Bug 1348493 - Clear ServoElementData from canvas custom content's during-PresShell-destruction clones. r=bholley

MozReview-Commit-ID: HqLgOuXsQuV

--HG--
extra : rebase_source : 0da1b02c0675fc93303cedf3d8dfb73d413670a2
This commit is contained in:
Cameron McCormack 2017-03-18 14:15:09 +08:00
parent 4d61095fe0
commit 0bd2536940

View File

@ -8,6 +8,7 @@
#include "mozilla/DocumentStyleRootIterator.h"
#include "mozilla/ServoRestyleManager.h"
#include "mozilla/dom/AnonymousContent.h"
#include "mozilla/dom/ChildIterator.h"
#include "mozilla/dom/Element.h"
#include "mozilla/dom/ElementInlines.h"
@ -60,6 +61,8 @@ ServoStyleSet::Init(nsPresContext* aPresContext)
void
ServoStyleSet::BeginShutdown()
{
nsIDocument* doc = mPresContext->Document();
// It's important to do this before mRawSet is released, since that will cause
// a RuleTree GC, which needs to happen after we have dropped all of the
// document's strong references to RuleNodes. We also need to do it here,
@ -72,10 +75,18 @@ ServoStyleSet::BeginShutdown()
// Note that this is pretty bad for performance; we should find a way to
// get by with the ServoNodeDatas being dropped as part of the document
// going away.
DocumentStyleRootIterator iter(mPresContext->Document());
DocumentStyleRootIterator iter(doc);
while (Element* root = iter.GetNextStyleRoot()) {
ServoRestyleManager::ClearServoDataFromSubtree(root);
}
// We can also have some cloned canvas custom content stored in the document
// (as done in nsCanvasFrame::DestroyFrom), due to bug 1348480, when we create
// the clone (wastefully) during PresShell destruction. Clear data from that
// clone.
for (RefPtr<AnonymousContent>& ac : doc->GetAnonymousContents()) {
ServoRestyleManager::ClearServoDataFromSubtree(ac->GetContentNode());
}
}
void