Backed out changeset 12db2d364b64 (bug 1364361) for heap write hazard. r=backout

layout/forms/nsComboboxControlFrame.cpp

@@ -1189,10 +1189,15 @@ nsComboboxControlFrame::GetContentInsertionFrame() {
 }
 
 void
-nsComboboxControlFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsComboboxControlFrame::DoUpdateStyleOfOwnedAnonBoxes(
+  ServoStyleSet& aStyleSet,
+  nsStyleChangeList& aChangeList,
+  nsChangeHint aHintForThisFrame)
 {
-  aResult.AppendElement(OwnedAnonBox(this, mDropdownFrame));
+  UpdateStyleOfChildAnonBox(mDropdownFrame, aStyleSet, aChangeList,
-  aResult.AppendElement(OwnedAnonBox(this, mDisplayFrame));
+                            aHintForThisFrame);
+  UpdateStyleOfChildAnonBox(mDisplayFrame, aStyleSet, aChangeList,
+                            aHintForThisFrame);
 }
 
 nsresult

layout/forms/nsComboboxControlFrame.h

@@ -117,8 +117,10 @@ public:
 
   virtual nsContainerFrame* GetContentInsertionFrame() override;
 
-  // Return the dropdown and display frame.
+  // Update the style on the block wrappers around our kids.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 
   // nsIFormControlFrame
   virtual nsresult SetFormProperty(nsIAtom* aName, const nsAString& aValue) override;

layout/forms/nsFieldSetFrame.cpp

@@ -664,10 +664,13 @@ nsFieldSetFrame::GetNaturalBaselineBOffset(WritingMode          aWM,
 }
 
 void
-nsFieldSetFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsFieldSetFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
+                                               nsStyleChangeList& aChangeList,
+                                               nsChangeHint aHintForThisFrame)
 {
-  if (nsIFrame* kid = GetInner()) {
+  nsIFrame* kid = GetInner();
-    aResult.AppendElement(OwnedAnonBox(this, kid));
+  if (kid) {
+    UpdateStyleOfChildAnonBox(kid, aStyleSet, aChangeList, aHintForThisFrame);
   }
 }
 

layout/forms/nsFieldSetFrame.h

@@ -73,8 +73,11 @@ public:
     return do_QueryFrame(GetInner());
   }
 
-  // Return the block wrapper around our kids.
+  // Update the style on the block wrappers around our kids.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(
+    mozilla::ServoStyleSet& aStyleSet,
+    nsStyleChangeList& aChangeList,
+    nsChangeHint aHintForThisFrame) override;
 
 #ifdef ACCESSIBILITY  
   virtual mozilla::a11y::AccType AccessibleType() override;

layout/forms/nsHTMLButtonControlFrame.cpp

@@ -396,12 +396,16 @@ nsHTMLButtonControlFrame::SetAdditionalStyleContext(int32_t aIndex,
 }
 
 void
-nsHTMLButtonControlFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsHTMLButtonControlFrame::DoUpdateStyleOfOwnedAnonBoxes(
+  ServoStyleSet& aStyleSet,
+  nsStyleChangeList& aChangeList,
+  nsChangeHint aHintForThisFrame)
 {
   MOZ_ASSERT(mFrames.FirstChild(), "Must have our button-content anon box");
   MOZ_ASSERT(!mFrames.FirstChild()->GetNextSibling(),
              "Must only have our button-content anon box");
-  aResult.AppendElement(OwnedAnonBox(this, mFrames.FirstChild()));
+  UpdateStyleOfChildAnonBox(mFrames.FirstChild(),
+                            aStyleSet, aChangeList, aHintForThisFrame);
 }
 
 #ifdef DEBUG

layout/forms/nsHTMLButtonControlFrame.h

@@ -98,9 +98,12 @@ public:
       ~(nsIFrame::eReplaced | nsIFrame::eReplacedContainsBlock));
   }
 
-  // Return the ::-moz-button-content anonymous box.
+  /**
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+   * Update the style of our ::-moz-button-content anonymous box.
-
+   */
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 protected:
   nsHTMLButtonControlFrame(nsStyleContext* aContext, nsIFrame::ClassID aID);
 

layout/generic/nsColumnSetFrame.cpp

@@ -1260,7 +1260,10 @@ nsColumnSetFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
 }
 
 void
-nsColumnSetFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsColumnSetFrame::DoUpdateStyleOfOwnedAnonBoxes(
+    mozilla::ServoStyleSet& aStyleSet,
+    nsStyleChangeList& aChangeList,
+    nsChangeHint aHintForThisFrame)
 {
   // Everything in mFrames is continuations of the first thing in mFrames.
   nsIFrame* column = mFrames.FirstChild();
@@ -1273,7 +1276,7 @@ nsColumnSetFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
   MOZ_ASSERT(column->StyleContext()->GetPseudo() ==
                nsCSSAnonBoxes::columnContent,
              "What sort of child is this?");
-  aResult.AppendElement(OwnedAnonBox(this, column));
+  UpdateStyleOfChildAnonBox(column, aStyleSet, aChangeList, aHintForThisFrame);
 }
 
 #ifdef DEBUG

layout/generic/nsColumnSetFrame.h

@@ -77,8 +77,12 @@ public:
    */
   void DrainOverflowColumns();
 
-  // Return the column-content frame.
+  /**
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+   * Update the style on our column-content frames.
+   */
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 
 #ifdef DEBUG_FRAME_DUMP
   virtual nsresult GetFrameName(nsAString& aResult) const override {

layout/generic/nsFrame.cpp

@@ -46,7 +46,7 @@
 #include "mozilla/GeckoRestyleManager.h"
 #include "mozilla/RestyleManager.h"
 #include "mozilla/RestyleManagerInlines.h"
-#include "nsInlineFrame.h"
+
 #include "nsIDOMNode.h"
 #include "nsISelection.h"
 #include "nsISelectionPrivate.h"
@@ -10201,10 +10201,10 @@ nsFrame::BoxMetrics() const
 }
 
 void
-nsIFrame::UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
+nsFrame::UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
-                                    ServoStyleSet& aStyleSet,
+                                   ServoStyleSet& aStyleSet,
-                                    nsStyleChangeList& aChangeList,
+                                   nsStyleChangeList& aChangeList,
-                                    nsChangeHint aHintForThisFrame)
+                                   nsChangeHint aHintForThisFrame)
 {
   MOZ_ASSERT(aChildFrame->GetParent() == this,
              "This should only be used for children!");
@@ -10479,74 +10479,16 @@ nsIFrame::IsScrolledOutOfView()
   return IsFrameScrolledOutOfView(this);
 }
 
+/* virtual */
 void
 nsIFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-                                        nsStyleChangeList& aChangeList,
+                                      nsStyleChangeList& aChangeList,
-                                        nsChangeHint aHintForThisFrame)
+                                      nsChangeHint aHintForThisFrame)
-{
-  // As a special case, we check for {ib}-split block frames here, rather
-  // than have an nsInlineFrame::AppendDirectlyOwnedAnonBoxes implementation
-  // that returns them.
-  //
-  // (If we did handle them in AppendDirectlyOwnedAnonBoxes, we would have to
-  // return *all* of the in-flow {ib}-split block frames, not just the first
-  // one.  For restyling, we really just need the first in flow, and the other
-  // user of the AppendOwnedAnonBoxes API, AllChildIterator, doesn't need to
-  // know about them at all, since these block frames never create NAC.  So we
-  // avoid any unncessary hashtable lookups for the {ib}-split frames by calling
-  // UpdateStyleOfOwnedAnonBoxesForIBSplit directly here.)
-  if (IsInlineFrame()) {
-    if ((GetStateBits() & NS_FRAME_PART_OF_IBSPLIT)) {
-      static_cast<nsInlineFrame*>(this)->
-        UpdateStyleOfOwnedAnonBoxesForIBSplit(aStyleSet, aChangeList,
-                                              aHintForThisFrame);
-    }
-    return;
-  }
-
-  AutoTArray<OwnedAnonBox,4> frames;
-  AppendDirectlyOwnedAnonBoxes(frames);
-  for (OwnedAnonBox& box : frames) {
-    if (box.mUpdateStyleFn) {
-      box.mUpdateStyleFn(box.mOwningFrame, box.mAnonBoxFrame,
-                         aStyleSet, aChangeList, aHintForThisFrame);
-    } else {
-      box.mOwningFrame->
-        UpdateStyleOfChildAnonBox(box.mAnonBoxFrame,
-                                  aStyleSet, aChangeList, aHintForThisFrame);
-    }
-  }
-}
-
-/* virtual */ void
-nsIFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
   MOZ_ASSERT(!(GetStateBits() & NS_FRAME_OWNS_ANON_BOXES));
   MOZ_ASSERT(false, "Why did this get called?");
 }
 
-void
-nsIFrame::DoAppendOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
-{
-  size_t i = aResult.Length();
-  AppendDirectlyOwnedAnonBoxes(aResult);
-
-  // After appending the directly owned anonymous boxes of this frame to
-  // aResult above, we need to check each of them to see if they own
-  // any anonymous boxes themselves.  Note that we keep progressing
-  // through aResult, looking for additional entries in aResult from these
-  // subsequent AppendDirectlyOwnedAnonBoxes calls.  (Thus we can't
-  // use a ranged for loop here.)
-
-  while (i < aResult.Length()) {
-    nsIFrame* f = aResult[i].mAnonBoxFrame;
-    if (f->GetStateBits() & NS_FRAME_OWNS_ANON_BOXES) {
-      f->AppendDirectlyOwnedAnonBoxes(aResult);
-    }
-    ++i;
-  }
-}
-
 nsIFrame::CaretPosition::CaretPosition()
   : mContentOffset(0)
 {

layout/generic/nsFrame.h

@@ -701,6 +701,13 @@ protected:
   // Fire DOM event. If no aContent argument use frame's mContent.
   void FireDOMEvent(const nsAString& aDOMEventName, nsIContent *aContent = nullptr);
 
+  // A helper for implementing UpdateStyleOfOwnedAnonBoxes for the specific case
+  // of the owned anon box being a child of this frame.
+  void UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
+                                 mozilla::ServoStyleSet& aStyleSet,
+                                 nsStyleChangeList& aChangeList,
+                                 nsChangeHint aHintForThisFrame);
+
 private:
   void BoxReflow(nsBoxLayoutState& aState,
                  nsPresContext*    aPresContext,

layout/generic/nsGfxScrollFrame.h

@@ -1042,9 +1042,12 @@ public:
     return mHelper.IsRootScrollFrameOfDocument();
   }
 
-  // Return the scrolled frame.
+  // Update the style on our scrolled frame.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override {
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-    aResult.AppendElement(OwnedAnonBox(this, mHelper.GetScrolledFrame()));
+                                             nsStyleChangeList& aChangeList,
+                                             nsChangeHint aHintForThisFrame) override {
+    UpdateStyleOfChildAnonBox(mHelper.GetScrolledFrame(), aStyleSet,
+                              aChangeList, aHintForThisFrame);
   }
 
 #ifdef DEBUG_FRAME_DUMP
@@ -1484,9 +1487,11 @@ public:
     return mHelper.IsRootScrollFrameOfDocument();
   }
 
-  // Return the scrolled frame.
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override {
+                                             nsStyleChangeList& aChangeList,
-    aResult.AppendElement(OwnedAnonBox(this, mHelper.GetScrolledFrame()));
+                                             nsChangeHint aHintForThisFrame) override {
+    UpdateStyleOfChildAnonBox(mHelper.GetScrolledFrame(), aStyleSet,
+                              aChangeList, aHintForThisFrame);
   }
 
 #ifdef DEBUG_FRAME_DUMP

layout/generic/nsHTMLCanvasFrame.cpp

@@ -414,12 +414,15 @@ nsHTMLCanvasFrame::GetContinuationOffset(nscoord* aWidth) const
 }
 
 void
-nsHTMLCanvasFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsHTMLCanvasFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
+                                                 nsStyleChangeList& aChangeList,
+                                                 nsChangeHint aHintForThisFrame)
 {
   MOZ_ASSERT(mFrames.FirstChild(), "Must have our canvas content anon box");
   MOZ_ASSERT(!mFrames.FirstChild()->GetNextSibling(),
              "Must only have our canvas content anon box");
-  aResult.AppendElement(OwnedAnonBox(this, mFrames.FirstChild()));
+  UpdateStyleOfChildAnonBox(mFrames.FirstChild(),
+                            aStyleSet, aChangeList, aHintForThisFrame);
 }
 
 #ifdef ACCESSIBILITY

layout/generic/nsHTMLCanvasFrame.h

@@ -97,9 +97,12 @@ public:
     return PrincipalChildList().FirstChild()->GetContentInsertionFrame();
   }
 
-  // Return the ::-moz-html-canvas-content anonymous box.
+  /**
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+   * Update the style of our ::-moz-html-canvas-content anonymous box.
-
+   */
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 protected:
   virtual ~nsHTMLCanvasFrame();
 

layout/generic/nsIFrame.h

@@ -3310,22 +3310,6 @@ public:
     }
   }
 
-protected:
-  // This does the actual work of UpdateStyleOfOwnedAnonBoxes.  It calls
-  // AppendDirectlyOwnedAnonBoxes to find all of the anonymous boxes
-  // owned by this frame, and then updates styles on each of them.
-  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-                                     nsStyleChangeList& aChangeList,
-                                     nsChangeHint aHintForThisFrame);
-
-  // A helper for DoUpdateStyleOfOwnedAnonBoxes for the specific case
-  // of the owned anon box being a child of this frame.
-  void UpdateStyleOfChildAnonBox(nsIFrame* aChildFrame,
-                                 mozilla::ServoStyleSet& aStyleSet,
-                                 nsStyleChangeList& aChangeList,
-                                 nsChangeHint aHintForThisFrame);
-
-public:
   // A helper both for UpdateStyleOfChildAnonBox, and to update frame-backed
   // pseudo-elements in ServoRestyleManager.
   //
@@ -3334,59 +3318,17 @@ public:
   // and adding to the change list as appropriate.
   //
   // Returns the generated change hint for the frame.
-  nsChangeHint UpdateStyleOfOwnedChildFrame(
+  nsChangeHint UpdateStyleOfOwnedChildFrame(nsIFrame* aChildFrame,
-      nsIFrame* aChildFrame,
+                                            nsStyleContext* aNewStyleContext,
-      nsStyleContext* aNewStyleContext,
+                                            nsStyleChangeList& aChangeList);
-      nsStyleChangeList& aChangeList);
-
-  struct OwnedAnonBox
-  {
-    typedef void (*UpdateStyleFn)(nsIFrame* aOwningFrame, nsIFrame* aAnonBox,
-                                  mozilla::ServoStyleSet&, nsStyleChangeList&,
-                                  nsChangeHint);
-
-    OwnedAnonBox(nsIFrame* aOwningFrame, nsIFrame* aAnonBoxFrame,
-                 UpdateStyleFn aUpdateStyleFn = nullptr)
-      : mOwningFrame(aOwningFrame)
-      , mAnonBoxFrame(aAnonBoxFrame)
-      , mUpdateStyleFn(aUpdateStyleFn)
-    {}
-
-    nsIFrame* mOwningFrame;
-    nsIFrame* mAnonBoxFrame;
-    UpdateStyleFn mUpdateStyleFn;
-  };
 
   /**
-   * Appends information about all of the anonymous boxes owned by this frame,
+   * Hook subclasses can override to actually implement updating of style of
-   * including other anonymous boxes owned by those which this frame owns
+   * owned anon boxes.
-   * directly.
    */
-  void AppendOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) {
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
-    if (GetStateBits() & NS_FRAME_OWNS_ANON_BOXES) {
+                                             nsStyleChangeList& aChangeList,
-      if (IsInlineFrame()) {
+                                             nsChangeHint aHintForThisFrame);
-        // See comment in nsIFrame::DoUpdateStyleOfOwnedAnonBoxes for why
-        // we skip nsInlineFrames.
-        return;
-      }
-      DoAppendOwnedAnonBoxes(aResult);
-    }
-  }
-
-protected:
-  // This does the actual work of AppendOwnedAnonBoxes.
-  void DoAppendOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult);
-
-public:
-  /**
-   * Hook subclasses can override to return their owned anonymous boxes.
-   *
-   * This function only appends anonymous boxes that are directly owned by
-   * this frame, i.e. direct children or (for certain frames) a wrapper
-   * parent, unlike AppendOwnedAnonBoxes, which will append all anonymous
-   * boxes transitively owned by this frame.
-   */
-  virtual void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult);
 
   /**
    * Determines whether a frame is visible for painting;

layout/generic/nsInlineFrame.cpp

@@ -1014,10 +1014,9 @@ nsInlineFrame::AccessibleType()
 #endif
 
 void
-nsInlineFrame::UpdateStyleOfOwnedAnonBoxesForIBSplit(
+nsInlineFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
-    ServoStyleSet& aStyleSet,
+                                             nsStyleChangeList& aChangeList,
-    nsStyleChangeList& aChangeList,
+                                             nsChangeHint aHintForThisFrame)
-    nsChangeHint aHintForThisFrame)
 {
   MOZ_ASSERT(GetStateBits() & NS_FRAME_OWNS_ANON_BOXES,
              "Why did we get called?");

layout/generic/nsInlineFrame.h

@@ -114,12 +114,12 @@ public:
              : (!GetNextInFlow());
   }
 
-  // Restyles the block wrappers around our non-inline-outside kids.
+  // Update the style on the block wrappers around our non-inline-outside kids.
   // This will only be called when such wrappers in fact exist.
-  void UpdateStyleOfOwnedAnonBoxesForIBSplit(
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(
-      mozilla::ServoStyleSet& aStyleSet,
+    mozilla::ServoStyleSet& aStyleSet,
-      nsStyleChangeList& aChangeList,
+    nsStyleChangeList& aChangeList,
-      nsChangeHint aHintForThisFrame);
+    nsChangeHint aHintForThisFrame) override;
 
 protected:
   // Additional reflow state used during our reflow methods

layout/svg/SVGTextFrame.cpp

@@ -5582,8 +5582,11 @@ SVGTextFrame::TransformFrameRectFromTextChild(const nsRect& aRect,
 }
 
 void
-SVGTextFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+SVGTextFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
+                                            nsStyleChangeList& aChangeList,
+                                            nsChangeHint aHintForThisFrame)
 {
   MOZ_ASSERT(PrincipalChildList().FirstChild(), "Must have our anon box");
-  aResult.AppendElement(OwnedAnonBox(this, PrincipalChildList().FirstChild()));
+  UpdateStyleOfChildAnonBox(PrincipalChildList().FirstChild(),
+                            aStyleSet, aChangeList, aHintForThisFrame);
 }

layout/svg/SVGTextFrame.h

@@ -353,8 +353,12 @@ public:
   gfxRect TransformFrameRectFromTextChild(const nsRect& aRect,
                                           nsIFrame* aChildFrame);
 
-  // Return our ::-moz-svg-text anonymous box.
+  /**
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+   * Update the style of our ::-moz-svg-text anonymous box.
+   */
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 
 private:
   /**

layout/svg/nsSVGForeignObjectFrame.cpp

@@ -572,8 +572,12 @@ nsSVGForeignObjectFrame::GetInvalidRegion()
 }
 
 void
-nsSVGForeignObjectFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsSVGForeignObjectFrame::DoUpdateStyleOfOwnedAnonBoxes(
+  ServoStyleSet& aStyleSet,
+  nsStyleChangeList& aChangeList,
+  nsChangeHint aHintForThisFrame)
 {
   MOZ_ASSERT(PrincipalChildList().FirstChild(), "Must have our anon box");
-  aResult.AppendElement(OwnedAnonBox(this, PrincipalChildList().FirstChild()));
+  UpdateStyleOfChildAnonBox(PrincipalChildList().FirstChild(),
+                            aStyleSet, aChangeList, aHintForThisFrame);
 }

layout/svg/nsSVGForeignObjectFrame.h

@@ -82,8 +82,12 @@ public:
 
   nsRect GetInvalidRegion();
 
-  // Return our ::-moz-svg-foreign-content anonymous box.
+  /**
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+   * Update the style of our ::-moz-svg-foreign-content anonymous box.
+   */
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 
 protected:
   // implementation helpers:

layout/svg/nsSVGMarkerFrame.cpp

@@ -201,9 +201,13 @@ nsSVGMarkerFrame::SetParentCoordCtxProvider(SVGSVGElement *aContext)
 }
 
 void
-nsSVGMarkerFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsSVGMarkerFrame::DoUpdateStyleOfOwnedAnonBoxes(
+  mozilla::ServoStyleSet& aStyleSet,
+  nsStyleChangeList& aChangeList,
+  nsChangeHint aHintForThisFrame)
 {
-  aResult.AppendElement(OwnedAnonBox(this, GetAnonymousChildFrame(this)));
+  UpdateStyleOfChildAnonBox(GetAnonymousChildFrame(this), aStyleSet,
+                            aChangeList, aHintForThisFrame);
 }
 
 //----------------------------------------------------------------------

layout/svg/nsSVGMarkerFrame.h

@@ -90,8 +90,10 @@ public:
                                   const nsSVGMark& aMark,
                                   float aStrokeWidth);
 
-  // Return our anonymous box child.
+  // Update the style on our anonymous box child.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 
 private:
   // stuff needed for callback

layout/svg/nsSVGOuterSVGFrame.cpp

@@ -971,11 +971,14 @@ nsSVGOuterSVGFrame::VerticalScrollbarNotNeeded() const
 }
 
 void
-nsSVGOuterSVGFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsSVGOuterSVGFrame::DoUpdateStyleOfOwnedAnonBoxes(
+  mozilla::ServoStyleSet& aStyleSet,
+  nsStyleChangeList& aChangeList,
+  nsChangeHint aHintForThisFrame)
 {
   nsIFrame* anonKid = PrincipalChildList().FirstChild();
   MOZ_ASSERT(anonKid->IsSVGOuterSVGAnonChildFrame());
-  aResult.AppendElement(OwnedAnonBox(this, anonKid));
+  UpdateStyleOfChildAnonBox(anonKid, aStyleSet, aChangeList, aHintForThisFrame);
 }
 
 //----------------------------------------------------------------------

layout/svg/nsSVGOuterSVGFrame.h

@@ -99,8 +99,10 @@ public:
   bool IsSVGTransformed(Matrix* aOwnTransform,
                         Matrix* aFromParentTransform) const override;
 
-  // Return our anonymous box child.
+  // Update the style on our anonymous box child.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+  void DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoStyleSet& aStyleSet,
+                                     nsStyleChangeList& aChangeList,
+                                     nsChangeHint aHintForThisFrame) override;
 
   // nsISVGSVGFrame interface:
   virtual void NotifyViewportOrTransformChanged(uint32_t aFlags) override;

layout/tables/nsTableCellFrame.cpp

@@ -1065,12 +1065,14 @@ nsTableCellFrame::GetBorderWidth(WritingMode aWM) const
 }
 
 void
-nsTableCellFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsTableCellFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
+                                                nsStyleChangeList& aChangeList,
+                                                nsChangeHint aHintForThisFrame)
 {
   nsIFrame* kid = mFrames.FirstChild();
   MOZ_ASSERT(kid && !kid->GetNextSibling(),
              "Table cells should have just one child");
-  aResult.AppendElement(OwnedAnonBox(this, kid));
+  UpdateStyleOfChildAnonBox(kid, aStyleSet, aChangeList, aHintForThisFrame);
 }
 
 #ifdef DEBUG_FRAME_DUMP

layout/tables/nsTableCellFrame.h

@@ -158,8 +158,11 @@ public:
 
   // there is no set row index because row index depends on the cell's parent row only
 
-  // Return our cell content frame.
+  // Update the style on the block wrappers around our kids.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(
+    mozilla::ServoStyleSet& aStyleSet,
+    nsStyleChangeList& aChangeList,
+    nsChangeHint aHintForThisFrame) override;
 
   /*---------------- nsITableCellLayout methods ------------------------*/
 

layout/tables/nsTableFrame.cpp

@@ -8001,31 +8001,19 @@ nsTableFrame::InvalidateTableFrame(nsIFrame* aFrame,
 }
 
 void
-nsTableFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+nsTableFrame::DoUpdateStyleOfOwnedAnonBoxes(ServoStyleSet& aStyleSet,
+                                            nsStyleChangeList& aChangeList,
+                                            nsChangeHint aHintForThisFrame)
 {
   nsIFrame* wrapper = GetParent();
-  MOZ_ASSERT(wrapper->StyleContext()->GetPseudo() ==
-               nsCSSAnonBoxes::tableWrapper,
-             "What happened to our parent?");
-  aResult.AppendElement(
-    OwnedAnonBox(this, wrapper, &UpdateStyleOfOwnedAnonBoxesForTableWrapper));
-}
 
-/* static */ void
+  MOZ_ASSERT(wrapper->StyleContext()->GetPseudo() ==
-nsTableFrame::UpdateStyleOfOwnedAnonBoxesForTableWrapper(
-    nsIFrame* aOwningFrame,
-    nsIFrame* aWrapperFrame,
-    ServoStyleSet& aStyleSet,
-    nsStyleChangeList& aChangeList,
-    nsChangeHint aHintForThisFrame)
-{
-  MOZ_ASSERT(aWrapperFrame->StyleContext()->GetPseudo() ==
                nsCSSAnonBoxes::tableWrapper,
              "What happened to our parent?");
 
   RefPtr<nsStyleContext> newContext =
     aStyleSet.ResolveInheritingAnonymousBoxStyle(nsCSSAnonBoxes::tableWrapper,
-                                                 aOwningFrame->StyleContext());
+                                                 StyleContext());
 
   // Figure out whether we have an actual change.  It's important that we do
   // this, even though all the wrapper's changes are due to properties it
@@ -8033,19 +8021,18 @@ nsTableFrame::UpdateStyleOfOwnedAnonBoxesForTableWrapper(
   // style structs and hence changes to them aren't reflected in
   // aHintForThisFrame at all.
   uint32_t equalStructs, samePointerStructs; // Not used, actually.
-  nsChangeHint wrapperHint = aWrapperFrame->StyleContext()->CalcStyleDifference(
+  nsChangeHint wrapperHint = wrapper->StyleContext()->CalcStyleDifference(
     newContext,
     &equalStructs,
     &samePointerStructs);
   if (wrapperHint) {
-    aChangeList.AppendChange(aWrapperFrame, aWrapperFrame->GetContent(),
+    aChangeList.AppendChange(wrapper, wrapper->GetContent(), wrapperHint);
-                             wrapperHint);
   }
 
-  for (nsIFrame* cur = aWrapperFrame; cur; cur = cur->GetNextContinuation()) {
+  for (nsIFrame* cur = wrapper; cur; cur = cur->GetNextContinuation()) {
     cur->SetStyleContext(newContext);
   }
 
-  MOZ_ASSERT(!(aWrapperFrame->GetStateBits() & NS_FRAME_OWNS_ANON_BOXES),
+  MOZ_ASSERT(!(wrapper->GetStateBits() & NS_FRAME_OWNS_ANON_BOXES),
              "Wrapper frame doesn't have any anon boxes of its own!");
 }

layout/tables/nsTableFrame.h

@@ -593,16 +593,12 @@ public:
 
   virtual bool ComputeCustomOverflow(nsOverflowAreas& aOverflowAreas) override;
 
-  // Return our wrapper frame.
+  // Update the style of our table wrapper frame.
-  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+  virtual void DoUpdateStyleOfOwnedAnonBoxes(
-
+    mozilla::ServoStyleSet& aStyleSet,
+    nsStyleChangeList& aChangeList,
+    nsChangeHint aHintForThisFrame) override;
 protected:
-  static void UpdateStyleOfOwnedAnonBoxesForTableWrapper(
-      nsIFrame* aOwningFrame,
-      nsIFrame* aWrapperFrame,
-      mozilla::ServoStyleSet& aStyleSet,
-      nsStyleChangeList& aChangeList,
-      nsChangeHint aHintForThisFrame);
 
   /** protected constructor.
     * @see NewFrame