diff --git a/content/base/crashtests/978646.html b/content/base/crashtests/978646.html
new file mode 100644
index 000000000000..09274ed16c30
--- /dev/null
+++ b/content/base/crashtests/978646.html
@@ -0,0 +1,15 @@
+
+
+
+
+
+
+
+
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 68a589962b83..14ae83457895 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -147,3 +147,4 @@ skip-if(Android) load 851353-1.html
load 863950.html
load 864448.html
load 942979.html
+load 978646.html
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index be3c5b020c6c..1aa222a76fda 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -1904,6 +1904,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsDocument)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mScriptGlobalObject)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mListenerManager)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDOMStyleSheets)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStyleSheetSetList)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mScriptLoader)
tmp->mRadioGroups.EnumerateRead(RadioGroupsTraverser, &cb);
@@ -2042,6 +2043,13 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
tmp->mListenerManager = nullptr;
}
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mDOMStyleSheets)
+
+ if (tmp->mStyleSheetSetList) {
+ tmp->mStyleSheetSetList->Disconnect();
+ tmp->mStyleSheetSetList = nullptr;
+ }
+
if (tmp->mSubDocuments) {
PL_DHashTableDestroy(tmp->mSubDocuments);
tmp->mSubDocuments = nullptr;