Bug 1230110 - HTMLImageElement should call its superclass's DestroyContent(). r=smaug

--HG-- extra : commitid : L6Z2VdVTfXK extra : rebase_source : fad68a186e8124cab5beffa34e9db960fe5d2d38
2015-12-03 14:03:12 -08:00 · 2015-12-03 14:03:12 -08:00 · 5e1c30c848
--- a/dom/html/HTMLImageElement.cpp
+++ b/dom/html/HTMLImageElement.cpp
@ -1309,6 +1309,8 @@ void
 HTMLImageElement::DestroyContent()
 {
  mResponsiveSelector = nullptr;
+
+  nsGenericHTMLElement::DestroyContent();
 }

 void
--- a/dom/html/crashtests/1230110.html
+++ b/dom/html/crashtests/1230110.html
@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+// This test case should not leak.
+function leak()
+{
+    var img = document.createElement("img");
+    var iframe = document.createElement("iframe");
+    img.appendChild(iframe);
+    document.body.appendChild(img);
+
+    document.addEventListener('Foo', function(){}, false);
+}
+</script>
+</head>
+<body onload="leak();"></body>
+</html>
--- a/dom/html/crashtests/crashtests.list
+++ b/dom/html/crashtests/crashtests.list
@ -75,3 +75,5 @@ load 916322-2.html
 load 1032654.html
 pref(dom.image.srcset.enabled,true) load 1141260.html
 load 1228876.html
+load 1230110.html
+