style: relax assertions in dom::element when setting selector flags.

Fixes #16409

components/script/dom/element.rs

@@ -780,7 +780,7 @@ impl LayoutElementHelpers for LayoutJS<Element> {
     #[inline]
     #[allow(unsafe_code)]
     fn insert_selector_flags(&self, flags: ElementSelectorFlags) {
-        debug_assert!(thread_state::get() == thread_state::LAYOUT);
+        debug_assert!(thread_state::get().is_layout());
         unsafe {
             let f = &(*self.unsafe_get()).selector_flags;
             f.set(f.get() | flags);

components/style/matching.rs

@@ -930,8 +930,17 @@ pub trait MatchMethods : TElement {
         let self_flags = flags.for_self();
         if !self_flags.is_empty() {
             if element == self {
+                // If this is the element we're styling, we have exclusive
+                // access to the element, and thus it's fine inserting them,
+                // even from the worker.
                 unsafe { element.set_selector_flags(self_flags); }
             } else {
+                // Otherwise, this element is an ancestor of the current element
+                // we're styling, and thus multiple children could write to it
+                // if we did from here.
+                //
+                // Instead, we can read them, and post them if necessary as a
+                // sequential task in order for them to be processed later.
                 if !element.has_selector_flags(self_flags) {
                     let task =
                         SequentialTask::set_selector_flags(element.clone(),