Bug 1507674 - Flush the overflow changed tracker earlier. r=jwatt

So we do it while we're still handling re-entrant changes for SVG, since SVG can
post change hints from UpdateOverflow().

Differential Revision: https://phabricator.services.mozilla.com/D12102

--HG--
extra : moz-landing-system : lando

layout/base/RestyleManager.cpp

@@ -1792,6 +1792,7 @@ void RestyleManager::ProcessRestyledFrames(nsStyleChangeList& aChangeList) {
   }
 
   aChangeList.Clear();
+  FlushOverflowChangedTracker();
 }
 
 /* static */
@@ -3122,8 +3123,6 @@ void RestyleManager::DoProcessPendingRestyles(ServoTraversalFlags aFlags) {
 
   doc->ClearServoRestyleRoot();
 
-  FlushOverflowChangedTracker();
-
   ClearSnapshots();
   styleSet->AssertTreeIsClean();
   mHaveNonAnimationRestyles = false;

layout/style/crashtests/1507674.html

@@ -0,0 +1,16 @@
+<style>
+menuitem { -webkit-filter: url(#a) }
+</style>
+<menuitem>A
+</menu>
+<svg id="b" style="-webkit-text-stroke-width: 1px;">
+<text id="a">
+<menu style="background-image: url();">
+<menuitem id="c">
+<script>
+c.offsetTop;
+a.setAttribute("exponent", "1");
+c.offsetTop;
+b.setAttribute("text-decoration", "line-through");
+c.offsetTop;
+</script>

layout/style/crashtests/crashtests.list

@@ -295,6 +295,7 @@ load 1479681.html
 load 1488817.html
 load 1490012.html
 load 1502893.html
+load 1507674.html
 load 1509989.html
 load 1514086.html
 load 1533783.html