Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonymousBoxStyle. r?heycam
MozReview-Commit-ID: FYctJRfLTK6
--- a/layout/style/ServoStyleSet.cpp
+++ b/layout/style/ServoStyleSet.cpp
@@ -530,27 +530,30 @@ ServoStyleSet::ResolveStyleLazily(Elemen
}
already_AddRefed<ServoStyleContext>
ServoStyleSet::ResolveInheritingAnonymousBoxStyle(nsIAtom* aPseudoTag,
ServoStyleContext* aParentContext)
{
MOZ_ASSERT(nsCSSAnonBoxes::IsAnonBox(aPseudoTag) &&
!nsCSSAnonBoxes::IsNonInheritingAnonBox(aPseudoTag));
- MOZ_ASSERT_IF(aParentContext, !StylistNeedsUpdate());
-
- UpdateStylistIfNeeded();
-
RefPtr<ServoStyleContext> style = nullptr;
if (aParentContext) {
style = aParentContext->GetCachedInheritingAnonBoxStyle(aPseudoTag);
}
if (!style) {
+ // People like to call into here from random attribute notifications (see
+ // bug 1388234, and bug 1389029).
+ //
+ // We may get a wrong cached style if the stylist needs an update, but we'll
+ // have a whole restyle scheduled anyway.
+ UpdateStylistIfNeeded();
+
style =
Servo_ComputedValues_GetForAnonymousBox(aParentContext,
aPseudoTag,
mRawSet.get()).Consume();
MOZ_ASSERT(style);
if (aParentContext) {
aParentContext->SetCachedInheritedAnonBoxStyle(aPseudoTag, style);
}
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1388234.html
@@ -0,0 +1,9 @@
+<style></style>
+<script>
+ try { o1 = document.createElement('th') } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { document.styleSheets[0].insertRule("* { }", 0); } catch(e) { }
+ try { document.documentElement.getBoundingClientRect() } catch(e) { }
+ try { document.styleSheets[0].insertRule("* { unicode-bidi: bidi-override}", 0); } catch(e) { }
+ try { o1.rowSpan = 32 } catch(e) { }
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -195,8 +195,9 @@ load large_border_image_width.html
load link-transition-before.html
load long-url-list-stack-overflow.html
load 1383981.html
load 1383981-2.html
load 1384824-1.html
load 1384824-2.html
load 1387481-1.html
load 1387499.html
+load 1388234.html