Bug 1851787 - Plumb a DestroyContext through all functions that can destroy frames. r=dholbert

This prevents anonymous content getting destroyed at weird times
during frame destruction.

Differential Revision: https://phabricator.services.mozilla.com/D187693

layout/base/nsCSSFrameConstructor.cpp

@@ -3912,7 +3912,8 @@ void nsCSSFrameConstructor::ConstructFrameFromItemInternal(
 
         if (childList.NotEmpty()) {
           // an error must have occurred, delete unprocessed frames
-          childList.DestroyFrames();
+          DestroyContext context(mPresShell);
+          childList.DestroyFrames(context);
         }
 
         childList = std::move(newList);
@@ -7053,7 +7054,9 @@ void nsCSSFrameConstructor::ContentRangeInserted(nsIContent* aStartChild,
     nsIContent* const nextSibling = aStartChild->GetNextSibling();
     MOZ_ASSERT(nextSibling && nextSibling->IsText(),
                "expected a text node after the list-style-image image");
-    RemoveFrame(FrameChildListID::Principal, nextSibling->GetPrimaryFrame());
+    DestroyContext context(mPresShell);
+    RemoveFrame(context, FrameChildListID::Principal,
+                nextSibling->GetPrimaryFrame());
     auto* const container = aStartChild->GetParent()->AsElement();
     nsIContent* firstNewChild = nullptr;
     auto InsertChild = [this, container, nextSibling,
@@ -7531,7 +7534,9 @@ bool nsCSSFrameConstructor::ContentRemoved(nsIContent* aChild,
       parentFrame = childFrame->GetParent();
     }
 
-    RemoveFrame(nsLayoutUtils::GetChildListNameFor(childFrame), childFrame);
+    DestroyContext context(mPresShell);
+    RemoveFrame(context, nsLayoutUtils::GetChildListNameFor(childFrame),
+                childFrame);
 
     // NOTE(emilio): aChild could be dead here already if it is a ::before or
     // ::after pseudo-element (since in that case it was owned by childFrame,
@@ -10182,20 +10187,22 @@ void nsCSSFrameConstructor::WrapFramesInFirstLetterFrame(
   WrapFramesInFirstLetterFrame(
       aBlockFrame, aBlockFrame, aBlockFrame, aBlockFrames.FirstChild(),
       &parentFrame, &textFrame, &prevFrame, letterFrames, &stopLooking);
-  if (parentFrame) {
-    if (parentFrame == aBlockFrame) {
-      // Take textFrame out of the block's frame list and substitute the
-      // letter frame(s) instead.
-      aBlockFrames.DestroyFrame(textFrame);
-      aBlockFrames.InsertFrames(nullptr, prevFrame, std::move(letterFrames));
-    } else {
-      // Take the old textFrame out of the inline parent's child list
-      RemoveFrame(FrameChildListID::Principal, textFrame);
+  if (!parentFrame) {
+    return;
+  }
+  DestroyContext context(mPresShell);
+  if (parentFrame == aBlockFrame) {
+    // Take textFrame out of the block's frame list and substitute the
+    // letter frame(s) instead.
+    aBlockFrames.DestroyFrame(context, textFrame);
+    aBlockFrames.InsertFrames(nullptr, prevFrame, std::move(letterFrames));
+  } else {
+    // Take the old textFrame out of the inline parent's child list
+    RemoveFrame(context, FrameChildListID::Principal, textFrame);
 
-      // Insert in the letter frame(s)
-      parentFrame->InsertFrames(FrameChildListID::Principal, prevFrame, nullptr,
-                                std::move(letterFrames));
-    }
+    // Insert in the letter frame(s)
+    parentFrame->InsertFrames(FrameChildListID::Principal, prevFrame, nullptr,
+                              std::move(letterFrames));
   }
 }
 
@@ -10335,9 +10342,10 @@ void nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames(
   // Destroy the old text frame's continuations (the old text frame
   // will be destroyed when its letter frame is destroyed).
   nsIFrame* frameToDelete = textFrame->LastContinuation();
+  DestroyContext context(mPresShell);
   while (frameToDelete != textFrame) {
     nsIFrame* nextFrameToDelete = frameToDelete->GetPrevContinuation();
-    RemoveFrame(FrameChildListID::Principal, frameToDelete);
+    RemoveFrame(context, FrameChildListID::Principal, frameToDelete);
     frameToDelete = nextFrameToDelete;
   }
 
@@ -10352,7 +10360,7 @@ void nsCSSFrameConstructor::RemoveFloatingFirstLetterFrames(
 #endif
 
   // Remove placeholder frame and the float
-  RemoveFrame(FrameChildListID::Principal, placeholderFrame);
+  RemoveFrame(context, FrameChildListID::Principal, placeholderFrame);
 
   // Now that the old frames are gone, we can start pointing to our
   // new primary frame.
@@ -10401,8 +10409,10 @@ void nsCSSFrameConstructor::RemoveFirstLetterFrames(
       textFrame = NS_NewTextFrame(aPresShell, newSC);
       textFrame->Init(textContent, aFrame, nullptr);
 
+      DestroyContext context(mPresShell);
+
       // Next rip out the kid and replace it with the text frame
-      RemoveFrame(FrameChildListID::Principal, kid);
+      RemoveFrame(context, FrameChildListID::Principal, kid);
 
       // Now that the old frames are gone, we can start pointing to our
       // new primary frame.
@@ -10427,7 +10437,8 @@ void nsCSSFrameConstructor::RemoveFirstLetterFrames(
                    "should have the first continuation here");
       aBlockFrame->RemoveStateBits(NS_BLOCK_HAS_FIRST_LETTER_CHILD);
       break;
-    } else if (IsInlineFrame(kid)) {
+    }
+    if (IsInlineFrame(kid)) {
       nsContainerFrame* kidAsContainerFrame = do_QueryFrame(kid);
       if (kidAsContainerFrame) {
         // Look inside child inline frame for the letter frame.
@@ -10488,14 +10499,16 @@ void nsCSSFrameConstructor::RecoverLetterFrames(nsContainerFrame* aBlockFrame) {
         static_cast<nsContainerFrame*>(continuation->GetNextContinuation());
   } while (continuation);
 
-  if (parentFrame) {
-    // Take the old textFrame out of the parent's child list
-    RemoveFrame(FrameChildListID::Principal, textFrame);
-
-    // Insert in the letter frame(s)
-    parentFrame->InsertFrames(FrameChildListID::Principal, prevFrame, nullptr,
-                              std::move(letterFrames));
+  if (!parentFrame) {
+    return;
   }
+  // Take the old textFrame out of the parent's child list
+  DestroyContext context(mPresShell);
+  RemoveFrame(context, FrameChildListID::Principal, textFrame);
+
+  // Insert in the letter frame(s)
+  parentFrame->InsertFrames(FrameChildListID::Principal, prevFrame, nullptr,
+                            std::move(letterFrames));
 }
 
 //----------------------------------------------------------------------
@@ -10916,7 +10929,8 @@ bool nsCSSFrameConstructor::MaybeRecreateForColumnSpan(
     // associated out-of-flow frames properly, we need to manually flush all the
     // out-of-flow frames in aState to their container frames.
     aState.ProcessFrameInsertionsForAllLists();
-    aFrameList.DestroyFrames();
+    DestroyContext context(mPresShell);
+    aFrameList.DestroyFrames(context);
     RecreateFramesForContent(
         GetMultiColumnContainingBlockFor(aParentFrame)->GetContent(),
         InsertionKind::Async);