Bug 1376936 - nsContentLists should stop observing mutations when their refcnt drops to 0, r=ehsan

dom/base/nsContentList.cpp

@@ -91,7 +91,8 @@ NS_INTERFACE_MAP_END
 
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsBaseContentList)
-NS_IMPL_CYCLE_COLLECTING_RELEASE(nsBaseContentList)
+NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_LAST_RELEASE(nsBaseContentList,
+                                                   LastRelease())
 
 
 NS_IMETHODIMP
@@ -592,6 +593,17 @@ nsContentList::NodeWillBeDestroyed(const nsINode* aNode)
   SetDirty();
 }
 
+void
+nsContentList::LastRelease()
+{
+  RemoveFromCaches();
+  if (mRootNode) {
+    mRootNode->RemoveMutationObserver(this);
+    mRootNode = nullptr;
+  }
+  SetDirty();
+}
+
 NS_IMETHODIMP
 nsContentList::GetLength(uint32_t* aLength)
 {

dom/base/nsContentList.h

@@ -95,6 +95,9 @@ public:
   {
     mElements.SetCapacity(aCapacity);
   }
+
+  virtual void LastRelease() {}
+
 protected:
   virtual ~nsBaseContentList();
 
@@ -352,6 +355,8 @@ public:
     Reset();
   }
 
+  virtual void LastRelease() override;
+
 protected:
   /**
    * Returns whether the element matches our criterion