Bug 1463116 - Make mBindingParent strong, r=bz

--HG--
extra : rebase_source : 7013301bf68d2f35bde61072152f8819336c7b5a

dom/base/FragmentOrElement.cpp

@@ -645,6 +645,7 @@ static_assert(sizeof(FragmentOrElement::nsDOMSlots) <= MaxDOMSlotSizeAllowed,
 void
 nsIContent::nsExtendedContentSlots::Unlink()
 {
+  mBindingParent = nullptr;
   mXBLInsertionPoint = nullptr;
   mContainingShadow = nullptr;
   mAssignedSlot = nullptr;
@@ -653,6 +654,9 @@ nsIContent::nsExtendedContentSlots::Unlink()
 void
 nsIContent::nsExtendedContentSlots::Traverse(nsCycleCollectionTraversalCallback& aCb)
 {
+  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(aCb, "mExtendedSlots->mBindingParent");
+  aCb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mBindingParent));
+
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(aCb, "mExtendedSlots->mContainingShadow");
   aCb.NoteXPCOMChild(NS_ISUPPORTS_CAST(nsIContent*, mContainingShadow));
 
@@ -664,7 +668,6 @@ nsIContent::nsExtendedContentSlots::Traverse(nsCycleCollectionTraversalCallback&
 }
 
 nsIContent::nsExtendedContentSlots::nsExtendedContentSlots()
-  : mBindingParent(nullptr)
 {
 }
 
@@ -736,8 +739,9 @@ FragmentOrElement::nsDOMSlots::SizeOfIncludingThis(MallocSizeOf aMallocSizeOf) c
   // - mChildrenList
   // - mClassList
 
-  // The following members are not measured:
-  // - mBindingParent / mControllers: because they're   non-owning
+  // The following member are not measured:
+  // - mControllers: because it is non-owning
+  // - mBindingParent: because it is some ancestor element.
   return n;
 }
 

dom/base/nsIContent.h

@@ -451,7 +451,7 @@ public:
   virtual nsIContent* GetBindingParent() const
   {
     const nsExtendedContentSlots* slots = GetExistingExtendedContentSlots();
-    return slots ? slots->mBindingParent : nullptr;
+    return slots ? slots->mBindingParent.get() : nullptr;
   }
 
   /**
@@ -808,7 +808,7 @@ protected:
      *
      * @see nsIContent::GetBindingParent
      */
-    nsIContent* mBindingParent;  // [Weak]
+    nsCOMPtr<nsIContent> mBindingParent;
 
     /**
      * @see nsIContent::GetXBLInsertionPoint

dom/xul/nsXULElement.cpp

@@ -304,12 +304,14 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULElement)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXULElement,
                                                   nsStyledElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mBindingParent);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXULElement,
                                                 nsStyledElement)
     // Why aren't we unlinking the prototype?
     tmp->ClearHasID();
+    NS_IMPL_CYCLE_COLLECTION_UNLINK(mBindingParent);
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ADDREF_INHERITED(nsXULElement, nsStyledElement)

dom/xul/nsXULElement.h

@@ -670,9 +670,9 @@ protected:
 
     /**
      * The nearest enclosing content node with a binding
-     * that created us. [Weak]
+     * that created us.
      */
-    nsIContent*                         mBindingParent;
+    nsCOMPtr<nsIContent> mBindingParent;
 
     /**
      * Abandon our prototype linkage, and copy all attributes locally

servo/components/style/gecko/wrapper.rs

@@ -665,7 +665,7 @@ impl<'le> GeckoElement<'le> {
     fn non_xul_xbl_binding_parent_raw_content(&self) -> *mut nsIContent {
         debug_assert!(!self.is_xul_element());
         self.extended_slots()
-            .map_or(ptr::null_mut(), |slots| slots._base.mBindingParent)
+            .map_or(ptr::null_mut(), |slots| slots._base.mBindingParent.raw())
     }
 
     #[inline]