diff --git a/layout/base/RestyleManager.cpp b/layout/base/RestyleManager.cpp index d32b74a5f73a..f8e60dd94c61 100644 --- a/layout/base/RestyleManager.cpp +++ b/layout/base/RestyleManager.cpp @@ -376,8 +376,14 @@ void RestyleManager::ContentRemoved(nsIContent* aOldChild, // Computed style data isn't useful for detached nodes, and we'll need to // recompute it anyway if we ever insert the nodes back into a document. - if (aOldChild->IsElement()) { - RestyleManager::ClearServoDataFromSubtree(aOldChild->AsElement()); + if (auto* element = Element::FromNode(aOldChild)) { + RestyleManager::ClearServoDataFromSubtree(element); + // If this element is undisplayed or may have undisplayed descendants, we + // need to invalidate the cache, since there's the unlikely event of those + // elements getting destroyed and their addresses reused in a way that we + // look up the cache with their address for a different element before it's + // invalidated. + IncrementUndisplayedRestyleGeneration(); } // The container might be a document or a ShadowRoot.