Bug 1562361 - Clear cached style indices whenever we clear the actual styles. r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D36450

--HG--
extra : moz-landing-system : lando

layout/style/ServoStyleSet.cpp

@@ -96,6 +96,7 @@ class MOZ_RAII AutoPrepareTraversal {
 
 ServoStyleSet::ServoStyleSet(Document& aDocument) : mDocument(&aDocument) {
   PreferenceSheet::EnsureInitialized();
+  PodArrayZero(mCachedAnonymousContentStyleIndexes);
   mRawSet.reset(Servo_StyleSet_Init(&aDocument));
 }
 
@@ -122,6 +123,7 @@ void EnumerateShadowRoots(const Document& aDoc, const Functor& aCb) {
 void ServoStyleSet::ShellDetachedFromDocument() {
   ClearNonInheritingComputedStyles();
   mCachedAnonymousContentStyles.Clear();
+  PodArrayZero(mCachedAnonymousContentStyleIndexes);
   mStyleRuleMap = nullptr;
 
   // Remove all our stylesheets...

layout/style/ServoStyleSet.h

@@ -583,9 +583,8 @@ class ServoStyleSet {
   // mCachedAnonymousContentStyles.
   //
   // We assert that the index and length values fit into uint8_ts.
-  std::pair<uint8_t, uint8_t>
-      mCachedAnonymousContentStyleIndexes[1
-                                          << sizeof(AnonymousContentKey) * 8]{};
+  Array<std::pair<uint8_t, uint8_t>, 1 << sizeof(AnonymousContentKey) * 8>
+      mCachedAnonymousContentStyleIndexes;
 
   // Stores cached ComputedStyles for certain native anonymous content.
   nsTArray<RefPtr<ComputedStyle>> mCachedAnonymousContentStyles;

layout/style/crashtests/1562361.html

@@ -0,0 +1,15 @@
+<script>
+window.onload = function() {
+  a.setAttribute("width", "0")
+  b.select()
+  document.documentElement.style.display="none"
+  document.documentElement.getBoundingClientRect()
+  document.documentElement.style.display=""
+
+  SpecialPowers.forceGC();
+  SpecialPowers.forceCC();
+  document.body.offsetTop;
+}
+</script>
+<input id="b" type="number">
+<iframe id="a" height="0">

layout/style/crashtests/crashtests.list

@@ -306,3 +306,4 @@ load 1541126.html
 load 1545177.html
 load 1546255.html
 pref(layout.css.resizeobserver.enabled,true) load 1552911.html
+load 1562361.html