Don't apply user stylesheets to descendants of native anonymous subtrees. Bug

285140, r+sr=dbaron

layout/style/nsStyleSet.cpp

@@ -465,11 +465,7 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   nsRuleNode* lastPresHintRN = mRuleWalker->GetCurrentNode();
 
   mRuleWalker->SetLevel(eUserSheet, PR_FALSE);
-  PRBool skipUserStyles = aData->mContent &&
-    aData->mContent == aData->mContent->GetBindingParent();
-  NS_ASSERTION(!skipUserStyles || aData->mContent->IsNativeAnonymous() ||
-               aData->mContent->IsNodeOfType(nsINode::eXUL),
-               "Content with bogus binding parent");
+  PRBool skipUserStyles = IsNativeAnonymous(aData->mContent);
   if (!skipUserStyles && mRuleProcessors[eUserSheet]) // NOTE: different
     (*aCollectorFunc)(mRuleProcessors[eUserSheet], aData);
   nsRuleNode* lastUserRN = mRuleWalker->GetCurrentNode();
@@ -533,11 +529,7 @@ nsStyleSet::WalkRuleProcessors(nsIStyleRuleProcessor::EnumFunc aFunc,
   if (mRuleProcessors[ePresHintSheet])
     (*aFunc)(mRuleProcessors[ePresHintSheet], aData);
 
-  PRBool skipUserStyles = aData->mContent &&
-    aData->mContent == aData->mContent->GetBindingParent();
-  NS_ASSERTION(!skipUserStyles || aData->mContent->IsNativeAnonymous() ||
-               aData->mContent->IsNodeOfType(nsINode::eXUL),
-               "Content with bogus binding parent");
+  PRBool skipUserStyles = IsNativeAnonymous(aData->mContent);
   if (!skipUserStyles && mRuleProcessors[eUserSheet]) // NOTE: different
     (*aFunc)(mRuleProcessors[eUserSheet], aData);
 
@@ -943,3 +935,20 @@ nsStyleSet::HasAttributeDependentStyle(nsPresContext* aPresContext,
 
   return result;
 }
+
+PRBool
+nsStyleSet::IsNativeAnonymous(nsIContent* aContent)
+{
+  while (aContent) {
+    nsIContent* bindingParent = aContent->GetBindingParent();
+    if (bindingParent == aContent) {
+      NS_ASSERTION(bindingParent->IsNativeAnonymous() ||
+                   bindingParent->IsNodeOfType(nsINode::eXUL),
+                   "Bogus binding parent?");
+      return PR_TRUE;
+    }
+    aContent = bindingParent;
+  }
+
+  return PR_FALSE;
+}

layout/style/nsStyleSet.h

@@ -235,6 +235,10 @@ class nsStyleSet
 
   nsPresContext* PresContext() { return mRuleTree->GetPresContext(); }
 
+  // Return true if aContent or one of its ancestors in the
+  // bindingParent chain is native anonymous.
+  static PRBool IsNativeAnonymous(nsIContent* aContent);
+
   static nsIURI  *gQuirkURI;
 
   // The sheets in each array in mSheets are stored with the most significant