From 9a264c8173501b2cbcc77895a1b66702fb69e5c6 Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Wed, 4 Jan 2017 12:36:11 -0500
Subject: [PATCH] Only pass nodes to layout for restyling that are actually in
 the document.

---
 components/script/dom/document.rs             |  9 +++++--
 components/script/layout_wrapper.rs           |  3 ++-
 tests/wpt/mozilla/meta/MANIFEST.json          | 24 +++++++++++++++++++
 .../mozilla/restyle-out-of-document-ref.html  |  3 +++
 .../mozilla/restyle-out-of-document.html      | 13 ++++++++++
 5 files changed, 49 insertions(+), 3 deletions(-)
 create mode 100644 tests/wpt/mozilla/tests/mozilla/restyle-out-of-document-ref.html
 create mode 100644 tests/wpt/mozilla/tests/mozilla/restyle-out-of-document.html

diff --git a/components/script/dom/document.rs b/components/script/dom/document.rs
index 79acb69096d..84eb19b8d7c 100644
--- a/components/script/dom/document.rs
+++ b/components/script/dom/document.rs
@@ -67,7 +67,7 @@ use dom::keyboardevent::KeyboardEvent;
 use dom::location::Location;
 use dom::messageevent::MessageEvent;
 use dom::mouseevent::MouseEvent;
-use dom::node::{self, CloneChildrenFlag, Node, NodeDamage, window_from_node};
+use dom::node::{self, CloneChildrenFlag, Node, NodeDamage, window_from_node, IS_IN_DOC, LayoutNodeHelpers};
 use dom::nodeiterator::NodeIterator;
 use dom::nodelist::NodeList;
 use dom::pagetransitionevent::PageTransitionEvent;
@@ -1790,7 +1790,12 @@ impl LayoutDocumentHelpers for LayoutJS<Document> {
     #[allow(unrooted_must_root)]
     unsafe fn drain_pending_restyles(&self) -> Vec<(LayoutJS<Element>, PendingRestyle)> {
         let mut elements = (*self.unsafe_get()).pending_restyles.borrow_mut_for_layout();
-        let result = elements.drain().map(|(k, v)| (k.to_layout(), v)).collect();
+        // Elements were in a document when they were adding to this list, but that
+        // may no longer be true when the next layout occurs.
+        let result = elements.drain()
+            .map(|(k, v)| (k.to_layout(), v))
+            .filter(|&(ref k, _)| k.upcast::<Node>().get_flag(IS_IN_DOC))
+            .collect();
         result
     }
 
diff --git a/components/script/layout_wrapper.rs b/components/script/layout_wrapper.rs
index 25150d60dfe..5576648b84d 100644
--- a/components/script/layout_wrapper.rs
+++ b/components/script/layout_wrapper.rs
@@ -37,7 +37,7 @@ use dom::bindings::js::LayoutJS;
 use dom::characterdata::LayoutCharacterDataHelpers;
 use dom::document::{Document, LayoutDocumentHelpers, PendingRestyle};
 use dom::element::{Element, LayoutElementHelpers, RawLayoutElementHelpers};
-use dom::node::{CAN_BE_FRAGMENTED, DIRTY_ON_VIEWPORT_SIZE_CHANGE, HAS_DIRTY_DESCENDANTS};
+use dom::node::{CAN_BE_FRAGMENTED, DIRTY_ON_VIEWPORT_SIZE_CHANGE, HAS_DIRTY_DESCENDANTS, IS_IN_DOC};
 use dom::node::{LayoutNodeHelpers, Node};
 use dom::text::Text;
 use gfx_traits::ByteIndex;
@@ -404,6 +404,7 @@ impl<'le> TElement for ServoLayoutElement<'le> {
     }
 
     unsafe fn set_dirty_descendants(&self) {
+        debug_assert!(self.as_node().node.get_flag(IS_IN_DOC));
         self.as_node().node.set_flag(HAS_DIRTY_DESCENDANTS, true)
     }
 
diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json
index 36abb2d5adb..c7f03027eae 100644
--- a/tests/wpt/mozilla/meta/MANIFEST.json
+++ b/tests/wpt/mozilla/meta/MANIFEST.json
@@ -6438,6 +6438,18 @@
             "url": "/_mozilla/mozilla/iframe/resize_after_load.html"
           }
         ],
+        "mozilla/restyle-out-of-document.html": [
+          {
+            "path": "mozilla/restyle-out-of-document.html",
+            "references": [
+              [
+                "/_mozilla/mozilla/restyle-out-of-document-ref.html",
+                "=="
+              ]
+            ],
+            "url": "/_mozilla/mozilla/restyle-out-of-document.html"
+          }
+        ],
         "mozilla/scrolling_div_background_borders.html": [
           {
             "path": "mozilla/scrolling_div_background_borders.html",
@@ -21720,6 +21732,18 @@
           "url": "/_mozilla/mozilla/iframe/resize_after_load.html"
         }
       ],
+      "mozilla/restyle-out-of-document.html": [
+        {
+          "path": "mozilla/restyle-out-of-document.html",
+          "references": [
+            [
+              "/_mozilla/mozilla/restyle-out-of-document-ref.html",
+              "=="
+            ]
+          ],
+          "url": "/_mozilla/mozilla/restyle-out-of-document.html"
+        }
+      ],
       "mozilla/scrolling_div_background_borders.html": [
         {
           "path": "mozilla/scrolling_div_background_borders.html",
diff --git a/tests/wpt/mozilla/tests/mozilla/restyle-out-of-document-ref.html b/tests/wpt/mozilla/tests/mozilla/restyle-out-of-document-ref.html
new file mode 100644
index 00000000000..12d09f82161
--- /dev/null
+++ b/tests/wpt/mozilla/tests/mozilla/restyle-out-of-document-ref.html
@@ -0,0 +1,3 @@
+<!doctype html>
+<meta charset="utf-8">
+<span>Visible content.</span>
diff --git a/tests/wpt/mozilla/tests/mozilla/restyle-out-of-document.html b/tests/wpt/mozilla/tests/mozilla/restyle-out-of-document.html
new file mode 100644
index 00000000000..cff2590e4eb
--- /dev/null
+++ b/tests/wpt/mozilla/tests/mozilla/restyle-out-of-document.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Verify that dirtying an element and removing it from the document before it's restyled doesn't mess up layout</title>
+<link rel='match' href='restyle-out-of-document-ref.html'>
+<div><strong>Removed content.</strong></div>
+<span>Visible content.</span>
+<script>
+  addEventListener('load', function() {
+    var d = document.querySelector('div');
+    d.firstChild.style.display = "none";
+    d.remove();
+  }, true);
+</script>