commit 79c72166bf05
Author: Emilio Cobos Álvarez <emilio@crisal.io>
Date:   Wed Sep 27 18:09:31 2017 +0200

    Bug 1403592 - Never flush the user font set when getting font metrics from style resolution. r=Manishearth, a=sledru
    
    In this case, the caller doesn't go through all the PreTraverseSync stuff (we
    don't really want it to do so), via GetComputedStyleNoFlush.
    
    It makes sense to not flush the user font set that case, we'll schedule a
    restyle properly if / when needed.
    
    Since the set should be flushed otherwise, let's just not flush it from the
    styling code.
    
    MozReview-Commit-ID: LLHfxemJ8QQ
    
    --HG--
    extra : source : 0a0cc4bb885a2487b643e94fc244620751616d03
---
 layout/style/ServoBindings.cpp |  7 ++++---
 layout/style/nsRuleNode.cpp    | 13 ++++++++-----
 layout/style/nsRuleNode.h      |  8 +++++++-
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git layout/style/ServoBindings.cpp layout/style/ServoBindings.cpp
index ac2a6cc2ec01..d248e6ad1401 100644
--- layout/style/ServoBindings.cpp
+++ layout/style/ServoBindings.cpp
@@ -2482,9 +2482,10 @@ Gecko_GetFontMetrics(RawGeckoPresContextBorrowed aPresContext,
 
   nsPresContext* presContext = const_cast<nsPresContext*>(aPresContext);
   presContext->SetUsesExChUnits(true);
-  RefPtr<nsFontMetrics> fm = nsRuleNode::GetMetricsFor(presContext, aIsVertical,
-                                                       aFont, aFontSize,
-                                                       aUseUserFontSet);
+  RefPtr<nsFontMetrics> fm = nsRuleNode::GetMetricsFor(
+      presContext, aIsVertical, aFont, aFontSize, aUseUserFontSet,
+      nsRuleNode::FlushUserFontSet::No);
+
   ret.mXSize = fm->XHeight();
   gfxFloat zeroWidth = fm->GetThebesFontGroup()->GetFirstValidFont()->
                            GetMetrics(fm->Orientation()).zeroOrAveCharWidth;
diff --git layout/style/nsRuleNode.cpp layout/style/nsRuleNode.cpp
index ccccce98009e..fbb5e3824e2f 100644
--- layout/style/nsRuleNode.cpp
+++ layout/style/nsRuleNode.cpp
@@ -377,7 +377,8 @@ nsRuleNode::GetMetricsFor(nsPresContext* aPresContext,
                           bool aIsVertical,
                           const nsStyleFont* aStyleFont,
                           nscoord aFontSize,
-                          bool aUseUserFontSet)
+                          bool aUseUserFontSet,
+                          FlushUserFontSet aFlushUserFontSet)
 {
   nsFont font = aStyleFont->mFont;
   font.size = aFontSize;
@@ -387,8 +388,9 @@ nsRuleNode::GetMetricsFor(nsPresContext* aPresContext,
   params.language = aStyleFont->mLanguage;
   params.explicitLanguage = aStyleFont->mExplicitLanguage;
   params.orientation = orientation;
-  params.userFontSet =
-    aUseUserFontSet ? aPresContext->GetUserFontSet() : nullptr;
+  params.userFontSet = aUseUserFontSet
+    ? aPresContext->GetUserFontSet(aFlushUserFontSet == FlushUserFontSet::Yes)
+    : nullptr;
   params.textPerf = aPresContext->GetTextPerfMetrics();
   return aPresContext->DeviceContext()->GetMetricsFor(font, params);
 }
@@ -408,8 +410,9 @@ nsRuleNode::GetMetricsFor(nsPresContext* aPresContext,
       isVertical = true;
     }
   }
-  return nsRuleNode::GetMetricsFor(aPresContext, isVertical, aStyleFont,
-                                   aFontSize, aUseUserFontSet);
+  return nsRuleNode::GetMetricsFor(
+      aPresContext, isVertical, aStyleFont, aFontSize, aUseUserFontSet,
+      FlushUserFontSet::Yes);
 }
 
 /* static */
diff --git layout/style/nsRuleNode.h layout/style/nsRuleNode.h
index 423545ffd198..719eb0c51eb0 100644
--- layout/style/nsRuleNode.h
+++ layout/style/nsRuleNode.h
@@ -807,11 +807,17 @@ public:
                                  bool aConvertListItem = false);
   static void EnsureInlineDisplay(mozilla::StyleDisplay& display);
 
+  enum class FlushUserFontSet {
+    Yes,
+    No,
+  };
+
   static already_AddRefed<nsFontMetrics> GetMetricsFor(nsPresContext* aPresContext,
                                                        bool aIsVertical,
                                                        const nsStyleFont* aStyleFont,
                                                        nscoord aFontSize,
-                                                       bool aUseUserFontSet);
+                                                       bool aUseUserFontSet,
+                                                       FlushUserFontSet aFlushUserFontSet);
 
   static already_AddRefed<nsFontMetrics> GetMetricsFor(nsPresContext* aPresContext,
                                                        nsStyleContext* aStyleContext,
commit f01f1d6ac516
Author: Emilio Cobos Álvarez <emilio@crisal.io>
Date:   Wed Sep 27 18:16:25 2017 +0200

    Bug 1403592 - Crashtest. r=Manishearth, a=sledru
    
    I've made it crash at least once, though it's intermittent-y. I guess it's
    better than no crashtest.
    
    MozReview-Commit-ID: 5m2VCrEs8lM
    
    --HG--
    extra : source : c050d8574203c0344a9570fef73df51a1a489091
    extra : amend_source : 45265a4fbe7d484fc784c3389f912d45eebf15de
---
 layout/style/crashtests/1403592.html    | 19 +++++++++++++++++++
 layout/style/crashtests/crashtests.list |  1 +
 2 files changed, 20 insertions(+)

diff --git layout/style/crashtests/1403592.html layout/style/crashtests/1403592.html
new file mode 100644
index 000000000000..fdd810b88603
--- /dev/null
+++ layout/style/crashtests/1403592.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<style></style>
+<script>
+function boom() {
+  a = document.createElement("x")
+  a.style.overflow = "o"
+  document.styleSheets[0].insertRule("i {}", 0)
+  requestIdleCallback(function() {
+    document.documentElement.className = "";
+  });
+}
+requestIdleCallback(boom)
+</script>
+</head>
+<i id=id0 style="margin: 15ch">
+<svg><animate xlink:href=#id0 attributeName=width to></svg>
+</html>
diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
index 565abf6c1f83..e811e54554b3 100644
--- layout/style/crashtests/crashtests.list
+++ layout/style/crashtests/crashtests.list
@@ -204,3 +204,4 @@ load 1391577.html
 load 1398581.html
 load 1402218-1.html
 load 1402366.html
+load 1403592.html