Bug 1468140 - Call AccessibleCaretEventHub::Init in a ScriptRunner. r=mats

Differential Revision: https://phabricator.services.mozilla.com/D9568

--HG--
extra : moz-landing-system : lando

layout/generic/nsCanvasFrame.cpp

@@ -12,6 +12,7 @@
 #include "gfxUtils.h"
 #include "nsContainerFrame.h"
 #include "nsContentCreatorFunctions.h"
+#include "nsContentUtils.h"
 #include "nsCSSRendering.h"
 #include "nsPresContext.h"
 #include "nsPopupSetFrame.h"
@@ -83,13 +84,15 @@ nsresult nsCanvasFrame::CreateAnonymousContent(
   RefPtr<AccessibleCaretEventHub> eventHub =
       PresShell()->GetAccessibleCaretEventHub();
 
-  // This will go through InsertAnonymousContent and such, and we don't really
-  // want it to end up inserting into our content container.
-  //
-  // FIXME(emilio): The fact that this enters into InsertAnonymousContent is a
-  // bit nasty, can we avoid it, maybe doing this off a scriptrunner?
+  // AccessibleCaret uses Document::InsertAnonymousContent() to insert caret
+  // element into mCustomContentContainer. To prevent it from doing so before
+  // the mCustomContentContainer becoming a native anonymous root, run it in a
+  // ScriptRunner.
   if (eventHub) {
-    eventHub->Init();
+    nsContentUtils::AddScriptRunner(
+      NewRunnableMethod("AccessibleCaretEventHub::Init",
+                        eventHub,
+                        &AccessibleCaretEventHub::Init));
   }
 
   // Create the custom content container.