Bug 1578671 - Wrap DestroyElementMaps call in a script blocker; r=smaug
authorEdgar Chen <echen@mozilla.com>
Sun, 22 Sep 2019 22:41:50 +0000
changeset 494472 340972ee99601a7932ed65ae040c1c8e3b984798
parent 494471 14789caee8bdde35e40a3bafa3ec7c786b8bc9f1
child 494473 88f20e24fa39cd939b5bf6003ec43014f722f8b7
push id96024
push userechen@mozilla.com
push dateSun, 22 Sep 2019 22:43:27 +0000
treeherderautoland@340972ee9960 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug
bugs1578671
milestone71.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1578671 - Wrap DestroyElementMaps call in a script blocker; r=smaug Differential Revision: https://phabricator.services.mozilla.com/D46588
dom/base/Document.cpp
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -1850,22 +1850,22 @@ Document::~Document() {
 
   mParentDocument = nullptr;
 
   // Kill the subdocument map, doing this will release its strong
   // references, if any.
   delete mSubDocuments;
   mSubDocuments = nullptr;
 
+  nsAutoScriptBlocker scriptBlocker;
+
   // Destroy link map now so we don't waste time removing
   // links one by one
   DestroyElementMaps();
 
-  nsAutoScriptBlocker scriptBlocker;
-
   // Invalidate cached array of child nodes
   InvalidateChildNodes();
 
   // We should not have child nodes when destructor is called,
   // since child nodes keep their owner document alive.
   MOZ_ASSERT(!HasChildren());
 
   mCachedRootElement = nullptr;
@@ -2374,25 +2374,25 @@ void Document::Reset(nsIChannel* aChanne
 
 void Document::DisconnectNodeTree() {
   // Delete references to sub-documents and kill the subdocument map,
   // if any. This is not strictly needed, but makes the node tree
   // teardown a bit faster.
   delete mSubDocuments;
   mSubDocuments = nullptr;
 
-  // Destroy link map now so we don't waste time removing
-  // links one by one
-  DestroyElementMaps();
-
   bool oldVal = mInUnlinkOrDeletion;
   mInUnlinkOrDeletion = true;
   {  // Scope for update
     MOZ_AUTO_DOC_UPDATE(this, true);
 
+    // Destroy link map now so we don't waste time removing
+    // links one by one
+    DestroyElementMaps();
+
     // Invalidate cached array of child nodes
     InvalidateChildNodes();
 
     while (HasChildren()) {
       nsCOMPtr<nsIContent> content = GetLastChild();
       nsIContent* previousSibling = content->GetPreviousSibling();
       DisconnectChild(content);
       if (content == mCachedRootElement) {
@@ -6360,17 +6360,19 @@ nsresult Document::InsertChildBefore(nsI
     NS_WARNING("Inserting root element when we already have one");
     return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
   }
 
   return nsINode::InsertChildBefore(aKid, aBeforeThis, aNotify);
 }
 
 void Document::RemoveChildNode(nsIContent* aKid, bool aNotify) {
+  Maybe<mozAutoDocUpdate> updateBatch;
   if (aKid->IsElement()) {
+    updateBatch.emplace(this, aNotify);
     // Destroy the link map up front before we mess with the child list.
     DestroyElementMaps();
   }
 
   // Preemptively clear mCachedRootElement, since we may be about to remove it
   // from our child list, and we don't want to return this maybe-obsolete value
   // from any GetRootElement() calls that happen inside of RemoveChildNode().
   // (NOTE: for this to be useful, RemoveChildNode() must NOT trigger any