Bug 612568 - Drop nsIContent handles when finished parsing a fragment. r=Olli.Pettay, a=jst.

parser/html/nsHtml5Parser.cpp

@@ -498,6 +498,7 @@ nsHtml5Parser::ParseHtml5Fragment(const nsAString& aSourceBuffer,
   mTokenizer->end();
   mExecutor->DropParserAndPerfHint();
   mExecutor->DropHeldElements();
+  mTreeBuilder->DropHandles();
   mAtomTable.Clear();
   return NS_OK;
 }

parser/html/nsHtml5TreeBuilderCppSupplement.h

@@ -667,6 +667,13 @@ nsHtml5TreeBuilder::IsDiscretionaryFlushSafe()
            stack[currentPtr]->fosterParenting);
 }
 
+void
+nsHtml5TreeBuilder::DropHandles()
+{
+  mOldHandles.Clear();
+  mHandlesUsed = 0;
+}
+
 // DocumentModeHandler
 void
 nsHtml5TreeBuilder::documentMode(nsHtml5DocumentMode m)

parser/html/nsHtml5TreeBuilderHSupplement.h

@@ -95,3 +95,5 @@
     void NeedsCharsetSwitchTo(const nsACString& aEncoding);
 
     void AddSnapshotToScript(nsAHtml5TreeBuilderState* aSnapshot, PRInt32 aLine);
+
+    void DropHandles();