I tested manually that after:
(a) removing the |ruleData.mValueOffsets[aSID] = 0;| in
nsRuleNode::WalkRuleTree
(b) removing the NS_ABORT_IF_FALSE(aRuleData->mValueOffsets[aSID] == 0,
...) from nsRuleNode::CheckSpecifiedProperties and
UnsetPropertiesWithoutFlags
that we crash dereferencing the poison address in a SetCoord call inside
nsRuleNode::ComputeTextResetData