From 93cb39c8cf55e318ebbafda9a71e8df33ff07fdc Mon Sep 17 00:00:00 2001
From: Miko Mynttinen <mikokm@gmail.com>
Date: Tue, 22 Mar 2022 22:34:37 +0000
Subject: [PATCH] Bug 1760847 - Deallocate linked list nodes when
 RemoveBottom() is called r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D141789
---
 layout/painting/nsDisplayList.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/layout/painting/nsDisplayList.h b/layout/painting/nsDisplayList.h
index 4e8b1f50f831..ab32b78e1074 100644
--- a/layout/painting/nsDisplayList.h
+++ b/layout/painting/nsDisplayList.h
@@ -3245,7 +3245,10 @@ class nsDisplayList {
     }
 
     nsDisplayItem* bottom = mBottom->mValue;
-    mBottom = mBottom->mNext;
+
+    auto next = mBottom->mNext;
+    Deallocate(mBottom);
+    mBottom = next;
 
     if (!mBottom) {
       // No bottom item means no items at all.