Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonimousBoxStyle. r?heycam draft
authorEmilio Cobos Álvarez <emilio@crisal.io>
Tue, 08 Aug 2017 14:54:13 +0200
changeset 642664 db89f7a04750586f7bd99000079f0647c7b7659c
parent 642663 ce2b6a193210388b2e672e1201684448bb1f4220
child 642665 3138eb914fba13d7840f14f196e2f8193a7a39ac
push id72833
push userbmo:emilio+bugs@crisal.io
push dateTue, 08 Aug 2017 16:50:16 +0000
reviewersheycam
bugs1388234
milestone57.0a1
Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonimousBoxStyle. r?heycam MozReview-Commit-ID: FYctJRfLTK6
layout/style/ServoStyleSet.cpp
layout/style/crashtests/1388234.html
layout/style/crashtests/crashtests.list
--- a/layout/style/ServoStyleSet.cpp
+++ b/layout/style/ServoStyleSet.cpp
@@ -525,27 +525,30 @@ ServoStyleSet::ResolveStyleLazily(Elemen
 }
 
 already_AddRefed<ServoStyleContext>
 ServoStyleSet::ResolveInheritingAnonymousBoxStyle(nsIAtom* aPseudoTag,
                                                   ServoStyleContext* aParentContext)
 {
   MOZ_ASSERT(nsCSSAnonBoxes::IsAnonBox(aPseudoTag) &&
              !nsCSSAnonBoxes::IsNonInheritingAnonBox(aPseudoTag));
-  MOZ_ASSERT_IF(aParentContext, !StylistNeedsUpdate());
-
-  UpdateStylistIfNeeded();
-
   RefPtr<ServoStyleContext> style = nullptr;
 
   if (aParentContext) {
     style = aParentContext->GetCachedInheritingAnonBoxStyle(aPseudoTag);
   }
 
   if (!style) {
+    // People like to call into here from random attribute notifications (see
+    // bug 1388234).
+    //
+    // We may get a wrong cached style if the stylist needs an update, but we'll
+    // have a whole restyle scheduled anyway.
+    UpdateStylistIfNeeded();
+
     style =
       Servo_ComputedValues_GetForAnonymousBox(aParentContext,
                                               aPseudoTag,
                                               mRawSet.get()).Consume();
     MOZ_ASSERT(style);
     if (aParentContext) {
       aParentContext->SetCachedInheritedAnonBoxStyle(aPseudoTag, *style);
     }
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1388234.html
@@ -0,0 +1,9 @@
+<style></style>
+<script>
+  try { o1 = document.createElement('th') } catch(e) { }
+  try { document.documentElement.appendChild(o1) } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { }", 0); } catch(e) { }
+  try { document.documentElement.getBoundingClientRect() } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { unicode-bidi: bidi-override}", 0); } catch(e) { }
+  try { o1.rowSpan = 32 } catch(e) { }
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -194,8 +194,9 @@ load font-face-truncated-src.html
 load large_border_image_width.html
 load link-transition-before.html
 load long-url-list-stack-overflow.html
 load 1383981.html
 load 1383981-2.html
 load 1384824-1.html
 load 1384824-2.html
 load 1387481-1.html
+load 1388234.html