_offset);
   container_builder_.PropagateBreak(layout_result);
@@ -1051,8 +1048,7 @@ bool NGBlockLayoutAlgorithm::HandleInflow(
                  logical_offset.block_offset + fragment.BlockSize());
   }
 
-  if (unpositioned_list_marker_)
-    PositionListMarker(physical_fragment, logical_offset);
+  PositionListMarker(*layout_result, logical_offset);
 
   container_builder_.AddChild(layout_result, logical_offset);
   if (child.IsBlock())
@@ -1596,7 +1592,7 @@ NGBlockLayoutAlgorithm::CreateConstraintSpaceForChild(
     writing_mode = child_style.GetWritingMode();
 
     // PositionListMarker() requires a first line baseline.
-    if (unpositioned_list_marker_) {
+    if (container_builder_.UnpositionedListMarker()) {
       space_builder.AddBaselineRequest(
           {NGBaselineAlgorithmType::kFirstLine,
            IsHorizontalWritingMode(constraint_space_.GetWritingMode())
@@ -1796,15 +1792,29 @@ LayoutUnit NGBlockLayoutAlgorithm::CalculateMinimumBlockSize(
 }
 
 void NGBlockLayoutAlgorithm::PositionListMarker(
-    const NGPhysicalFragment& content,
+    const NGLayoutResult& layout_result,
     const NGLogicalOffset& content_offset) {
-  DCHECK(unpositioned_list_marker_);
+  // If this is not a list-item, propagate unpositioned list markers to
+  // ancestors.
+  if (!node_.IsListItem()) {
+    if (layout_result.UnpositionedListMarker()) {
+      container_builder_.SetUnpositionedListMarker(
+          layout_result.UnpositionedListMarker());
+    }
+    return;
+  }
 
+  // If this is a list item, add the unpositioned list marker as a child.
+  NGBlockNode list_marker_node = layout_result.UnpositionedListMarker();
+  if (!list_marker_node) {
+    list_marker_node = container_builder_.UnpositionedListMarker();
+    if (!list_marker_node)
+      return;
+    container_builder_.SetUnpositionedListMarker(NGBlockNode(nullptr));
+  }
   NGListLayoutAlgorithm::AddListMarkerForBlockContent(
-      unpositioned_list_marker_, constraint_space_,
-      ToNGPhysicalBoxFragment(content), content_offset, &container_builder_);
-
-  unpositioned_list_marker_ = NGBlockNode(nullptr);
+      list_marker_node, constraint_space_, *layout_result.PhysicalFragment(),
+      content_offset, &container_builder_);
 }
 
 }  // namespace blink

third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.h

@@ -189,7 +189,7 @@ class CORE_EXPORT NGBlockLayoutAlgorithm
   void AddPositionedFloats(const Vector<NGPositionedFloat>& positioned_floats);
 
   // Positions a list marker for the specified block content.
-  void PositionListMarker(const NGPhysicalFragment&, const NGLogicalOffset&);
+  void PositionListMarker(const NGLayoutResult&, const NGLogicalOffset&);
 
   // Calculates logical offset for the current fragment using either {@code
   // intrinsic_block_size_} when the fragment doesn't know it's offset or
@@ -234,7 +234,6 @@ class CORE_EXPORT NGBlockLayoutAlgorithm
 
   std::unique_ptr<NGExclusionSpace> exclusion_space_;
   Vector<scoped_refptr<NGUnpositionedFloat>> unpositioned_floats_;
-  NGBlockNode unpositioned_list_marker_;
 };
 
 }  // namespace blink

third_party/WebKit/Source/core/layout/ng/ng_block_node.cc

@@ -450,7 +450,8 @@ void NGBlockNode::CopyChildFragmentPosition(
       (layout_box->ContainingBlock()->IsLayoutFlowThread() &&
        box_ == layout_box->ContainingBlock()->ContainingBlock()) ||
       (layout_box->ContainingBlock()->IsInline() &&  // anonymous wrapper case
-       box_->Parent() == layout_box->ContainingBlock()));
+       box_->Parent() == layout_box->ContainingBlock()) ||
+      (box_->IsLayoutNGListItem() && layout_box->IsLayoutNGListMarker()));
 
   // LegacyLayout flips vertical-rl horizontal coordinates before paint.
   // NGLayout flips X location for LegacyLayout compatibility.

third_party/WebKit/Source/core/layout/ng/ng_container_fragment_builder.cc

@@ -16,7 +16,8 @@ NGContainerFragmentBuilder::NGContainerFragmentBuilder(
     scoped_refptr<const ComputedStyle> style,
     WritingMode writing_mode,
     TextDirection direction)
-    : NGBaseFragmentBuilder(std::move(style), writing_mode, direction) {}
+    : NGBaseFragmentBuilder(std::move(style), writing_mode, direction),
+      unpositioned_list_marker_(nullptr) {}
 
 NGContainerFragmentBuilder::~NGContainerFragmentBuilder() = default;
 
@@ -51,6 +52,13 @@ NGContainerFragmentBuilder& NGContainerFragmentBuilder::SwapUnpositionedFloats(
   return *this;
 }
 
+NGContainerFragmentBuilder&
+NGContainerFragmentBuilder::SetUnpositionedListMarker(const NGBlockNode& node) {
+  DCHECK(!unpositioned_list_marker_ || !node);
+  unpositioned_list_marker_ = node;
+  return *this;
+}
+
 NGContainerFragmentBuilder& NGContainerFragmentBuilder::AddChild(
     scoped_refptr<NGLayoutResult> child,
     const NGLogicalOffset& child_offset) {

third_party/WebKit/Source/core/layout/ng/ng_container_fragment_builder.h

@@ -49,6 +49,11 @@ class CORE_EXPORT NGContainerFragmentBuilder : public NGBaseFragmentBuilder {
   NGContainerFragmentBuilder& SwapUnpositionedFloats(
       Vector<scoped_refptr<NGUnpositionedFloat>>*);
 
+  const NGBlockNode& UnpositionedListMarker() const {
+    return unpositioned_list_marker_;
+  }
+  NGContainerFragmentBuilder& SetUnpositionedListMarker(const NGBlockNode&);
+
   virtual NGContainerFragmentBuilder& AddChild(scoped_refptr<NGLayoutResult>,
                                                const NGLogicalOffset&);
 
@@ -174,6 +179,8 @@ class CORE_EXPORT NGContainerFragmentBuilder : public NGBaseFragmentBuilder {
   Vector<NGOutOfFlowPositionedCandidate> oof_positioned_candidates_;
   Vector<NGOutOfFlowPositionedDescendant> oof_positioned_descendants_;
 
+  NGBlockNode unpositioned_list_marker_;
+
   Vector<scoped_refptr<NGPhysicalFragment>> children_;
   Vector<NGLogicalOffset> offsets_;
 

third_party/WebKit/Source/core/layout/ng/ng_fragment_builder.cc

@@ -295,10 +295,11 @@ scoped_refptr<NGLayoutResult> NGFragmentBuilder::ToBoxFragment() {
 
   return base::AdoptRef(new NGLayoutResult(
       std::move(fragment), oof_positioned_descendants_, positioned_floats,
-      unpositioned_floats_, std::move(exclusion_space_), bfc_offset_,
-      end_margin_strut_, intrinsic_block_size_, minimal_space_shortage_,
-      initial_break_before_, previous_break_after_, has_forced_break_,
-      is_pushed_by_floats_, NGLayoutResult::kSuccess));
+      unpositioned_floats_, unpositioned_list_marker_,
+      std::move(exclusion_space_), bfc_offset_, end_margin_strut_,
+      intrinsic_block_size_, minimal_space_shortage_, initial_break_before_,
+      previous_break_after_, has_forced_break_, is_pushed_by_floats_,
+      NGLayoutResult::kSuccess));
 }
 
 scoped_refptr<NGLayoutResult> NGFragmentBuilder::Abort(
@@ -307,9 +308,9 @@ scoped_refptr<NGLayoutResult> NGFragmentBuilder::Abort(
   Vector<NGPositionedFloat> positioned_floats;
   return base::AdoptRef(new NGLayoutResult(
       nullptr, oof_positioned_descendants, positioned_floats,
-      unpositioned_floats_, nullptr, bfc_offset_, end_margin_strut_,
-      LayoutUnit(), LayoutUnit(), EBreakBetween::kAuto, EBreakBetween::kAuto,
-      false, false, status));
+      unpositioned_floats_, NGBlockNode(nullptr), nullptr, bfc_offset_,
+      end_margin_strut_, LayoutUnit(), LayoutUnit(), EBreakBetween::kAuto,
+      EBreakBetween::kAuto, false, false, status));
 }
 
 // Finds FragmentPairs that define inline containing blocks.

third_party/WebKit/Source/core/layout/ng/ng_layout_input_node.cc

@@ -87,13 +87,12 @@ bool NGLayoutInputNode::ShouldBeConsideredAsReplaced() const {
   return box_->ShouldBeConsideredAsReplaced();
 }
 
-bool NGLayoutInputNode::IsListMarker() const {
-  return IsBlock() && box_->IsLayoutNGListMarker();
+bool NGLayoutInputNode::IsListItem() const {
+  return IsBlock() && box_->IsLayoutNGListItem();
 }
 
-bool NGLayoutInputNode::IsListMarkerWrapperForBlockContent() const {
-  return IsBlock() &&
-         LayoutNGListMarker::IsListMarkerWrapperForBlockContent(*box_);
+bool NGLayoutInputNode::IsListMarker() const {
+  return IsBlock() && box_->IsLayoutNGListMarker();
 }
 
 bool NGLayoutInputNode::IsQuirkyContainer() const {

third_party/WebKit/Source/core/layout/ng/ng_layout_input_node.h

@@ -57,10 +57,8 @@ class CORE_EXPORT NGLayoutInputNode {
   bool IsBody() const;
   bool IsDocumentElement() const;
   bool ShouldBeConsideredAsReplaced() const;
+  bool IsListItem() const;
   bool IsListMarker() const;
-  // True for an anonymous block wrapper of a list marker. See
-  // LayoutNGListMarker::IsListMarkerWrapper() for more.
-  bool IsListMarkerWrapperForBlockContent() const;
 
   // If the node is a quirky container for margin collapsing, see:
   // https://html.spec.whatwg.org/#margin-collapsing-quirks

third_party/WebKit/Source/core/layout/ng/ng_layout_result.cc

@@ -16,6 +16,7 @@ NGLayoutResult::NGLayoutResult(
     Vector<NGOutOfFlowPositionedDescendant>& oof_positioned_descendants,
     Vector<NGPositionedFloat>& positioned_floats,
     Vector<scoped_refptr<NGUnpositionedFloat>>& unpositioned_floats,
+    const NGBlockNode& unpositioned_list_marker,
     std::unique_ptr<const NGExclusionSpace> exclusion_space,
     const WTF::Optional<NGBfcOffset> bfc_offset,
     const NGMarginStrut end_margin_strut,
@@ -27,6 +28,7 @@ NGLayoutResult::NGLayoutResult(
     bool is_pushed_by_floats,
     NGLayoutResultStatus status)
     : physical_fragment_(std::move(physical_fragment)),
+      unpositioned_list_marker_(unpositioned_list_marker),
       exclusion_space_(std::move(exclusion_space)),
       bfc_offset_(bfc_offset),
       end_margin_strut_(end_margin_strut),
@@ -56,10 +58,10 @@ scoped_refptr<NGLayoutResult> NGLayoutResult::CloneWithoutOffset() const {
       WTF::WrapUnique(new NGExclusionSpace(*exclusion_space_)));
   return base::AdoptRef(new NGLayoutResult(
       physical_fragment_->CloneWithoutOffset(), oof_positioned_descendants,
-      positioned_floats, unpositioned_floats, std::move(exclusion_space),
-      bfc_offset_, end_margin_strut_, intrinsic_block_size_,
-      minimal_space_shortage_, initial_break_before_, final_break_after_,
-      has_forced_break_, is_pushed_by_floats_, Status()));
+      positioned_floats, unpositioned_floats, unpositioned_list_marker_,
+      std::move(exclusion_space), bfc_offset_, end_margin_strut_,
+      intrinsic_block_size_, minimal_space_shortage_, initial_break_before_,
+      final_break_after_, has_forced_break_, is_pushed_by_floats_, Status()));
 }
 
 }  // namespace blink

third_party/WebKit/Source/core/layout/ng/ng_layout_result.h

@@ -70,6 +70,10 @@ class CORE_EXPORT NGLayoutResult : public RefCounted<NGLayoutResult> {
     return unpositioned_floats_;
   }
 
+  const NGBlockNode& UnpositionedListMarker() const {
+    return unpositioned_list_marker_;
+  }
+
   const NGExclusionSpace* ExclusionSpace() const {
     return exclusion_space_.get();
   }
@@ -116,6 +120,7 @@ class CORE_EXPORT NGLayoutResult : public RefCounted<NGLayoutResult> {
           out_of_flow_positioned_descendants,
       Vector<NGPositionedFloat>& positioned_floats,
       Vector<scoped_refptr<NGUnpositionedFloat>>& unpositioned_floats,
+      const NGBlockNode& unpositioned_list_marker,
       std::unique_ptr<const NGExclusionSpace> exclusion_space,
       const WTF::Optional<NGBfcOffset> bfc_offset,
       const NGMarginStrut end_margin_strut,
@@ -133,6 +138,8 @@ class CORE_EXPORT NGLayoutResult : public RefCounted<NGLayoutResult> {
   Vector<NGPositionedFloat> positioned_floats_;
   Vector<scoped_refptr<NGUnpositionedFloat>> unpositioned_floats_;
 
+  NGBlockNode unpositioned_list_marker_;
+
   const std::unique_ptr<const NGExclusionSpace> exclusion_space_;
   const WTF::Optional<NGBfcOffset> bfc_offset_;
   const NGMarginStrut end_margin_strut_;

third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.cc

@@ -239,6 +239,10 @@ bool NGPhysicalFragment::IsBlockFlow() const {
   return layout_object_ && layout_object_->IsLayoutBlockFlow();
 }
 
+bool NGPhysicalFragment::IsListMarker() const {
+  return layout_object_ && layout_object_->IsLayoutNGListMarker();
+}
+
 bool NGPhysicalFragment::IsPlacedByLayoutNG() const {
   // TODO(kojii): Move this to a flag for |LayoutNGBlockFlow::UpdateBlockLayout|
   // to set.

third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.h

@@ -95,6 +95,7 @@ class CORE_EXPORT NGPhysicalFragment
     return IsFloating() || IsOutOfFlowPositioned();
   }
   bool IsBlockFlow() const;
+  bool IsListMarker() const;
 
   // A block sub-layout starts on this fragment. Inline blocks, floats, out of
   // flow positioned objects are such examples. This is also true on NG/legacy

third_party/WebKit/Source/core/paint/ng/ng_box_fragment_painter.cc

@@ -556,10 +556,14 @@ void NGBoxFragmentPainter::PaintLineBoxChildren(
   for (const auto& line : line_boxes) {
     if (line->PhysicalFragment().IsFloatingOrOutOfFlowPositioned())
       continue;
-    DCHECK(line->PhysicalFragment().IsLineBox())
-        << line->PhysicalFragment().ToString();
     const LayoutPoint child_offset =
         paint_offset + line->Offset().ToLayoutPoint();
+    if (line->PhysicalFragment().IsListMarker()) {
+      PaintAtomicInlineChild(*line, paint_info, paint_offset, paint_offset);
+      continue;
+    }
+    DCHECK(line->PhysicalFragment().IsLineBox())
+        << line->PhysicalFragment().ToString();
     PaintInlineChildren(line->Children(), paint_info, child_offset,
                         paint_offset);
   }