Update identifier map entries and notify if they get removed.

This can happen through DestroyElementMaps()
Based on work by Markus Stange and Edgar Chen.

2 files changed, 34 insertions, 6 deletions

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 6b8e11db0..e2be6b664 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -395,6 +395,21 @@ nsIdentifierMapEntry::FireChangeCallbacks(Element* aOldElement,
   }
 }
 
+void
+nsIdentifierMapEntry::ClearAndNotify()
+{
+  Element* currentElement = mIdContentList.SafeElementAt(0);
+  mIdContentList.Clear();
+  if (currentElement) {
+    FireChangeCallbacks(currentElement, nullptr);
+  }
+  mNameContentList = nullptr;
+  if (mImageElement) {
+    SetImageElement(nullptr);
+  }
+  mChangeCallbacks = nullptr;
+}
+
 namespace {
 
 struct PositionComparator
@@ -1422,12 +1437,12 @@ nsDocument::~nsDocument()
   delete mSubDocuments;
   mSubDocuments = nullptr;
 
+  nsAutoScriptBlocker scriptBlocker;
+
   // Destroy link map now so we don't waste time removing
   // links one by one
   DestroyElementMaps();
 
-  nsAutoScriptBlocker scriptBlocker;
-
   for (uint32_t indx = mChildren.ChildCount(); indx-- != 0; ) {
     mChildren.ChildAt(indx)->UnbindFromTree();
     mChildren.RemoveChildAt(indx);
@@ -1972,15 +1987,16 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
   delete mSubDocuments;
   mSubDocuments = nullptr;
 
-  // Destroy link map now so we don't waste time removing
-  // links one by one
-  DestroyElementMaps();
-
   bool oldVal = mInUnlinkOrDeletion;
   mInUnlinkOrDeletion = true;
   uint32_t count = mChildren.ChildCount();
   { // Scope for update
     MOZ_AUTO_DOC_UPDATE(this, UPDATE_CONTENT_MODEL, true);
+
+    // Destroy link map now so we don't waste time removing
+    // links one by one
+    DestroyElementMaps();
+
     for (int32_t i = int32_t(count) - 1; i >= 0; i--) {
       nsCOMPtr<nsIContent> content = mChildren.ChildAt(i);
 
@@ -8955,7 +8971,14 @@ nsDocument::DestroyElementMaps()
   mStyledLinksCleared = true;
 #endif
   mStyledLinks.Clear();
+
+  // Notify ID change listeners before clearing the identifier map.
+  for (auto iter = mIdentifierMap.Iter(); !iter.Done(); iter.Next()) {
+    iter.Get()->ClearAndNotify();
+  }
+
   mIdentifierMap.Clear();
+
   ++mExpandoAndGeneration.generation;
 }
 
diff --git a/dom/base/nsDocument.h b/dom/base/nsDocument.h
index 2b29b98fa..ac600eb43 100644
--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -216,6 +216,11 @@ public:
   void RemoveContentChangeCallback(nsIDocument::IDTargetObserver aCallback,
                                 void* aData, bool aForImage);
 
+  /**
+   * Remove all elements and notify change listeners.
+   */
+  void ClearAndNotify();
+
   void Traverse(nsCycleCollectionTraversalCallback* aCallback);
 
   struct ChangeCallback {