Fix bustage from bug 636039, patch 13, by not trying to access stub entries in kOffsetTable for the CSS_PROP_STUB_NOT_CSS entries. (Bug 636039)

layout/style/nsCSSDataBlock.cpp

@@ -611,8 +611,12 @@ nsCSSExpandedDataBlock::DoAssertInitialState()
     mPropertiesImportant.AssertIsEmpty("not initial state");
 
     for (PRUint32 i = 0; i < eCSSProperty_COUNT_no_shorthands; ++i) {
-        NS_ABORT_IF_FALSE(PropertyAt(nsCSSProperty(i))->GetUnit() ==
-                          eCSSUnit_Null, "not initial state");
+        // Check all properties except the non-CSS ones, which have
+        // size_t(-1) in kOffsetTable.
+        nsCSSProperty prop = nsCSSProperty(i);
+        NS_ABORT_IF_FALSE(kOffsetTable[prop] == size_t(-1) ||
+                          PropertyAt(prop)->GetUnit() == eCSSUnit_Null,
+                          "not initial state");
     }
 }
 #endif

layout/style/nsCSSDataBlock.h

@@ -286,7 +286,12 @@ private:
      * property |aProperty|.
      */
     nsCSSValue* PropertyAt(nsCSSProperty aProperty) {
+        NS_ABORT_IF_FALSE(0 <= aProperty &&
+                          aProperty < eCSSProperty_COUNT_no_shorthands,
+                          "property out of range");
         size_t offset = nsCSSExpandedDataBlock::kOffsetTable[aProperty];
+        NS_ABORT_IF_FALSE(offset != size_t(-1), 
+                          "requesting offset of non-CSS property");
         return reinterpret_cast<nsCSSValue*>(reinterpret_cast<char*>(this) +
                                              offset);
     }