Bug 1288228 part 2: When a DOMSVGLength is CC'd, remove it from tearoff table and drop its weak ref to wrapped val. r?jwatt
MozReview-Commit-ID: 74YJfLnRYg0
--- a/dom/svg/DOMSVGLength.cpp
+++ b/dom/svg/DOMSVGLength.cpp
@@ -28,20 +28,18 @@ static nsSVGAttrTearoffTable<nsSVGLength
// We could use NS_IMPL_CYCLE_COLLECTION(, except that in Unlink() we need to
// clear our list's weak ref to us to be safe. (The other option would be to
// not unlink and rely on the breaking of the other edges in the cycle, as
// NS_SVG_VAL_IMPL_CYCLE_COLLECTION does.)
NS_IMPL_CYCLE_COLLECTION_CLASS(DOMSVGLength)
NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(DOMSVGLength)
- // We may not belong to a list, so we must null check tmp->mList.
- if (tmp->mList) {
- tmp->mList->mItems[tmp->mListIndex] = nullptr;
- }
+ tmp->CleanupWeakRefs();
+ tmp->mVal = nullptr; // (owned by mSVGElement, which we drop our ref to here)
NS_IMPL_CYCLE_COLLECTION_UNLINK(mList)
NS_IMPL_CYCLE_COLLECTION_UNLINK(mSVGElement)
NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
NS_IMPL_CYCLE_COLLECTION_UNLINK_END
NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(DOMSVGLength)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mList)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSVGElement)