Bug 1315889 - stylo: don't try to restyle elements that have been removed from the document. r=emilio
authorCameron McCormack <cam@mcc.id.au>
Tue, 08 Nov 2016 16:24:34 +0800
changeset 352000 25f6a27f309d85438bd3729d392291a038ad248f
parent 351999 fc55188f14b6819fbf34a425d7af2a2c73ded730
child 352001 4c1cb8ecde7fa13a4f4c5d28df5b34cbed6e3319
push id6795
push userjlund@mozilla.com
push dateMon, 23 Jan 2017 14:19:46 +0000
treeherdermozilla-esr52@76101b503191 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersemilio
bugs1315889
milestone52.0a1
Bug 1315889 - stylo: don't try to restyle elements that have been removed from the document. r=emilio MozReview-Commit-ID: EiFS1KAKAj6
layout/base/ServoRestyleManager.cpp
layout/style/crashtests/1315889-1.html
layout/style/crashtests/crashtests.list
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@@ -361,16 +361,25 @@ ServoRestyleManager::ProcessPendingResty
   ServoStyleSet* styleSet = StyleSet();
   nsIDocument* doc = PresContext()->Document();
   Element* root = doc->GetRootElement();
   if (root) {
     for (auto iter = mModifiedElements.Iter(); !iter.Done(); iter.Next()) {
       ServoElementSnapshot* snapshot = iter.UserData();
       Element* element = iter.Key();
 
+      // The element is no longer in the document, so don't bother computing
+      // a final restyle hint for it.
+      //
+      // XXXheycam RestyleTracker checks that the element's GetComposedDoc()
+      // matches the document we're restyling.  Do we need to do that too?
+      if (!element->IsInComposedDoc()) {
+        continue;
+      }
+
       // TODO: avoid the ComputeRestyleHint call if we already have the highest
       // explicit restyle hint?
       nsRestyleHint hint = styleSet->ComputeRestyleHint(element, snapshot);
       hint |= snapshot->ExplicitRestyleHint();
 
       if (hint) {
         NoteRestyleHint(element, hint);
       }
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1315889-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<style>
+.x { color: blue; }
+</style>
+<div class=x>hello</div>
+<script>
+document.body.offsetWidth;
+var x = document.querySelector(".x");
+x.className = "";
+x.remove();
+document.body.offsetWidth;
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -155,9 +155,10 @@ pref(dom.animations-api.core.enabled,tru
 load 1277908-2.html
 load 1282076-1.html
 pref(dom.animations-api.core.enabled,true) load 1282076-2.html
 pref(dom.animations-api.core.enabled,true) load 1290994-1.html
 pref(dom.animations-api.core.enabled,true) load 1290994-2.html
 pref(dom.animations-api.core.enabled,true) load 1290994-3.html
 load 1290994-4.html
 load 1314531.html
+load 1315889-1.html
 load 1315894-1.html