[css-pseudo] Let non-replaced images be list items with markers

<img> elements are usually replaced, so they can't originate a ::marker
pseudo-element even if they have 'display: list-item'.

However, if they point to an invalid image and have an alternative text,
then they are not replaced. Therefore they can have ::before and ::after
pseudo-elements, and also a ::marker if they have 'display: list-item'.

Before this patch, markers with 'content: normal' were never generated.
And non-normal ones worked fine in the inside case, but when outside
they triggerede a DCHECK failure because the marker was created but not
laid out.

BUG=1038644

TEST=external/wpt/css/css-pseudo/marker-content-017.html

The test fails in legacy because the 'content' property is not supported
yet in ::marker.

Change-Id: I4420bc2e9a0460f3a59fa030e5e3d249428aa6be
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1985759Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Oriol Brufau <obrufau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#728012}

third_party/blink/renderer/core/layout/layout_object.cc

@@ -238,11 +238,10 @@ LayoutObject* LayoutObject::CreateObject(Element* element,
     case EDisplay::kBlock:
     case EDisplay::kFlowRoot:
     case EDisplay::kInlineBlock:
+    case EDisplay::kListItem:
     case EDisplay::kMath:
     case EDisplay::kInlineMath:
       return LayoutObjectFactory::CreateBlockFlow(*element, style, legacy);
-    case EDisplay::kListItem:
-      return LayoutObjectFactory::CreateListItem(*element, style, legacy);
     case EDisplay::kTable:
     case EDisplay::kInlineTable:
       return new LayoutTable(element);

third_party/blink/renderer/core/layout/layout_object_factory.cc

@@ -75,6 +75,13 @@ LayoutBlockFlow* LayoutObjectFactory::CreateBlockFlow(
     Node& node,
     const ComputedStyle& style,
     LegacyLayout legacy) {
+  if (style.Display() == EDisplay::kListItem) {
+    // Create a LayoutBlockFlow with a list marker
+    return CreateObject<LayoutBlockFlow, LayoutNGListItem, LayoutListItem>(
+        node, style, legacy);
+  }
+
+  // Create a plain LayoutBlockFlow
   return CreateObject<LayoutBlockFlow, LayoutNGBlockFlow>(node, style, legacy);
 }
 
@@ -86,13 +93,6 @@ LayoutBlock* LayoutObjectFactory::CreateFlexibleBox(Node& node,
       node, style, legacy, disable_ng_for_type);
 }
 
-LayoutBlockFlow* LayoutObjectFactory::CreateListItem(Node& node,
-                                                     const ComputedStyle& style,
-                                                     LegacyLayout legacy) {
-  return CreateObject<LayoutBlockFlow, LayoutNGListItem, LayoutListItem>(
-      node, style, legacy);
-}
-
 LayoutObject* LayoutObjectFactory::CreateListMarker(Node& node,
                                                     const ComputedStyle& style,
                                                     LegacyLayout legacy) {

third_party/blink/renderer/core/layout/layout_object_factory.h

@@ -41,9 +41,6 @@ class LayoutObjectFactory {
   static LayoutBlock* CreateFlexibleBox(Node&,
                                         const ComputedStyle&,
                                         LegacyLayout);
-  static LayoutBlockFlow* CreateListItem(Node&,
-                                         const ComputedStyle&,
-                                         LegacyLayout);
   static LayoutObject* CreateListMarker(Node&,
                                         const ComputedStyle&,
                                         LegacyLayout);

third_party/blink/web_tests/FlagExpectations/disable-layout-ng

@@ -78,6 +78,7 @@ crbug.com/457718 external/wpt/css/css-pseudo/marker-content-006.html [ Failure ]
 crbug.com/457718 external/wpt/css/css-pseudo/marker-content-012.html [ Failure ]
 crbug.com/457718 external/wpt/css/css-pseudo/marker-content-015.html [ Failure ]
 crbug.com/457718 external/wpt/css/css-pseudo/marker-content-016.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-017.html [ Failure ]
 crbug.com/1012289 external/wpt/css/css-pseudo/marker-unicode-bidi-default.html [ Failure ]
 crbug.com/1012289 external/wpt/css/css-pseudo/marker-unicode-bidi-normal.html [ Failure ]
 

third_party/blink/web_tests/external/wpt/css/css-pseudo/marker-content-017-ref.html

+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Reference: ::marker pseudo elements styled with 'content' property</title>
+<link rel="author" title="Oriol Brufau" href="mailto:obrufau@igalia.com">
+<style>
+img {
+  display: list-item;
+  list-style-type: "[marker]";
+}
+img.inside {
+  list-style-position: inside;
+}
+</style>
+<ol>
+  <img src="about:invalid" alt="alt" class="inside" />
+  <img src="about:invalid" alt="alt" />
+  <li value="3">item</li>
+</ol>

third_party/blink/web_tests/external/wpt/css/css-pseudo/marker-content-017.html

+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Test: ::marker pseudo elements styled with 'content' property</title>
+<link rel="author" title="Oriol Brufau" href="mailto:obrufau@igalia.com">
+<link rel="match" href="marker-content-017-ref.html">
+<link rel="help" href="https://drafts.csswg.org/css-pseudo-4/#marker-pseudo">
+<link rel="help" href="https://drafts.csswg.org/css-lists/#declaring-a-list-item">
+<meta name="assert" content="Checks that ::marker can be created inside a non-replaced <img>.">
+<style>
+img {
+  display: list-item;
+}
+img.inside {
+  list-style-position: inside;
+}
+img::marker {
+  content: '[marker]';
+}
+</style>
+<ol>
+  <img src="about:invalid" alt="alt" class="inside" />
+  <img src="about:invalid" alt="alt" />
+  <li>item</li>
+</ol>