Bug 1230110 - HTMLImageElement should call its superclass's DestroyContent(). r=smaug, a=ritu
authorAndrew McCreight <continuation@gmail.com>
Thu, 03 Dec 2015 14:03:12 -0800
changeset 305794 f2da4256bbe6bd9fc51cfa7a3086fec4c54ba8ec
parent 305793 8359a49d557afbf52cdaade882fa6a0ecdffc8a0
child 305795 69905a57ac2d3d7fe581f47c4a962ec35d7636fd
push id1001
push userraliiev@mozilla.com
push dateMon, 18 Jan 2016 19:06:03 +0000
treeherdermozilla-release@8b89261f3ac4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug, ritu
bugs1230110
milestone44.0a2
Bug 1230110 - HTMLImageElement should call its superclass's DestroyContent(). r=smaug, a=ritu
dom/html/HTMLImageElement.cpp
dom/html/crashtests/1230110.html
dom/html/crashtests/crashtests.list
--- a/dom/html/HTMLImageElement.cpp
+++ b/dom/html/HTMLImageElement.cpp
@@ -1280,16 +1280,18 @@ HTMLImageElement::SelectSourceForTagWith
   // <source> tags with no match would leave source yet-undetermined.
   return false;
 }
 
 void
 HTMLImageElement::DestroyContent()
 {
   mResponsiveSelector = nullptr;
+
+  nsGenericHTMLElement::DestroyContent();
 }
 
 void
 HTMLImageElement::MediaFeatureValuesChanged()
 {
   QueueImageLoadTask();
 }
 
new file mode 100644
--- /dev/null
+++ b/dom/html/crashtests/1230110.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+// This test case should not leak.
+function leak()
+{
+    var img = document.createElement("img");
+    var iframe = document.createElement("iframe");
+    img.appendChild(iframe);
+    document.body.appendChild(img);
+
+    document.addEventListener('Foo', function(){}, false);
+}
+</script>
+</head>
+<body onload="leak();"></body>
+</html>
--- a/dom/html/crashtests/crashtests.list
+++ b/dom/html/crashtests/crashtests.list
@@ -68,9 +68,10 @@ load 837033.html
 load 838256-1.html
 load 862084.html
 load 865147.html
 load 877910.html
 load 903106.html
 load 916322-1.html
 load 916322-2.html
 load 1032654.html
-pref(dom.image.srcset.enabled,true) load 1141260.html
\ No newline at end of file
+pref(dom.image.srcset.enabled,true) load 1141260.html
+load 1230110.html