Remove incorrect DCHECK for InStyleRecalc()
Also mark ancestors child-dirty if this SetStyle happens outside style
recalc to make sure we reach the element during the next recalc.
Bug: 1298917
Change-Id: Iaf1341bd2aa957ba3454144725157a3c6b211439
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3484283
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#974184}
diff --git a/css/css-lists/crashtests/chrome-legacy-propagation-remove-body-crash.html b/css/css-lists/crashtests/chrome-legacy-propagation-remove-body-crash.html
new file mode 100644
index 0000000..94b5728
--- /dev/null
+++ b/css/css-lists/crashtests/chrome-legacy-propagation-remove-body-crash.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<title>BODY list-item crash inserting extra BODY</title>
+<link rel="help" href="https://crbug.com/1298917">
+<style>
+ body {
+ display: list-item;
+ }
+ div {
+ /* Multicol and table display to trigger legacy layout */
+ display: table-row-group;
+ column-count: 1;
+ }
+</style>
+<body>
+ <p>Pass if no crash.</p>
+ <div></div>
+</body>
+<script>
+ document.documentElement.offsetTop;
+ document.documentElement.insertBefore(document.createElement("body"), document.body);
+</script>
