Fix a null-deref in LayoutListMarker::TextAlternative()

Bug: 1167174
Change-Id: If793ee4b3e96782abf0f812f771840020b9f5741
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2633827
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Auto-Submit: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#844300}

third_party/blink/renderer/core/BUILD.gn

@@ -1320,6 +1320,7 @@ source_set("unit_tests") {
     "layout/layout_grid_test.cc",
     "layout/layout_image_test.cc",
     "layout/layout_inline_test.cc",
+    "layout/layout_list_marker_test.cc",
     "layout/layout_media_test.cc",
     "layout/layout_multi_column_flow_thread_test.cc",
     "layout/layout_object_test.cc",

third_party/blink/renderer/core/layout/layout_list_marker.cc

@@ -207,6 +207,9 @@ String LayoutListMarker::TextAlternative() const {
   // order.
 
   if (RuntimeEnabledFeatures::CSSAtRuleCounterStyleEnabled()) {
+    if (GetListStyleCategory() == ListMarker::ListStyleCategory::kNone)
+      return "";
+
     const CounterStyle& counter_style = GetCounterStyle();
     return counter_style.GetPrefix() + text_ + counter_style.GetSuffix();
   }

third_party/blink/renderer/core/layout/layout_list_marker_test.cc

+// Copyright 2021 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/layout/layout_list_marker.h"
+
+#include "third_party/blink/renderer/core/layout/layout_list_item.h"
+#include "third_party/blink/renderer/core/testing/core_unit_test_helper.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+#include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
+
+namespace blink {
+
+class LayoutListMarkerTest : public RenderingTest,
+                             private ScopedLayoutNGForTest {
+ public:
+  // LayoutListMarker is for legacy layout only
+  LayoutListMarkerTest() : ScopedLayoutNGForTest(false) {}
+};
+
+// https://crbug.com/1167174
+TEST_F(LayoutListMarkerTest, ListStyleTypeNoneTextAlternative) {
+  ScopedCSSAtRuleCounterStyleForTest scope(true);
+
+  SetBodyInnerHTML(R"HTML(
+    <style>
+      li {
+        list-style-type: none;
+        list-style-image: linear-gradient(black, white);
+      }
+    </style>
+    <ul>
+      <li id="target">foo</li>
+    </ul>
+  )HTML");
+
+  Element* target = GetElementById("target");
+  LayoutObject* marker =
+      ListMarker::MarkerFromListItem(target->GetLayoutObject());
+
+  // Should not crash
+  EXPECT_EQ("", To<LayoutListMarker>(marker)->TextAlternative());
+}
+
+}  // namespace blink