Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonymousBoxStyle. r?heycam draft
authorEmilio Cobos Álvarez <emilio@crisal.io>
Tue, 08 Aug 2017 14:54:13 +0200
changeset 644032 0435ac119f7bc2362b3db99a76f417454050cb34
parent 644031 5e8ee8c79ba2b8b1d79b1e57435f91bb07ad9faf
child 725468 ba151117dc698c68fd1f159e21e6abefb03a7cc2
push id73283
push userbmo:emilio+bugs@crisal.io
push dateThu, 10 Aug 2017 10:09:45 +0000
reviewersheycam
bugs1388234
milestone57.0a1
Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonymousBoxStyle. r?heycam MozReview-Commit-ID: FYctJRfLTK6
layout/style/ServoStyleSet.cpp
layout/style/crashtests/1388234.html
layout/style/crashtests/crashtests.list
--- a/layout/style/ServoStyleSet.cpp
+++ b/layout/style/ServoStyleSet.cpp
@@ -530,27 +530,30 @@ ServoStyleSet::ResolveStyleLazily(Elemen
 }
 
 already_AddRefed<ServoStyleContext>
 ServoStyleSet::ResolveInheritingAnonymousBoxStyle(nsIAtom* aPseudoTag,
                                                   ServoStyleContext* aParentContext)
 {
   MOZ_ASSERT(nsCSSAnonBoxes::IsAnonBox(aPseudoTag) &&
              !nsCSSAnonBoxes::IsNonInheritingAnonBox(aPseudoTag));
-  MOZ_ASSERT_IF(aParentContext, !StylistNeedsUpdate());
-
-  UpdateStylistIfNeeded();
-
   RefPtr<ServoStyleContext> style = nullptr;
 
   if (aParentContext) {
     style = aParentContext->GetCachedInheritingAnonBoxStyle(aPseudoTag);
   }
 
   if (!style) {
+    // People like to call into here from random attribute notifications (see
+    // bug 1388234, and bug 1389029).
+    //
+    // We may get a wrong cached style if the stylist needs an update, but we'll
+    // have a whole restyle scheduled anyway.
+    UpdateStylistIfNeeded();
+
     style =
       Servo_ComputedValues_GetForAnonymousBox(aParentContext,
                                               aPseudoTag,
                                               mRawSet.get()).Consume();
     MOZ_ASSERT(style);
     if (aParentContext) {
       aParentContext->SetCachedInheritedAnonBoxStyle(aPseudoTag, style);
     }
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1388234.html
@@ -0,0 +1,9 @@
+<style></style>
+<script>
+  try { o1 = document.createElement('th') } catch(e) { }
+  try { document.documentElement.appendChild(o1) } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { }", 0); } catch(e) { }
+  try { document.documentElement.getBoundingClientRect() } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { unicode-bidi: bidi-override}", 0); } catch(e) { }
+  try { o1.rowSpan = 32 } catch(e) { }
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -195,8 +195,9 @@ load large_border_image_width.html
 load link-transition-before.html
 load long-url-list-stack-overflow.html
 load 1383981.html
 load 1383981-2.html
 load 1384824-1.html
 load 1384824-2.html
 load 1387481-1.html
 load 1387499.html
+load 1388234.html