Don't calculate stuff with dirty lists. Bug 367243, r=mats, sr=dbaron

layout/base/nsCSSFrameConstructor.cpp

@@ -2024,15 +2024,22 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIFrame*             aParentFram
           return NS_ERROR_OUT_OF_MEMORY;
 
         counterList->Insert(node);
-        if (counterList->IsLast(node))
-          node->Calc(counterList);
-        else {
-          counterList->SetDirty();
-          CountersDirty();
+        PRBool dirty = counterList->IsDirty();
+        if (!dirty) {
+          if (counterList->IsLast(node)) {
+            node->Calc(counterList);
+            node->GetText(contentString);
+          }
+          // In all other cases (list already dirty or node not at the end),
+          // just start with an empty string for now and when we recalculate
+          // the list we'll change the value to the right one.
+          else {
+            counterList->SetDirty();
+            CountersDirty();
+          }
         }
 
         textPtr = &node->mText; // text node assigned below
-        node->GetText(contentString);
       }
       break;
 

layout/base/nsCounterManager.cpp

@@ -46,6 +46,8 @@
 // Should be called immediately after calling |Insert|.
 void nsCounterUseNode::Calc(nsCounterList *aList)
 {
+    NS_ASSERTION(!aList->IsDirty(),
+                 "Why are we calculating with a dirty list?");
     mValueAfter = aList->ValueBefore(this);
 }
 
@@ -53,6 +55,8 @@ void nsCounterUseNode::Calc(nsCounterList *aList)
 // Should be called immediately after calling |Insert|.
 void nsCounterChangeNode::Calc(nsCounterList *aList)
 {
+    NS_ASSERTION(!aList->IsDirty(),
+                 "Why are we calculating with a dirty list?");
     if (mType == RESET) {
         mValueAfter = mChangeValue;
     } else {
@@ -235,7 +239,12 @@ nsCounterManager::AddResetOrIncrement(nsIFrame *aFrame, PRInt32 aIndex,
         // list.
         return PR_TRUE;
     }
-    node->Calc(counterList);
+
+    // Don't call Calc() if the list is already dirty -- it'll be recalculated
+    // anyway, and trying to calculate with a dirty list doesn't work.
+    if (NS_LIKELY(!counterList->IsDirty())) {
+        node->Calc(counterList);
+    }
     return PR_FALSE;
 }
 

layout/base/nsCounterManager.h

@@ -190,7 +190,11 @@ public:
 
     void Insert(nsCounterNode* aNode) {
         nsGenConList::Insert(aNode);
-        SetScope(aNode);
+        // Don't SetScope if we're dirty -- we'll reset all the scopes anyway,
+        // and we can't usefully compute scopes right now.
+        if (NS_LIKELY(!IsDirty())) {
+            SetScope(aNode);
+        }
     }
 
     nsCounterNode* First() {