Loading the testcase triggers: frame: Bullet(scrollbox)(1) (0x3dba97d0) style: 0x3dac2068 :-moz-list-bullet {} Wrong parent style context: style: 0x3dba8d40 :-moz-scrolled-content {} should be using: style: 0x3dbb57bc {}

Comment on attachment 271631 [details] [diff] [review] Proposed fix This patch makes sense, but I'm wondering if CorrectStyleParentFrame is doing the right thing here...

I think so... it's parenting pseudo-element frames to the nearest non-anonymous-box ancestor. I think that's what we want to be doing. In particular, for a scrollable list-item it's parenting to the scrollframe (which is the frame that actually has the styles for the node) instead of what we used to be doing, which was parenting to the anonymous blockframe inside the scrollframe.

Comment on attachment 271631 [details] [diff] [review] Proposed fix Ah, right, :-moz-list-bullet is a pseudoelement, not an anonbox. r+sr=dbaron

Comment on attachment 271631 [details] [diff] [review] Proposed fix Give bullets on scrollable list items the right style context parent. Shouldn't have any effect on rendering, really, but will prevent our internal style context tree integrity checks from failing.

Comment on attachment 271631 [details] [diff] [review] Proposed fix a19=dbaron

Fixed.

Crashtest checked in. "Wrong parent style context" is now an assertion, so once assertions turn Tinderbox orange, this will be properly regression-tested.