Don't apply user stylesheets to native anonymous content. Bug 286895, r+sr=dbaron

content/base/src/nsGenericDOMDataNode.cpp

@@ -567,6 +567,9 @@ nsGenericDOMDataNode::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                   (!aBindingParent && aParent &&
                    aParent->GetBindingParent() == GetBindingParent()),
                   "Already have a binding parent.  Unbind first!");
+  NS_PRECONDITION(aBindingParent != this || IsNativeAnonymous(),
+                  "Only native anonymous content should have itself as its "
+                  "own binding parent");
 
   if (!aBindingParent && aParent) {
     aBindingParent = aParent->GetBindingParent();

content/base/src/nsGenericElement.cpp

@@ -1756,6 +1756,9 @@ nsGenericElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                   (!aBindingParent && aParent &&
                    aParent->GetBindingParent() == GetBindingParent()),
                   "Already have a binding parent.  Unbind first!");
+  NS_PRECONDITION(aBindingParent != this || IsNativeAnonymous(),
+                  "Only native anonymous content should have itself as its "
+                  "own binding parent");
   
   if (!aBindingParent && aParent) {
     aBindingParent = aParent->GetBindingParent();

content/xbl/src/nsBindingManager.cpp

@@ -1090,11 +1090,14 @@ nsBindingManager::WalkRules(nsStyleSet* aStyleSet,
     }
 
     nsIContent* parent = content->GetBindingParent();
-    if (parent == content)
+    if (parent == content) {
-      break; // The scrollbar case only is deliberately hacked to return itself
+      NS_ASSERTION(content->IsNativeAnonymous() ||
-             // (see GetBindingParent in nsXULElement.cpp).  Actually, all
+                   content->IsNodeOfType(nsINode::eXUL),
-             // native anonymous content is thus hacked.  Cut off inheritance
+                   "Unexpected binding parent");
-             // here.
+                             
+      break; // The anonymous content case is often deliberately hacked to
+             // return itself to cut off style inheritance here.  Do that.
+    }
 
     content = parent;
   } while (content);

layout/base/nsCSSFrameConstructor.cpp

@@ -1905,6 +1905,8 @@ nsCSSFrameConstructor::CreateAttributeContent(nsIContent* aParentContent,
                                        getter_AddRefs(content));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  content->SetNativeAnonymous(PR_TRUE);
+
   // Set aContent as the parent content so that event handling works.
   rv = content->BindToTree(mDocument, aParentContent, content, PR_TRUE);
   if (NS_FAILED(rv)) {
@@ -1912,8 +1914,6 @@ nsCSSFrameConstructor::CreateAttributeContent(nsIContent* aParentContent,
     return rv;
   }
 
-  content->SetNativeAnonymous(PR_TRUE);
-
   // Create a text frame and initialize it
   nsIFrame* textFrame = NS_NewTextFrame(mPresShell, aStyleContext);
   rv = textFrame->Init(content, aParentFrame, nsnull);
@@ -1967,6 +1967,8 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIFrame*             aParentFram
                                            data.mContent.mImage);
     NS_ENSURE_SUCCESS(rv, rv);
 
+    content->SetNativeAnonymous(PR_TRUE);
+  
     // Set aContent as the parent content and set the document object. This
     // way event handling works
     // Hack the binding parent to make document rules not match (not
@@ -1978,8 +1980,6 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIFrame*             aParentFram
       return rv;
     }
     
-    content->SetNativeAnonymous(PR_TRUE);
-  
     // Create an image frame and initialize it
     nsIFrame* imageFrame = NS_NewImageFrame(mPresShell, aStyleContext);
     if (NS_UNLIKELY(!imageFrame)) {
@@ -2149,6 +2149,8 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIFrame*             aParentFram
           NS_ASSERTION(*textPtr, "must implement nsIDOMCharacterData");
         }
 
+        textContent->SetNativeAnonymous(PR_TRUE);
+
         // Set aContent as the parent content so that event handling works.
         nsresult rv = textContent->BindToTree(mDocument, aContent, textContent,
                                               PR_TRUE);
@@ -2157,8 +2159,6 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIFrame*             aParentFram
           return rv;
         }
 
-        textContent->SetNativeAnonymous(PR_TRUE);
-
         // Create a text frame and initialize it
         textFrame = NS_NewTextFrame(mPresShell, aStyleContext);
         if (!textFrame) {

layout/style/nsStyleSet.cpp

@@ -461,8 +461,13 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   if (mRuleProcessors[ePresHintSheet])
     (*aCollectorFunc)(mRuleProcessors[ePresHintSheet], aData);
   nsRuleNode* lastPresHintRN = mRuleWalker->GetCurrentNode();
-  
+
-  if (mRuleProcessors[eUserSheet])
+  PRBool skipUserStyles = aData->mContent &&
+    aData->mContent == aData->mContent->GetBindingParent();
+  NS_ASSERTION(!skipUserStyles || aData->mContent->IsNativeAnonymous() ||
+               aData->mContent->IsNodeOfType(nsINode::eXUL),
+               "Content with bogus binding parent");
+  if (!skipUserStyles && mRuleProcessors[eUserSheet]) // NOTE: different
     (*aCollectorFunc)(mRuleProcessors[eUserSheet], aData);
   nsRuleNode* lastUserRN = mRuleWalker->GetCurrentNode();
 
@@ -476,7 +481,8 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
     mBindingManager->WalkRules(this, aCollectorFunc, aData,
                                &cutOffInheritance);
   }
-  if (!cutOffInheritance && mRuleProcessors[eDocSheet]) // NOTE: different
+  if (!skipUserStyles && !cutOffInheritance &&
+      mRuleProcessors[eDocSheet]) // NOTE: different
     (*aCollectorFunc)(mRuleProcessors[eDocSheet], aData);
   if (mRuleProcessors[eStyleAttrSheet])
     (*aCollectorFunc)(mRuleProcessors[eStyleAttrSheet], aData);
@@ -514,8 +520,15 @@ nsStyleSet::WalkRuleProcessors(nsIStyleRuleProcessor::EnumFunc aFunc,
     (*aFunc)(mRuleProcessors[eAgentSheet], aData);
   if (mRuleProcessors[ePresHintSheet])
     (*aFunc)(mRuleProcessors[ePresHintSheet], aData);
-  if (mRuleProcessors[eUserSheet])
+
+  PRBool skipUserStyles = aData->mContent &&
+    aData->mContent == aData->mContent->GetBindingParent();
+  NS_ASSERTION(!skipUserStyles || aData->mContent->IsNativeAnonymous() ||
+               aData->mContent->IsNodeOfType(nsINode::eXUL),
+               "Content with bogus binding parent");
+  if (!skipUserStyles && mRuleProcessors[eUserSheet]) // NOTE: different
     (*aFunc)(mRuleProcessors[eUserSheet], aData);
+
   if (mRuleProcessors[eHTMLPresHintSheet])
     (*aFunc)(mRuleProcessors[eHTMLPresHintSheet], aData);
   
@@ -524,7 +537,8 @@ nsStyleSet::WalkRuleProcessors(nsIStyleRuleProcessor::EnumFunc aFunc,
     // We can supply additional document-level sheets that should be walked.
     mBindingManager->WalkRules(this, aFunc, aData, &cutOffInheritance);
   }
-  if (!cutOffInheritance && mRuleProcessors[eDocSheet]) // NOTE: different
+  if (!skipUserStyles && !cutOffInheritance &&
+      mRuleProcessors[eDocSheet]) // NOTE: different
     (*aFunc)(mRuleProcessors[eDocSheet], aData);
   if (mRuleProcessors[eStyleAttrSheet])
     (*aFunc)(mRuleProcessors[eStyleAttrSheet], aData);