Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonymousBoxStyle. r=heycam

MozReview-Commit-ID: FYctJRfLTK6

--HG--
extra : rebase_source : feec0d3a65c501ea7b3382d892f512388bd7240e

layout/style/ServoStyleSet.cpp

@@ -535,10 +535,6 @@ ServoStyleSet::ResolveInheritingAnonymousBoxStyle(nsIAtom* aPseudoTag,
 {
   MOZ_ASSERT(nsCSSAnonBoxes::IsAnonBox(aPseudoTag) &&
              !nsCSSAnonBoxes::IsNonInheritingAnonBox(aPseudoTag));
-  MOZ_ASSERT_IF(aParentContext, !StylistNeedsUpdate());
-
-  UpdateStylistIfNeeded();
-
   RefPtr<ServoStyleContext> style = nullptr;
 
   if (aParentContext) {
@@ -546,6 +542,13 @@ ServoStyleSet::ResolveInheritingAnonymousBoxStyle(nsIAtom* aPseudoTag,
   }
 
   if (!style) {
+    // People like to call into here from random attribute notifications (see
+    // bug 1388234, and bug 1389029).
+    //
+    // We may get a wrong cached style if the stylist needs an update, but we'll
+    // have a whole restyle scheduled anyway.
+    UpdateStylistIfNeeded();
+
     style =
       Servo_ComputedValues_GetForAnonymousBox(aParentContext,
                                               aPseudoTag,

layout/style/crashtests/1388234.html

@@ -0,0 +1,9 @@
+<style></style>
+<script>
+  try { o1 = document.createElement('th') } catch(e) { }
+  try { document.documentElement.appendChild(o1) } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { }", 0); } catch(e) { }
+  try { document.documentElement.getBoundingClientRect() } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { unicode-bidi: bidi-override}", 0); } catch(e) { }
+  try { o1.rowSpan = 32 } catch(e) { }
+</script>

layout/style/crashtests/crashtests.list

@@ -200,3 +200,4 @@ load 1384824-1.html
 load 1384824-2.html
 load 1387481-1.html
 load 1387499.html
+load 1388234.html