Bug 926361, make sure mutation observers can't see the parent when unbinding, r=jst
authorOlli Pettay <Olli.Pettay@helsinki.fi>
Wed, 16 Oct 2013 22:29:08 +0300
changeset 165838 77a86dcd14d8cda674e21f7796b19bcb127567fb
parent 165837 2f93601415e1f29955df0522f380143311c5632e
child 165839 11c7c6810c730a28aceb31e9112b8797770c1fe9
push id428
push userbbajaj@mozilla.com
push dateTue, 28 Jan 2014 00:16:25 +0000
treeherdermozilla-release@cd72a7ff3a75 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjst
bugs926361
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 926361, make sure mutation observers can't see the parent when unbinding, r=jst
content/base/src/Element.cpp
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -1168,17 +1168,19 @@ Element::UnbindFromTree(bool aDeep, bool
                                       "RemovedFullScreenElement");
       // Fully exit full-screen.
       nsIDocument::ExitFullscreen(OwnerDoc(), /* async */ false);
     }
     if (HasPointerLock()) {
       nsIDocument::UnlockPointer();
     }
     if (GetParent()) {
-      NS_RELEASE(mParent);
+      nsINode* p = mParent;
+      mParent = nullptr;
+      NS_RELEASE(p);
     } else {
       mParent = nullptr;
     }
     SetParentIsContent(false);
   }
   ClearInDocument();
 
   // Begin keeping track of our subtree root.