Backed out changeset 62ad968c5c5d (bug 1294572) for mass crashes in mozilla::dom::FragmentOrElement::SetXBLInsertionParent

CLOSED TREE

MozReview-Commit-ID: Fw9sxk3lnML

dom/base/FragmentOrElement.cpp

@@ -23,7 +23,6 @@
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/EventListenerManager.h"
 #include "mozilla/EventStates.h"
-#include "mozilla/ServoRestyleManager.h"
 #include "mozilla/dom/Attr.h"
 #include "nsDOMAttributeMap.h"
 #include "nsIAtom.h"
@@ -1113,12 +1112,6 @@ FragmentOrElement::SetXBLInsertionParent(nsIContent* aContent)
       slots->mXBLInsertionParent = nullptr;
     }
   }
-
-  // We just changed the flattened tree, so any Servo style data is now invalid.
-  // We rely on nsXBLService::LoadBindings to re-traverse the subtree afterwards.
-  if (IsElement() && AsElement()->HasServoData()) {
-    ServoRestyleManager::ClearServoDataFromSubtree(AsElement());
-  }
 }
 
 CustomElementData*

dom/xbl/nsXBLBinding.cpp

@@ -58,6 +58,7 @@
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/ScriptSettings.h"
 #include "mozilla/dom/ShadowRoot.h"
+#include "mozilla/ServoStyleSet.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -419,6 +420,14 @@ nsXBLBinding::GenerateAnonymousContent()
     if (mContent)
       mContent->UnsetAttr(namespaceID, name, false);
   }
+
+  // Now that we've finished shuffling the tree around, go ahead and restyle it
+  // since frame construction is about to happen.
+  nsIPresShell* presShell = mBoundElement->OwnerDoc()->GetShell();
+  ServoStyleSet* servoSet = presShell->StyleSet()->GetAsServo();
+  if (servoSet) {
+    servoSet->StyleNewChildren(mBoundElement->AsElement());
+  }
 }
 
 nsIURI*

dom/xbl/nsXBLService.cpp

@@ -53,7 +53,6 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/EventListenerManager.h"
 #include "mozilla/Preferences.h"
-#include "mozilla/ServoStyleSet.h"
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/Element.h"
 
@@ -407,24 +406,6 @@ nsXBLService::IsChromeOrResourceURI(nsIURI* aURI)
   return false;
 }
 
-// RAII class to invoke StyleNewChildren for Elements in Servo-backed documents
-// on destruction.
-class MOZ_STACK_CLASS AutoStyleNewChildren
-{
-public:
-  AutoStyleNewChildren(Element* aElement) : mElement(aElement) { MOZ_ASSERT(mElement); }
-  ~AutoStyleNewChildren()
-  {
-    nsIPresShell* presShell = mElement->OwnerDoc()->GetShell();
-    ServoStyleSet* servoSet = presShell ? presShell->StyleSet()->GetAsServo() : nullptr;
-    if (servoSet) {
-      servoSet->StyleNewChildren(mElement);
-    }
-  }
-
-private:
-  Element* mElement;
-};
 
 // This function loads a particular XBL file and installs all of the bindings
 // onto the element.
@@ -455,15 +436,6 @@ nsXBLService::LoadBindings(nsIContent* aContent, nsIURI* aURL,
     return NS_OK;
   }
 
-  // There are various places in this function where we shuffle content around
-  // the subtree and rebind things to and from insertion points. Once all that's
-  // done, we want to invoke StyleNewChildren to style any unstyled children
-  // that we may have after bindings have been removed and applied. This includes
-  // anonymous content created in this function, explicit children for which we
-  // defer styling until after XBL bindings are applied, and elements whose existing
-  // style was invalidated by a call to SetXBLInsertionParent.
-  AutoStyleNewChildren styleNewChildren(aContent->AsElement());
-
   nsXBLBinding *binding = aContent->GetXBLBinding();
   if (binding) {
     if (binding->MarkedForDeath()) {