Bug 1089463 - Clear an element's restyle bits when inserting into a shadow tree. r=bzbarsky
authorCameron McCormack <cam@mcc.id.au>
Sat, 15 Nov 2014 09:08:21 +1100
changeset 215861 9b77a97a378b4a7cb7ef0ddc30093dc9f00879f6
parent 215856 647ec1593edb4ef1fe148db1813ea5f635d52796
child 215862 6039cbdd69a96a524280495945a8938376ce65b4
push id27829
push usergszorc@mozilla.com
push dateSat, 15 Nov 2014 22:34:49 +0000
treeherderautoland@19f75e1211e6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbzbarsky
bugs1089463
milestone36.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1089463 - Clear an element's restyle bits when inserting into a shadow tree. r=bzbarsky
dom/base/Element.cpp
layout/style/crashtests/1089463-1.html
layout/style/crashtests/crashtests.list
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -1464,17 +1464,27 @@ Element::BindToTree(nsIDocument* aDocume
     }
 
     // Unset this flag since we now really are in a document.
     UnsetFlags(NODE_FORCE_XBL_BINDINGS |
                // And clear the lazy frame construction bits.
                NODE_NEEDS_FRAME | NODE_DESCENDANTS_NEED_FRAMES |
                // And the restyle bits
                ELEMENT_ALL_RESTYLE_FLAGS);
-  } else if (!IsInShadowTree()) {
+  } else if (IsInShadowTree()) {
+    // We're not in a document, but we did get inserted into a shadow tree.
+    // Since we won't have any restyle data in the document's restyle trackers,
+    // don't let us get inserted with restyle bits set incorrectly.
+    //
+    // Also clear all the other flags that are cleared above when we do get
+    // inserted into a document.
+    UnsetFlags(NODE_FORCE_XBL_BINDINGS |
+               NODE_NEEDS_FRAME | NODE_DESCENDANTS_NEED_FRAMES |
+               ELEMENT_ALL_RESTYLE_FLAGS);
+  } else {
     // If we're not in the doc and not in a shadow tree,
     // update our subtree pointer.
     SetSubtreeRootPointer(aParent->SubtreeRoot());
   }
 
   // Propagate scoped style sheet tracking bit.
   if (mParent->IsContent()) {
     nsIContent* parent;
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1089463-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<div></div>
+<script>
+window.onload = function() {
+  var div = document.querySelector("div");
+  var shadow = div.createShadowRoot();
+  shadow.innerHTML = "<p style='display: none'><span><i>x</i></span></p>";
+  var p = shadow.lastChild;
+  var span = p.firstChild;
+  var i = span.firstChild;
+
+  span.style.color = 'blue';
+  p.remove();
+
+  document.body.offsetTop;
+
+  shadow.appendChild(p);
+  i.style.color = 'red';
+};
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -104,10 +104,11 @@ load 930270-2.html
 load 945048-1.html
 pref(layers.offmainthreadcomposition.async-animations,true) load 972199-1.html
 load 989965-1.html
 load 992333-1.html
 pref(dom.webcomponents.enabled,true) load 1017798-1.html
 load 1028514-1.html
 load 1066089-1.html
 load 1074651-1.html
+pref(dom.webcomponents.enabled,true) load 1089463-1.html
 load large_border_image_width.html
 load border-image-visited-link.html