Bug 1473637: Unbind ShadowRoot during unlinking. r=smaug

MozReview-Commit-ID: 7cWtZ5epRqK
This commit is contained in:
Emilio Cobos Álvarez 2018-07-11 03:40:44 +02:00
parent ef58e3064f
commit 8d2f22c0d8

View File

@ -763,10 +763,12 @@ FragmentOrElement::nsExtendedDOMSlots::UnlinkExtendedSlots()
// Don't clear mXBLBinding, it'll be done in
// BindingManager::RemovedFromDocument from FragmentOrElement::Unlink.
//
// mShadowRoot will similarly be cleared explicitly from
// FragmentOrElement::Unlink.
mSMILOverrideStyle = nullptr;
mControllers = nullptr;
mLabelsList = nullptr;
mShadowRoot = nullptr;
if (mCustomElementData) {
mCustomElementData->Unlink();
mCustomElementData = nullptr;
@ -1500,6 +1502,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(FragmentOrElement)
// containing shadow root pointer.
tmp->UnsetFlags(NODE_IS_IN_SHADOW_TREE);
if (ShadowRoot* shadowRoot = tmp->GetShadowRoot()) {
for (nsIContent* child = shadowRoot->GetFirstChild();
child;
child = child->GetNextSibling()) {
child->UnbindFromTree(true, false);
}
shadowRoot->SetIsComposedDocParticipant(false);
tmp->ExtendedDOMSlots()->mShadowRoot = nullptr;
}
nsIDocument* doc = tmp->OwnerDoc();
doc->BindingManager()->RemovedFromDocument(tmp, doc,
nsBindingManager::eDoNotRunDtor);