commit a7b8ec708c2566cc6e69c0b464e416c018227b02
author Ben Murdoch <benm@google.com> Thu Oct 21 16:17:55 2010 +0100
committer Ben Murdoch <benm@google.com> Thu Oct 21 16:20:05 2010 +0100
tree fc4104290079a6d0dab843dcc7088101d2efcf6b
parent 93bec1ec2d7bca6a6df6bb0391d1b6a0d6562f33

Cherry-pick WebKit security fix (webkit.org r68860) Do not merge

See http://trac.webkit.org/changeset/68860

Change-Id: I7860374528be836e1f4ea7c6faa48966fd3ed23c

WebCore/rendering/RenderObjectChildList.cpp

diff --git a/WebCore/rendering/RenderObjectChildList.cpp b/WebCore/rendering/RenderObjectChildList.cpp
index 24e8645..65c35f0 100644
--- a/WebCore/rendering/RenderObjectChildList.cpp
+++ b/WebCore/rendering/RenderObjectChildList.cpp
@@ -429,7 +429,10 @@
                 generatedContentContainer->setStyle(pseudoElementStyle);
                 owner->addChild(generatedContentContainer, insertBefore);
             }
-            generatedContentContainer->addChild(renderer);
+            if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
+                generatedContentContainer->addChild(renderer);
+            else
+                renderer->destroy();
         }
     }
 }