Bug 1480275: Handle nested use shadow trees properly when the ID target changes. r=heycam

We end up with three <svg:use> elements to update (lol), because the target (#c)
changes, since we create another element with that ID in the document via
outerHTML.

Differential Revision: https://phabricator.services.mozilla.com/D2650

--HG--
extra : moz-landing-system : lando

dom/base/nsDocument.cpp

@@ -9801,6 +9801,13 @@ nsIDocument::DoUpdateSVGUseElementShadowTrees()
     }
 
     for (auto& useElement : useElementsToUpdate) {
+      if (MOZ_UNLIKELY(!useElement->IsInComposedDoc())) {
+        // The element was in another <use> shadow tree which we processed
+        // already and also needed an update, and is removed from the document
+        // now, so nothing to do here.
+        MOZ_ASSERT(useElementsToUpdate.Length() > 1);
+        continue;
+      }
       useElement->UpdateShadowTree();
     }
   } while (!mSVGUseElementsNeedingShadowTreeUpdate.IsEmpty());

layout/svg/crashtests/1480275.html

@@ -0,0 +1,15 @@
+<script>
+function go() {
+  b.appendChild(a);
+  d.outerHTML = f.outerHTML;
+}
+</script>
+<table>
+<tr id="a">
+<th>
+<svg id="c" onload="go()">
+<use xlink:href="#c"/>
+</tr>
+<code id="d"></code>
+<video id="f">
+<details id="b">

layout/svg/crashtests/crashtests.list

@@ -213,4 +213,5 @@ load conditional-outer-svg-nondirty-reflow-assert.xhtml
 load extref-test-1.xhtml
 load blob-merging-and-retained-display-list.html
 load grouping-empty-bounds.html
+load 1480275.html
 load 1480224.html