Bug 53901: Make sure to also release controllers when unbinding xul elements from the DOM. r/sr=bz

content/base/public/nsINode.h

@@ -82,8 +82,8 @@ class nsNodeSupportsWeakRefTearoff;
 // NOTE: Should only be used on nsIContent nodes
 #define NODE_MAY_HAVE_FRAME          0x00000020U
 
-// Forces the XBL code to treat this node as if it was
-// in the document and therefor should get bindings attached.
+// Forces the XBL code to treat this node as if it were
+// in the document and therefore should get bindings attached.
 #define NODE_FORCE_XBL_BINDINGS      0x00000040U
 
 // Whether a binding manager may have a pointer to this

content/xul/content/src/nsXULElement.cpp

@@ -785,6 +785,28 @@ nsXULElement::MaybeAddPopupListener(nsIAtom* aLocalName)
 // nsIContent interface
 //
 
+void
+nsXULElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
+{
+    // mControllers can own objects that are implemented
+    // in JavaScript (such as some implementations of
+    // nsIControllers.  These objects prevent their global
+    // object's script object from being garbage collected,
+    // which means JS continues to hold an owning reference
+    // to the nsGlobalWindow, which owns the document,
+    // which owns this content.  That's a cycle, so we break
+    // it here.  (It might be better to break this by releasing
+    // mDocument in nsGlobalWindow::SetDocShell, but I'm not
+    // sure whether that would fix all possible cycles through
+    // mControllers.)
+    nsDOMSlots* slots = GetExistingDOMSlots();
+    if (slots) {
+        NS_IF_RELEASE(slots->mControllers);
+    }
+
+    nsGenericElement::UnbindFromTree(aDeep, aNullParent);
+}
+
 void
 nsXULElement::SetNativeAnonymous(PRBool aAnonymous)
 {

content/xul/content/src/nsXULElement.h

@@ -486,6 +486,7 @@ public:
                                    PRBool aNotify);
 
     // nsIContent
+    virtual void UnbindFromTree(PRBool aDeep, PRBool aNullParent);
     virtual void SetNativeAnonymous(PRBool aAnonymous);
     virtual nsresult RemoveChildAt(PRUint32 aIndex, PRBool aNotify);
     virtual nsIAtom *GetIDAttributeName() const;
@@ -559,8 +560,8 @@ public:
     virtual void RecompileScriptEventListeners();
 
     // This function should ONLY be used by BindToTree implementations.
-    // The function exists soly because XUL elements store the binding parent
-    // differently than nsGenericElement does.
+    // The function exists solely because XUL elements store the binding
+    // parent as a member instead of in the slots, as nsGenericElement does.
     void SetXULBindingParent(nsIContent* aBindingParent)
     {
       mBindingParent = aBindingParent;