Bug 1380106 - Drop style data in DestroyContent. r=heycam,r=bz
authorBobby Holley <bobbyholley@gmail.com>
Tue, 11 Jul 2017 12:57:38 -0700
changeset 368673 795947f535e823454f4dcf400b8c004dfd9d09a2
parent 368672 72ce56d64a62fe06e4c49ab4511c61e6e67cde65
child 368674 dbb7c080c1df9eebc5cb7417f2affba0abb0af37
push id32167
push usercbook@mozilla.com
push dateThu, 13 Jul 2017 14:35:41 +0000
treeherdermozilla-central@d4e6f45db733 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersheycam, bz
bugs1380106
milestone56.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1380106 - Drop style data in DestroyContent. r=heycam,r=bz MozReview-Commit-ID: 9ydkvlDA9oS
dom/base/FragmentOrElement.cpp
--- a/dom/base/FragmentOrElement.cpp
+++ b/dom/base/FragmentOrElement.cpp
@@ -1257,16 +1257,23 @@ FragmentOrElement::SetTextContentInterna
                                           ErrorResult& aError)
 {
   aError = nsContentUtils::SetNodeTextContent(this, aTextContent, false);
 }
 
 void
 FragmentOrElement::DestroyContent()
 {
+  // Drop any servo data. We do this before the RemovedFromDocument call below
+  // so that it doesn't need to try to keep the style state sane when shuffling
+  // around the flattened tree.
+  if (IsElement() && AsElement()->HasServoData()) {
+    AsElement()->ClearServoData();
+  }
+
   nsIDocument *document = OwnerDoc();
   document->BindingManager()->RemovedFromDocument(this, document,
                                                   nsBindingManager::eRunDtor);
   document->ClearBoxObjectFor(this);
 
   uint32_t i, count = mAttrsAndChildren.ChildCount();
   for (i = 0; i < count; ++i) {
     // The child can remove itself from the parent in BindToTree.