Backed out changeset 74eb0b08e42b (bug 1353187 patch 2) for test failures (assertions firing).

layout/base/FramePropertyTable.cpp

@@ -22,7 +22,6 @@ FramePropertyTable::SetInternal(
   if (mLastFrame != aFrame || !mLastEntry) {
     mLastFrame = aFrame;
     mLastEntry = mEntries.PutEntry(aFrame);
-    aFrame->AddStateBits(NS_FRAME_HAS_PROPERTIES);
   }
   Entry* entry = mLastEntry;
 
@@ -64,8 +63,7 @@ FramePropertyTable::SetInternal(
 
 void*
 FramePropertyTable::GetInternal(
-  const nsIFrame* aFrame, UntypedDescriptor aProperty, bool aSkipBitCheck,
-  bool* aFoundResult)
+  const nsIFrame* aFrame, UntypedDescriptor aProperty, bool* aFoundResult)
 {
   NS_ASSERTION(aFrame, "Null frame?");
   NS_ASSERTION(aProperty, "Null property?");
@@ -74,10 +72,6 @@ FramePropertyTable::GetInternal(
     *aFoundResult = false;
   }
 
-  if (!aSkipBitCheck && !(aFrame->GetStateBits() & NS_FRAME_HAS_PROPERTIES)) {
-    return nullptr;
-  }
-
   // We can end up here during parallel style traversal, in which case the main
   // thread is blocked. Reading from the cache is fine on any thread, but we
   // only want to write to it in the main-thread case.
@@ -88,8 +82,6 @@ FramePropertyTable::GetInternal(
     mLastEntry = entry;
   }
 
-  MOZ_ASSERT(entry || aSkipBitCheck,
-             "NS_FRAME_HAS_PROPERTIES bit should match whether entry exists");
   if (!entry)
     return nullptr;
 
@@ -129,17 +121,11 @@ FramePropertyTable::RemoveInternal(
     *aFoundResult = false;
   }
 
-  if (!(aFrame->GetStateBits() & NS_FRAME_HAS_PROPERTIES)) {
-    return nullptr;
-  }
-
   if (mLastFrame != aFrame) {
     mLastFrame = aFrame;
     mLastEntry = mEntries.GetEntry(aFrame);
   }
   Entry* entry = mLastEntry;
-  MOZ_ASSERT(entry,
-             "NS_FRAME_HAS_PROPERTIES bit should match whether entry exists");
   if (!entry)
     return nullptr;
 
@@ -150,7 +136,6 @@ FramePropertyTable::RemoveInternal(
     // Here it's ok to use RemoveEntry() -- which may resize mEntries --
     // because we null mLastEntry at the same time.
     mEntries.RemoveEntry(entry);
-    aFrame->RemoveStateBits(NS_FRAME_HAS_PROPERTIES);
     mLastEntry = nullptr;
     if (aFoundResult) {
       *aFoundResult = true;
@@ -225,13 +210,7 @@ FramePropertyTable::DeleteAllFor(nsIFrame* aFrame)
 {
   NS_ASSERTION(aFrame, "Null frame?");
 
-  if (!(aFrame->GetStateBits() & NS_FRAME_HAS_PROPERTIES)) {
-    return;
-  }
-
   Entry* entry = mEntries.GetEntry(aFrame);
-  MOZ_ASSERT(entry,
-             "NS_FRAME_HAS_PROPERTIES bit should match whether entry exists");
   if (!entry)
     return;
 
@@ -247,8 +226,6 @@ FramePropertyTable::DeleteAllFor(nsIFrame* aFrame)
   // mLastEntry points into mEntries, so we use RawRemoveEntry() which will not
   // resize mEntries.
   mEntries.RawRemoveEntry(entry);
-
-  // Don't bother unsetting NS_FRAME_HAS_PROPERTIES, since aFrame is going away
 }
 
 void

layout/base/FramePropertyTable.h

@@ -188,25 +188,12 @@ public:
    *
    *   - Calling Has() before Set() in cases where we don't want to overwrite
    *     an existing value for the frame property.
-   *
-   * The HasSkippingBitCheck variant doesn't test NS_FRAME_HAS_PROPERTIES
-   * on aFrame, so it is safe to call after aFrame has been destroyed as
-   * long as, since that destruction happened, it isn't possible for a
-   * new frame to have been created and the same property added.
    */
   template<typename T>
   bool Has(const nsIFrame* aFrame, Descriptor<T> aProperty)
   {
     bool foundResult = false;
-    mozilla::Unused << GetInternal(aFrame, aProperty, false, &foundResult);
-    return foundResult;
-  }
-
-  template<typename T>
-  bool HasSkippingBitCheck(const nsIFrame* aFrame, Descriptor<T> aProperty)
-  {
-    bool foundResult = false;
-    mozilla::Unused << GetInternal(aFrame, aProperty, true, &foundResult);
+    mozilla::Unused << GetInternal(aFrame, aProperty, &foundResult);
     return foundResult;
   }
 
@@ -225,7 +212,7 @@ public:
   PropertyType<T> Get(const nsIFrame* aFrame, Descriptor<T> aProperty,
                       bool* aFoundResult = nullptr)
   {
-    void* ptr = GetInternal(aFrame, aProperty, false, aFoundResult);
+    void* ptr = GetInternal(aFrame, aProperty, aFoundResult);
     return ReinterpretHelper<T>::FromPointer(ptr);
   }
   /**
@@ -275,7 +262,7 @@ protected:
                    void* aValue);
 
   void* GetInternal(const nsIFrame* aFrame, UntypedDescriptor aProperty,
-                    bool aSkipBitCheck, bool* aFoundResult);
+                    bool* aFoundResult);
 
   void* RemoveInternal(nsIFrame* aFrame, UntypedDescriptor aProperty,
                        bool* aFoundResult);

layout/base/RestyleManager.cpp

@@ -1396,8 +1396,7 @@ RestyleManager::ProcessRestyledFrames(nsStyleChangeList& aChangeList)
       break;
     }
 
-    nsStyleChangeData& mutable_data = aChangeList[i];
-    const nsStyleChangeData& data = mutable_data;
+    const nsStyleChangeData& data = aChangeList[i];
     nsIFrame* frame = data.mFrame;
     nsIContent* content = data.mContent;
     nsChangeHint hint = data.mHint;
@@ -1408,11 +1407,7 @@ RestyleManager::ProcessRestyledFrames(nsStyleChangeList& aChangeList)
                  "Reflow hint bits set without actually asking for a reflow");
 
     // skip any frame that has been destroyed due to a ripple effect
-    if (frame && !propTable->HasSkippingBitCheck(frame, ChangeListProperty())) {
-      // Null out the pointer since the frame was already destroyed.
-      // This is important so we don't try to delete its
-      // ChangeListProperty() below.
-      mutable_data.mFrame = nullptr;
+    if (frame && !propTable->Get(frame, ChangeListProperty())) {
       continue;
     }
 
@@ -1480,11 +1475,6 @@ RestyleManager::ProcessRestyledFrames(nsStyleChangeList& aChangeList)
     }
 
     if (hint & nsChangeHint_ReconstructFrame) {
-      // We're about to destroy data.mFrame, so null out the pointer.
-      // This is important so we don't try to delete its
-      // ChangeListProperty() below.
-      mutable_data.mFrame = nullptr;
-
       // If we ever start passing true here, be careful of restyles
       // that involve a reframe and animations.  In particular, if the
       // restyle we're processing here is an animation restyle, but

layout/generic/nsFrameStateBits.h

@@ -270,9 +270,6 @@ FRAME_STATE_BIT(Generic, 54, NS_FRAME_HAS_LAYER_ACTIVITY_PROPERTY)
 // a stylo tree traversal.
 FRAME_STATE_BIT(Generic, 55, NS_FRAME_OWNS_ANON_BOXES)
 
-// Frame has properties in the nsIFrame::Properties() hash.
-FRAME_STATE_BIT(Generic, 56, NS_FRAME_HAS_PROPERTIES)
-
 // Set for all descendants of MathML sub/supscript elements (other than the
 // base frame) to indicate that the SSTY font feature should be used.
 FRAME_STATE_BIT(Generic, 58, NS_FRAME_MATHML_SCRIPT_DESCENDANT)