Bug 1380106 - Drop style data in DestroyContent. r=heycam,r=bz
authorBobby Holley <bobbyholley@gmail.com>
Tue, 11 Jul 2017 12:57:38 -0700
changeset 607784 795947f535e823454f4dcf400b8c004dfd9d09a2
parent 607783 72ce56d64a62fe06e4c49ab4511c61e6e67cde65
child 607785 dbb7c080c1df9eebc5cb7417f2affba0abb0af37
push id68110
push userbmo:nchen@mozilla.com
push dateWed, 12 Jul 2017 21:26:51 +0000
reviewersheycam, bz
bugs1380106
milestone56.0a1
Bug 1380106 - Drop style data in DestroyContent. r=heycam,r=bz MozReview-Commit-ID: 9ydkvlDA9oS
dom/base/FragmentOrElement.cpp
--- a/dom/base/FragmentOrElement.cpp
+++ b/dom/base/FragmentOrElement.cpp
@@ -1257,16 +1257,23 @@ FragmentOrElement::SetTextContentInterna
                                           ErrorResult& aError)
 {
   aError = nsContentUtils::SetNodeTextContent(this, aTextContent, false);
 }
 
 void
 FragmentOrElement::DestroyContent()
 {
+  // Drop any servo data. We do this before the RemovedFromDocument call below
+  // so that it doesn't need to try to keep the style state sane when shuffling
+  // around the flattened tree.
+  if (IsElement() && AsElement()->HasServoData()) {
+    AsElement()->ClearServoData();
+  }
+
   nsIDocument *document = OwnerDoc();
   document->BindingManager()->RemovedFromDocument(this, document,
                                                   nsBindingManager::eRunDtor);
   document->ClearBoxObjectFor(this);
 
   uint32_t i, count = mAttrsAndChildren.ChildCount();
   for (i = 0; i < count; ++i) {
     // The child can remove itself from the parent in BindToTree.