Bug 1396041 - Disassociate element from document before destroying animations in UnbindFromTree(). r?birtles draft
authorHiroyuki Ikezoe <hikezoe@mozilla.com>
Mon, 04 Sep 2017 12:24:07 +0900
changeset 658402 4150e29e36ee0098ae480e050deb7fc0e9ee9639
parent 658358 8e05298328da75f3056a9f1f9609938870d756a0
child 729637 ec56677aa7dad9f84a8622b21d0bb8e54aa73995
push id77752
push userhikezoe@mozilla.com
push dateMon, 04 Sep 2017 03:24:34 +0000
reviewersbirtles
bugs1396041
milestone57.0a1
Bug 1396041 - Disassociate element from document before destroying animations in UnbindFromTree(). r?birtles This allows us to avoid posting animation-related restyles when removing elements from the document tree. MozReview-Commit-ID: CzN4S0DTUMa
dom/base/Element.cpp
layout/style/crashtests/1396041.html
layout/style/crashtests/crashtests.list
--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -1881,33 +1881,33 @@ Element::UnbindFromTree(bool aDeep, bool
                    presContext->GetViewportScrollbarStylesOverrideNode(),
                    "Leaving behind a raw pointer to this node (as having "
                    "propagated scrollbar styles) - that's dangerous...");
       }
     }
   }
 #endif
 
+  ClearInDocument();
+
   // Ensure that CSS transitions don't continue on an element at a
   // different place in the tree (even if reinserted before next
   // animation refresh).
   // We need to delete the properties while we're still in document
   // (if we were in document).
   // FIXME (Bug 522599): Need a test for this.
   if (MayHaveAnimations()) {
     DeleteProperty(nsGkAtoms::transitionsOfBeforeProperty);
     DeleteProperty(nsGkAtoms::transitionsOfAfterProperty);
     DeleteProperty(nsGkAtoms::transitionsProperty);
     DeleteProperty(nsGkAtoms::animationsOfBeforeProperty);
     DeleteProperty(nsGkAtoms::animationsOfAfterProperty);
     DeleteProperty(nsGkAtoms::animationsProperty);
   }
 
-  ClearInDocument();
-
   // Computed style data isn't useful for detached nodes, and we'll need to
   // recompute it anyway if we ever insert the nodes back into a document.
   if (IsStyledByServo()) {
     if (document) {
       ClearServoData(document);
     } else {
       MOZ_ASSERT(!HasServoData());
       MOZ_ASSERT(!HasAnyOfFlags(kAllServoDescendantBits | NODE_NEEDS_FRAME));
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1396041.html
@@ -0,0 +1,9 @@
+<script>
+document.documentElement.appendChild(document.createElement("meter"))
+a = document.createElement("textarea")
+document.documentElement.appendChild(a)
+b = document.createElement("style")
+b.appendChild(document.createTextNode("*::-moz-meter-bar { text-indent: calc(50%); scroll-behavior: smooth; transition-duration: 250ms; }"))
+a.select()
+document.head.appendChild(b)
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -206,8 +206,9 @@ load 1388234.html
 load 1391577.html
 load 1393189.html
 load 1393580.html
 load 1389645.html
 load 1390726.html
 load 1393791.html
 load 1384232.html
 load 1395725.html
+load 1396041.html