WebCore:

        Reviewed by Dave Hyatt.

        - fix <rdar://problem/6777374> Generated content with display: run-in
          causes a crash

        Test: fast/runin/generated.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::handleRunInChild): Check if the run-in block is
        generated, and if so, make the RenderInline anonymous instead of passing
        a 0 node to the RenderInline constructor. If the run-in itself is
        generated, do move :before and :after children from the block into the
        inline, as they will not be regenerated. Changed nested ifs into early
        returns.

LayoutTests:

        Reviewed by Dave Hyatt.

        - test for <rdar://problem/6777374> Generated content with display:
          run-in causes a crash

        * fast/runin/generated.html: Added.
        * platform/mac/fast/runin/generated-expected.checksum: Added.
        * platform/mac/fast/runin/generated-expected.png: Added.
        * platform/mac/fast/runin/generated-expected.txt: Added.



git-svn-id: svn://svn.chromium.org/blink/trunk@42546 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/ChangeLog

+2009-04-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - test for <rdar://problem/6777374> Generated content with display:
+          run-in causes a crash
+
+        * fast/runin/generated.html: Added.
+        * platform/mac/fast/runin/generated-expected.checksum: Added.
+        * platform/mac/fast/runin/generated-expected.png: Added.
+        * platform/mac/fast/runin/generated-expected.txt: Added.
+
 2009-04-15  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Alexey Proskuryakov.

third_party/WebKit/LayoutTests/fast/runin/generated.html

+<style>
+    #target:before {
+        content: "PASS";
+        display: run-in;
+    }
+</style>
+<p>
+    Test for <i><a href="rdar://problem/6777374">rdar://problem/6777374</a>
+    Generated content with display: run-in causes a crash</i>.
+</p>
+<div id="target">
+    &lt; this should say &ldquo;PASS&rdquo;
+</div>

third_party/WebKit/LayoutTests/platform/mac/fast/runin/generated-expected.checksum

+9923b89cd3cc56a7cdfe6e3e2a19165d
\ No newline at end of file

third_party/WebKit/LayoutTests/platform/mac/fast/runin/generated-expected.txt

+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x18
+        RenderText {#text} at (0,0) size 53x18
+          text run at (0,0) width 53: "Test for "
+        RenderInline {I} at (0,0) size 500x18
+          RenderInline {A} at (0,0) size 154x18 [color=#0000EE]
+            RenderText {#text} at (53,0) size 154x18
+              text run at (53,0) width 154: "rdar://problem/6777374"
+          RenderText {#text} at (207,0) size 346x18
+            text run at (207,0) width 4: " "
+            text run at (211,0) width 342: "Generated content with display: run-in causes a crash"
+        RenderText {#text} at (553,0) size 4x18
+          text run at (553,0) width 4: "."
+      RenderBlock {DIV} at (0,34) size 784x18
+        RenderBlock (anonymous) at (0,0) size 784x18
+          RenderInline (generated) at (0,0) size 39x18
+            RenderText at (0,0) size 39x18
+              text run at (0,0) width 39: "PASS"
+          RenderText {#text} at (39,0) size 167x18
+            text run at (39,0) width 4: " "
+            text run at (43,0) width 163: "< this should say \x{201C}PASS\x{201D}"

third_party/WebKit/WebCore/ChangeLog

+2009-04-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6777374> Generated content with display: run-in
+          causes a crash
+
+        Test: fast/runin/generated.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild): Check if the run-in block is
+        generated, and if so, make the RenderInline anonymous instead of passing
+        a 0 node to the RenderInline constructor. If the run-in itself is
+        generated, do move :before and :after children from the block into the
+        inline, as they will not be regenerated. Changed nested ifs into early
+        returns.
+
 2009-04-15  Eric Roman  <eroman@chromium.org>
 
         Reviewed by Geoffrey Garen.

third_party/WebKit/WebCore/rendering/RenderBlock.cpp

@@ -977,50 +977,55 @@ RenderBox* RenderBlock::handleRunInChild(RenderBox* child, bool& handled)
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (child->isRunIn() && (child->childrenInline() || child->isReplaced())) {
-        RenderBlock* blockRunIn = toRenderBlock(child);
-        // Get the next non-positioned/non-floating RenderBlock.
-        RenderObject* curr = blockRunIn->nextSibling();
-        while (curr && curr->isFloatingOrPositioned())
-            curr = curr->nextSibling();
-        if (curr && (curr->isRenderBlock() && curr->childrenInline() && !curr->isRunIn())) {
-            RenderBlock* currBlock = toRenderBlock(curr);
-        
-            // The block acts like an inline, so just null out its
-            // position.
-            handled = true;
-            
-            // Remove the old child.
-            RenderBox* next = blockRunIn->nextSiblingBox();
-            children()->removeChildNode(this, blockRunIn);
-
-            // Create an inline.
-            RenderInline* inlineRunIn = new (renderArena()) RenderInline(blockRunIn->node());
-            inlineRunIn->setStyle(blockRunIn->style());
-
-            // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
-            // been regenerated by the new inline.
-            for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
-                if (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
-                    blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
-                    inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
-                }
-            }
+    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
+        return 0;
 
-            // Now insert the new child under |currBlock|.
-            currBlock->children()->insertChildNode(currBlock, inlineRunIn, currBlock->firstChild());
-            
-            // If the run-in had an element, we need to set the new renderer.
-            if (blockRunIn->node())
-                blockRunIn->node()->setRenderer(inlineRunIn);
-            
-            // Destroy the block run-in.
-            blockRunIn->destroy();
+    RenderBlock* blockRunIn = toRenderBlock(child);
+    // Get the next non-positioned/non-floating RenderBlock.
+    RenderObject* curr = blockRunIn->nextSibling();
+    while (curr && curr->isFloatingOrPositioned())
+        curr = curr->nextSibling();
 
-            return next;
+    if (!curr || !curr->isRenderBlock() || !curr->childrenInline() || curr->isRunIn())
+        return 0;
+
+    RenderBlock* currBlock = toRenderBlock(curr);
+
+    // The block acts like an inline, so just null out its
+    // position.
+    handled = true;
+    
+    // Remove the old child.
+    RenderBox* next = blockRunIn->nextSiblingBox();
+    children()->removeChildNode(this, blockRunIn);
+
+    // Create an inline.
+    Node* runInNode = blockRunIn->node();
+    RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
+    inlineRunIn->setStyle(blockRunIn->style());
+
+    bool runInIsGenerated = child->style()->styleType() == BEFORE || child->style()->styleType() == AFTER;
+
+    // Move the nodes from the old child to the new child, but skip any :before/:after content.  It has already
+    // been regenerated by the new inline.
+    for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild; runInChild = runInChild->nextSibling()) {
+        if (runInIsGenerated || runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER) {
+            blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
+            inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
         }
     }
-    return 0;
+
+    // Now insert the new child under |currBlock|.
+    currBlock->children()->insertChildNode(currBlock, inlineRunIn, currBlock->firstChild());
+    
+    // If the run-in had an element, we need to set the new renderer.
+    if (runInNode)
+        runInNode->setRenderer(inlineRunIn);
+
+    // Destroy the block run-in.
+    blockRunIn->destroy();
+
+    return next;
 }
 
 int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)