From b4340daf095e31971346630ae834f43c86d4be08 Mon Sep 17 00:00:00 2001
From: Fedor <fedor@mail.ru>
Date: Wed, 12 Jun 2019 13:44:36 +0300
Subject: [PATCH] Make extra sure Compositables don't refer back to layers
 after reassignment.

---
 gfx/layers/composite/CanvasLayerComposite.cpp  | 6 +++++-
 gfx/layers/composite/ImageLayerComposite.cpp   | 9 +++++++--
 gfx/layers/composite/PaintedLayerComposite.cpp | 9 +++++++--
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/gfx/layers/composite/CanvasLayerComposite.cpp b/gfx/layers/composite/CanvasLayerComposite.cpp
index 3c8299e05..86f25b1ee 100644
--- a/gfx/layers/composite/CanvasLayerComposite.cpp
+++ b/gfx/layers/composite/CanvasLayerComposite.cpp
@@ -43,9 +43,13 @@ bool
 CanvasLayerComposite::SetCompositableHost(CompositableHost* aHost)
 {
   switch (aHost->GetType()) {
-    case CompositableType::IMAGE:
+    case CompositableType::IMAGE: {
+      if (mCompositableHost && aHost != mCompositableHost) {
+        mCompositableHost->Detach(this);
+      }
       mCompositableHost = aHost;
       return true;
+    }
     default:
       return false;
   }
diff --git a/gfx/layers/composite/ImageLayerComposite.cpp b/gfx/layers/composite/ImageLayerComposite.cpp
index bac9f3790..6867aaa22 100644
--- a/gfx/layers/composite/ImageLayerComposite.cpp
+++ b/gfx/layers/composite/ImageLayerComposite.cpp
@@ -50,9 +50,14 @@ bool
 ImageLayerComposite::SetCompositableHost(CompositableHost* aHost)
 {
   switch (aHost->GetType()) {
-    case CompositableType::IMAGE:
-      mImageHost = static_cast<ImageHost*>(aHost);
+    case CompositableType::IMAGE: {
+      ImageHost* newImageHost = static_cast<ImageHost*>(aHost);
+      if (mImageHost && newImageHost != mImageHost) {
+        mImageHost->Detach(this);
+      }
+      mImageHost = newImageHost;
       return true;
+    }
     default:
       return false;
   }
diff --git a/gfx/layers/composite/PaintedLayerComposite.cpp b/gfx/layers/composite/PaintedLayerComposite.cpp
index b58f5d690..232cc4ef4 100644
--- a/gfx/layers/composite/PaintedLayerComposite.cpp
+++ b/gfx/layers/composite/PaintedLayerComposite.cpp
@@ -49,9 +49,14 @@ PaintedLayerComposite::SetCompositableHost(CompositableHost* aHost)
   switch (aHost->GetType()) {
     case CompositableType::CONTENT_TILED:
     case CompositableType::CONTENT_SINGLE:
-    case CompositableType::CONTENT_DOUBLE:
-      mBuffer = static_cast<ContentHost*>(aHost);
+    case CompositableType::CONTENT_DOUBLE: {
+      ContentHost* newBuffer = static_cast<ContentHost*>(aHost);
+      if (mBuffer && newBuffer != mBuffer) {
+        mBuffer->Detach(this);
+      }
+      mBuffer = newBuffer;
       return true;
+    }
     default:
       return false;
   }