Backed out 1 changesets (bug 1162765)

Backed out changeset 18886e5d06df (bug 1162765)

dom/html/HTMLFieldSetElement.cpp

@@ -32,6 +32,10 @@ HTMLFieldSetElement::HTMLFieldSetElement(already_AddRefed<mozilla::dom::NodeInfo
 
 HTMLFieldSetElement::~HTMLFieldSetElement()
 {
+  uint32_t length = mDependentElements.Length();
+  for (uint32_t i = 0; i < length; ++i) {
+    mDependentElements[i]->ForgetFieldSet(this);
+  }
 }
 
 // nsISupports

dom/html/nsGenericHTMLElement.cpp

@@ -1895,16 +1895,15 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericHTMLFormElement)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsGenericHTMLFormElement,
                                                   nsGenericHTMLElement)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mForm)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFieldSet)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGenericHTMLFormElement,
                                                 nsGenericHTMLElement)
   tmp->ClearForm(true);
-  tmp->ClearFieldSet();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 nsGenericHTMLFormElement::nsGenericHTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
   : nsGenericHTMLElement(aNodeInfo)
+  , mFieldSet(nullptr)
 {
   // We should add the NS_EVENT_STATE_ENABLED bit here as needed, but
   // that depends on our type, which is not initialized yet.  So we
@@ -1913,21 +1912,14 @@ nsGenericHTMLFormElement::nsGenericHTMLFormElement(already_AddRefed<mozilla::dom
 
 nsGenericHTMLFormElement::~nsGenericHTMLFormElement()
 {
-  ClearFieldSet();
+  if (mFieldSet) {
+    mFieldSet->RemoveElement(this);
+  }
 
   // Check that this element doesn't know anything about its form at this point.
   NS_ASSERTION(!mForm, "mForm should be null at this point!");
 }
 
-void
-nsGenericHTMLFormElement::ClearFieldSet()
-{
-  if (mFieldSet) {
-    mFieldSet->RemoveElement(this);
-    mFieldSet = nullptr;
-  }
-}
-
 nsINode*
 nsGenericHTMLFormElement::GetScopeChainParent() const
 {
@@ -2264,6 +2256,14 @@ nsGenericHTMLFormElement::IsDisabled() const
          (mFieldSet && mFieldSet->IsDisabled());
 }
 
+void
+nsGenericHTMLFormElement::ForgetFieldSet(nsIContent* aFieldset)
+{
+  if (mFieldSet == aFieldset) {
+    mFieldSet = nullptr;
+  }
+}
+
 bool
 nsGenericHTMLFormElement::CanBeDisabled() const
 {

dom/html/nsGenericHTMLElement.h

@@ -1331,6 +1331,15 @@ public:
     UpdateFieldSet(aNotify);
   }
 
+  /**
+   * This callback is called by a fieldset on all it's elements when it's being
+   * destroyed. When called, the elements should check that aFieldset is there
+   * first parent fieldset and null mFieldset in that case only.
+   *
+   * @param aFieldSet The fieldset being removed.
+   */
+  void ForgetFieldSet(nsIContent* aFieldset);
+
   /**
    * Returns if the control can be disabled.
    */
@@ -1341,9 +1350,6 @@ public:
 
   virtual bool IsLabelable() const override;
 
-private:
-  void ClearFieldSet();
-
 protected:
   virtual ~nsGenericHTMLFormElement();
 
@@ -1413,7 +1419,7 @@ protected:
   nsRefPtr<mozilla::dom::HTMLFormElement> mForm;
 
   /* This is a pointer to our closest fieldset parent if any */
-  nsRefPtr<mozilla::dom::HTMLFieldSetElement> mFieldSet;
+  mozilla::dom::HTMLFieldSetElement* mFieldSet;
 };
 
 class nsGenericHTMLFormElementWithState : public nsGenericHTMLFormElement