Bug 1396041 - Disassociate element from document before destroying animations in UnbindFromTree(). r=birtles

This allows us to avoid posting animation-related restyles when removing
elements from the document tree.

MozReview-Commit-ID: CzN4S0DTUMa

--HG--
extra : rebase_source : a5b94d9ad5b1b2243abd0a5b188eec2b334df74d

dom/base/Element.cpp

@@ -1886,6 +1886,8 @@ Element::UnbindFromTree(bool aDeep, bool aNullParent)
   }
 #endif
 
+  ClearInDocument();
+
   // Ensure that CSS transitions don't continue on an element at a
   // different place in the tree (even if reinserted before next
   // animation refresh).
@@ -1901,8 +1903,6 @@ Element::UnbindFromTree(bool aDeep, bool aNullParent)
     DeleteProperty(nsGkAtoms::animationsProperty);
   }
 
-  ClearInDocument();
-
   // Computed style data isn't useful for detached nodes, and we'll need to
   // recompute it anyway if we ever insert the nodes back into a document.
   if (IsStyledByServo()) {

layout/style/crashtests/1396041.html

@@ -0,0 +1,9 @@
+<script>
+document.documentElement.appendChild(document.createElement("meter"))
+a = document.createElement("textarea")
+document.documentElement.appendChild(a)
+b = document.createElement("style")
+b.appendChild(document.createTextNode("*::-moz-meter-bar { text-indent: calc(50%); scroll-behavior: smooth; transition-duration: 250ms; }"))
+a.select()
+document.head.appendChild(b)
+</script>

layout/style/crashtests/crashtests.list

@@ -211,3 +211,4 @@ load 1390726.html
 load 1393791.html
 load 1384232.html
 load 1395725.html
+load 1396041.html