Backed out changeset 55052ae7d067 (bug 1851868) for reftest failure on 1153695.html . CLOSED TREE

layout/base/nsFrameManager.cpp

@@ -50,8 +50,7 @@ void nsFrameManager::Destroy() {
   mPresShell->SetIgnoreFrameDestruction(true);
 
   if (mRootFrame) {
-    FrameDestroyContext context(mRootFrame);
+    mRootFrame->Destroy();
-    mRootFrame->Destroy(context);
     mRootFrame = nullptr;
   }
 

layout/forms/nsColorControlFrame.cpp

@@ -38,9 +38,10 @@ NS_QUERYFRAME_HEAD(nsColorControlFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLButtonControlFrame)
 
-void nsColorControlFrame::Destroy(DestroyContext& aContext) {
+void nsColorControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  aContext.AddAnonymousContent(mColorContent.forget());
+                                      PostDestroyData& aPostDestroyData) {
-  nsHTMLButtonControlFrame::Destroy(aContext);
+  aPostDestroyData.AddAnonymousContent(mColorContent.forget());
+  nsHTMLButtonControlFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 #ifdef DEBUG_FRAME_DUMP

layout/forms/nsColorControlFrame.h

@@ -27,7 +27,8 @@ class nsColorControlFrame final : public nsHTMLButtonControlFrame,
   friend nsIFrame* NS_NewColorControlFrame(mozilla::PresShell* aPresShell,
                                            ComputedStyle* aStyle);
 
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS(nsColorControlFrame)

layout/forms/nsComboboxControlFrame.cpp

@@ -845,16 +845,17 @@ nsIFrame* nsComboboxControlFrame::CreateFrameForDisplayNode() {
   return mDisplayFrame;
 }
 
-void nsComboboxControlFrame::Destroy(DestroyContext& aContext) {
+void nsComboboxControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                         PostDestroyData& aPostDestroyData) {
   // Revoke any pending RedisplayTextEvent
   mRedisplayTextEvent.Revoke();
 
   mEventListener->Detach();
 
   // Cleanup frames in popup child list
-  aContext.AddAnonymousContent(mDisplayContent.forget());
+  aPostDestroyData.AddAnonymousContent(mDisplayContent.forget());
-  aContext.AddAnonymousContent(mButtonContent.forget());
+  aPostDestroyData.AddAnonymousContent(mButtonContent.forget());
-  nsBlockFrame::Destroy(aContext);
+  nsBlockFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 const nsFrameList& nsComboboxControlFrame::GetChildList(

layout/forms/nsComboboxControlFrame.h

@@ -105,8 +105,8 @@ class nsComboboxControlFrame final : public nsBlockFrame,
 #ifdef DEBUG_FRAME_DUMP
   nsresult GetFrameName(nsAString& aResult) const final;
 #endif
-  void Destroy(DestroyContext&) final;
+  void DestroyFrom(nsIFrame* aDestructRoot,
-
+                   PostDestroyData& aPostDestroyData) final;
   void SetInitialChildList(ChildListID aListID, nsFrameList&& aChildList) final;
   const nsFrameList& GetChildList(ChildListID aListID) const final;
   void GetChildLists(nsTArray<ChildList>* aLists) const final;

layout/forms/nsFileControlFrame.cpp

@@ -59,7 +59,8 @@ void nsFileControlFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   mMouseListener = new DnDListener(this);
 }
 
-void nsFileControlFrame::Destroy(DestroyContext& aContext) {
+void nsFileControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                     PostDestroyData& aPostDestroyData) {
   NS_ENSURE_TRUE_VOID(mContent);
 
   // Remove the events.
@@ -68,11 +69,11 @@ void nsFileControlFrame::Destroy(DestroyContext& aContext) {
     mContent->RemoveSystemEventListener(u"dragover"_ns, mMouseListener, false);
   }
 
-  aContext.AddAnonymousContent(mTextContent.forget());
+  aPostDestroyData.AddAnonymousContent(mTextContent.forget());
-  aContext.AddAnonymousContent(mBrowseFilesOrDirs.forget());
+  aPostDestroyData.AddAnonymousContent(mBrowseFilesOrDirs.forget());
 
   mMouseListener->ForgetFrame();
-  nsBlockFrame::Destroy(aContext);
+  nsBlockFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 static already_AddRefed<Element> MakeAnonButton(

layout/forms/nsFileControlFrame.h

@@ -39,7 +39,8 @@ class nsFileControlFrame final : public nsBlockFrame,
   nsresult SetFormProperty(nsAtom* aName, const nsAString& aValue) override;
   void SetFocus(bool aOn, bool aRepaint) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
 #ifdef DEBUG_FRAME_DUMP
   nsresult GetFrameName(nsAString& aResult) const override;

layout/forms/nsGfxButtonControlFrame.cpp

@@ -26,9 +26,10 @@ nsContainerFrame* NS_NewGfxButtonControlFrame(PresShell* aPresShell,
 
 NS_IMPL_FRAMEARENA_HELPERS(nsGfxButtonControlFrame)
 
-void nsGfxButtonControlFrame::Destroy(DestroyContext& aContext) {
+void nsGfxButtonControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  aContext.AddAnonymousContent(mTextContent.forget());
+                                          PostDestroyData& aPostDestroyData) {
-  nsHTMLButtonControlFrame::Destroy(aContext);
+  aPostDestroyData.AddAnonymousContent(mTextContent.forget());
+  nsHTMLButtonControlFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 #ifdef DEBUG_FRAME_DUMP

layout/forms/nsGfxButtonControlFrame.h

@@ -27,7 +27,8 @@ class nsGfxButtonControlFrame final : public nsHTMLButtonControlFrame,
   explicit nsGfxButtonControlFrame(ComputedStyle* aStyle,
                                    nsPresContext* aPresContext);
 
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   virtual nsresult HandleEvent(nsPresContext* aPresContext,
                                mozilla::WidgetGUIEvent* aEvent,

layout/forms/nsListControlFrame.cpp

@@ -77,7 +77,8 @@ Maybe<nscoord> nsListControlFrame::GetNaturalBaselineBOffset(
   return Nothing{};
 }
 // for Bug 47302 (remove this comment later)
-void nsListControlFrame::Destroy(DestroyContext& aContext) {
+void nsListControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                     PostDestroyData& aPostDestroyData) {
   // get the receiver interface from the browser button's content node
   NS_ENSURE_TRUE_VOID(mContent);
 
@@ -85,7 +86,7 @@ void nsListControlFrame::Destroy(DestroyContext& aContext) {
   // event listener can outlive the frame.
 
   mEventListener->Detach();
-  nsHTMLScrollFrame::Destroy(aContext);
+  nsHTMLScrollFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsListControlFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,

layout/forms/nsListControlFrame.h

@@ -77,7 +77,8 @@ class nsListControlFrame final : public nsHTMLScrollFrame,
 
   void DidReflow(nsPresContext* aPresContext,
                  const ReflowInput* aReflowInput) final;
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) final;
 
   void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                         const nsDisplayListSet& aLists) final;

layout/forms/nsMeterFrame.cpp

@@ -38,12 +38,13 @@ nsMeterFrame::nsMeterFrame(ComputedStyle* aStyle, nsPresContext* aPresContext)
 
 nsMeterFrame::~nsMeterFrame() = default;
 
-void nsMeterFrame::Destroy(DestroyContext& aContext) {
+void nsMeterFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                               PostDestroyData& aPostDestroyData) {
   NS_ASSERTION(!GetPrevContinuation(),
                "nsMeterFrame should not have continuations; if it does we "
                "need to call RegUnregAccessKey only for the first.");
-  aContext.AddAnonymousContent(mBarDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mBarDiv.forget());
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsresult nsMeterFrame::CreateAnonymousContent(

layout/forms/nsMeterFrame.h

@@ -26,7 +26,8 @@ class nsMeterFrame final : public nsContainerFrame,
   explicit nsMeterFrame(ComputedStyle* aStyle, nsPresContext* aPresContext);
   virtual ~nsMeterFrame();
 
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   virtual void Reflow(nsPresContext* aCX, ReflowOutput& aDesiredSize,
                       const ReflowInput& aReflowInput,

layout/forms/nsNumberControlFrame.cpp

@@ -41,9 +41,10 @@ nsNumberControlFrame::nsNumberControlFrame(ComputedStyle* aStyle,
                                            nsPresContext* aPresContext)
     : nsTextControlFrame(aStyle, aPresContext, kClassID) {}
 
-void nsNumberControlFrame::Destroy(DestroyContext& aContext) {
+void nsNumberControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  aContext.AddAnonymousContent(mSpinBox.forget());
+                                       PostDestroyData& aPostDestroyData) {
-  nsTextControlFrame::Destroy(aContext);
+  aPostDestroyData.AddAnonymousContent(mSpinBox.forget());
+  nsTextControlFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsresult nsNumberControlFrame::CreateAnonymousContent(

layout/forms/nsNumberControlFrame.h

@@ -49,7 +49,7 @@ class nsNumberControlFrame final : public nsTextControlFrame {
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS(nsNumberControlFrame)
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData&) override;
 
 #ifdef ACCESSIBILITY
   mozilla::a11y::AccType AccessibleType() override;

layout/forms/nsProgressFrame.cpp

@@ -37,12 +37,13 @@ nsProgressFrame::nsProgressFrame(ComputedStyle* aStyle,
 
 nsProgressFrame::~nsProgressFrame() = default;
 
-void nsProgressFrame::Destroy(DestroyContext& aContext) {
+void nsProgressFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                  PostDestroyData& aPostDestroyData) {
   NS_ASSERTION(!GetPrevContinuation(),
                "nsProgressFrame should not have continuations; if it does we "
                "need to call RegUnregAccessKey only for the first.");
-  aContext.AddAnonymousContent(mBarDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mBarDiv.forget());
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsresult nsProgressFrame::CreateAnonymousContent(

layout/forms/nsProgressFrame.h

@@ -28,7 +28,8 @@ class nsProgressFrame final : public nsContainerFrame,
   explicit nsProgressFrame(ComputedStyle* aStyle, nsPresContext* aPresContext);
   virtual ~nsProgressFrame();
 
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   virtual void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                                 const nsDisplayListSet& aLists) override;

layout/forms/nsRangeFrame.cpp

@@ -69,7 +69,8 @@ NS_QUERYFRAME_HEAD(nsRangeFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
 NS_QUERYFRAME_TAIL_INHERITING(nsContainerFrame)
 
-void nsRangeFrame::Destroy(DestroyContext& aContext) {
+void nsRangeFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                               PostDestroyData& aPostDestroyData) {
   NS_ASSERTION(!GetPrevContinuation() && !GetNextContinuation(),
                "nsRangeFrame should not have continuations; if it does we "
                "need to call RegUnregAccessKey only for the first.");
@@ -77,10 +78,10 @@ void nsRangeFrame::Destroy(DestroyContext& aContext) {
   if (mListMutationObserver) {
     mListMutationObserver->Detach();
   }
-  aContext.AddAnonymousContent(mTrackDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mTrackDiv.forget());
-  aContext.AddAnonymousContent(mProgressDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mProgressDiv.forget());
-  aContext.AddAnonymousContent(mThumbDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mThumbDiv.forget());
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsresult nsRangeFrame::MakeAnonymousDiv(Element** aResult,

layout/forms/nsRangeFrame.h

@@ -48,7 +48,8 @@ class nsRangeFrame final : public nsContainerFrame,
   NS_DECL_FRAMEARENA_HELPERS(nsRangeFrame)
 
   // nsIFrame overrides
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                         const nsDisplayListSet& aLists) override;

layout/forms/nsSearchControlFrame.cpp

@@ -39,9 +39,10 @@ nsSearchControlFrame::nsSearchControlFrame(ComputedStyle* aStyle,
                                            nsPresContext* aPresContext)
     : nsTextControlFrame(aStyle, aPresContext, kClassID) {}
 
-void nsSearchControlFrame::Destroy(DestroyContext& aContext) {
+void nsSearchControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  aContext.AddAnonymousContent(mClearButton.forget());
+                                       PostDestroyData& aPostDestroyData) {
-  nsTextControlFrame::Destroy(aContext);
+  aPostDestroyData.AddAnonymousContent(mClearButton.forget());
+  nsTextControlFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsresult nsSearchControlFrame::CreateAnonymousContent(

layout/forms/nsSearchControlFrame.h

@@ -40,7 +40,8 @@ class nsSearchControlFrame final : public nsTextControlFrame {
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS(nsSearchControlFrame)
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   // nsIAnonymousContentCreator
   nsresult CreateAnonymousContent(nsTArray<ContentInfo>& aElements) override;

layout/forms/nsTextControlFrame.cpp

@@ -126,7 +126,8 @@ nsIScrollableFrame* nsTextControlFrame::GetScrollTargetFrame() const {
   return do_QueryFrame(mRootNode->GetPrimaryFrame());
 }
 
-void nsTextControlFrame::Destroy(DestroyContext& aContext) {
+void nsTextControlFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                     PostDestroyData& aPostDestroyData) {
   RemoveProperty(TextControlInitializer());
 
   // Unbind the text editor state object from the frame.  The editor will live
@@ -165,12 +166,12 @@ void nsTextControlFrame::Destroy(DestroyContext& aContext) {
 
   // If we're a subclass like nsNumberControlFrame, then it owns the root of the
   // anonymous subtree where mRootNode is.
-  aContext.AddAnonymousContent(mRootNode.forget());
+  aPostDestroyData.AddAnonymousContent(mRootNode.forget());
-  aContext.AddAnonymousContent(mPlaceholderDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mPlaceholderDiv.forget());
-  aContext.AddAnonymousContent(mPreviewDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mPreviewDiv.forget());
-  aContext.AddAnonymousContent(mRevealButton.forget());
+  aPostDestroyData.AddAnonymousContent(mRevealButton.forget());
 
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 LogicalSize nsTextControlFrame::CalcIntrinsicSize(

layout/forms/nsTextControlFrame.h

@@ -49,14 +49,16 @@ class nsTextControlFrame : public nsContainerFrame,
   virtual ~nsTextControlFrame();
 
   /**
-   * Destroy() causes preparing to destroy editor and that may cause running
+   * DestroyFrom() causes preparing to destroy editor and that may cause
-   * selection listeners of spellchecker selection and document state listeners.
+   * running selection listeners of specllchecker selection and document
-   * Not sure whether the former does something or not, but nobody should run
+   * state listeners.  Not sure whether the former does something or not,
-   * content script.  The latter is currently only FinderHighlighter to clean up
+   * but nobody should run content script.  The latter is currently only
-   * its fields at destruction.  Thus, the latter won't run content script too.
+   * FinderHighlighter to clean up its fields at destruction.  Thus, the
-   * Therefore, this won't run unsafe script.
+   * latter won't run content script too.  Therefore, this won't run
+   * unsafe script.
    */
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY void Destroy(DestroyContext&) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void DestroyFrom(nsIFrame* aDestructRoot,
+                                               PostDestroyData&) override;
 
   nsIScrollableFrame* GetScrollTargetFrame() const override;
 

layout/generic/MiddleCroppingBlockFrame.cpp

@@ -210,9 +210,10 @@ void MiddleCroppingBlockFrame::AppendAnonymousContentTo(
   aContent.AppendElement(mTextNode);
 }
 
-void MiddleCroppingBlockFrame::Destroy(DestroyContext& aContext) {
+void MiddleCroppingBlockFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  aContext.AddAnonymousContent(mTextNode.forget());
+                                           PostDestroyData& aPostDestroyData) {
-  nsBlockFrame::Destroy(aContext);
+  aPostDestroyData.AddAnonymousContent(mTextNode.forget());
+  nsBlockFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 }  // namespace mozilla

layout/generic/MiddleCroppingBlockFrame.h

@@ -53,7 +53,8 @@ class MiddleCroppingBlockFrame : public nsBlockFrame,
    */
   void UpdateDisplayedValue(const nsAString& aValue, bool aIsCropped,
                             bool aNotify);
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   RefPtr<dom::Text> mTextNode;
   bool mCropped = false;

layout/generic/nsAbsoluteContainingBlock.cpp

@@ -396,8 +396,10 @@ bool nsAbsoluteContainingBlock::FrameDependsOnContainer(nsIFrame* f,
   return false;
 }
 
-void nsAbsoluteContainingBlock::DestroyFrames(DestroyContext& aContext) {
+void nsAbsoluteContainingBlock::DestroyFrames(
-  mAbsoluteFrames.DestroyFrames(aContext);
+    nsIFrame* aDelegatingFrame, nsIFrame* aDestructRoot,
+    PostDestroyData& aPostDestroyData) {
+  mAbsoluteFrames.DestroyFramesFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsAbsoluteContainingBlock::MarkSizeDependentFramesDirty() {

layout/generic/nsAbsoluteContainingBlock.h

@@ -95,8 +95,9 @@ class nsAbsoluteContainingBlock {
               const nsRect& aContainingBlock, AbsPosReflowFlags aFlags,
               mozilla::OverflowAreas* aOverflowAreas);
 
-  using DestroyContext = nsIFrame::DestroyContext;
+  using PostDestroyData = nsIFrame::PostDestroyData;
-  void DestroyFrames(DestroyContext&);
+  void DestroyFrames(nsIFrame* aDelegatingFrame, nsIFrame* aDestructRoot,
+                     PostDestroyData& aPostDestroyData);
 
   bool HasAbsoluteFrames() const { return mAbsoluteFrames.NotEmpty(); }
 

layout/generic/nsBlockFrame.cpp

@@ -472,39 +472,43 @@ void nsBlockFrame::AddSizeOfExcludingThisForTree(
   }
 }
 
-void nsBlockFrame::Destroy(DestroyContext& aContext) {
+void nsBlockFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                               PostDestroyData& aPostDestroyData) {
   ClearLineCursors();
-  DestroyAbsoluteFrames(aContext);
+  DestroyAbsoluteFrames(aDestructRoot, aPostDestroyData);
-  mFloats.DestroyFrames(aContext);
+  mFloats.DestroyFramesFrom(aDestructRoot, aPostDestroyData);
   nsPresContext* presContext = PresContext();
   mozilla::PresShell* presShell = presContext->PresShell();
-  nsLineBox::DeleteLineList(presContext, mLines, &mFrames, aContext);
+  nsLineBox::DeleteLineList(presContext, mLines, aDestructRoot, &mFrames,
+                            aPostDestroyData);
 
   if (HasPushedFloats()) {
-    SafelyDestroyFrameListProp(aContext, presShell, PushedFloatProperty());
+    SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
+                               PushedFloatProperty());
     RemoveStateBits(NS_BLOCK_HAS_PUSHED_FLOATS);
   }
 
   // destroy overflow lines now
   FrameLines* overflowLines = RemoveOverflowLines();
   if (overflowLines) {
-    nsLineBox::DeleteLineList(presContext, overflowLines->mLines,
+    nsLineBox::DeleteLineList(presContext, overflowLines->mLines, aDestructRoot,
-                              &overflowLines->mFrames, aContext);
+                              &overflowLines->mFrames, aPostDestroyData);
     delete overflowLines;
   }
 
   if (HasAnyStateBits(NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS)) {
-    SafelyDestroyFrameListProp(aContext, presShell,
+    SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
                                OverflowOutOfFlowsProperty());
     RemoveStateBits(NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS);
   }
 
   if (HasOutsideMarker()) {
-    SafelyDestroyFrameListProp(aContext, presShell, OutsideMarkerProperty());
+    SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
+                               OutsideMarkerProperty());
     RemoveStateBits(NS_BLOCK_FRAME_HAS_OUTSIDE_MARKER);
   }
 
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 /* virtual */
@@ -5852,10 +5856,9 @@ void nsBlockFrame::RemoveFrame(ChildListID aListID, nsIFrame* aOldFrame) {
   printf("\n");
 #endif
 
-  DestroyContext context(aOldFrame);
   if (aListID == FrameChildListID::Principal) {
     bool hasFloats = BlockHasAnyFloats(aOldFrame);
-    DoRemoveFrame(aOldFrame, REMOVE_FIXED_CONTINUATIONS, context);
+    DoRemoveFrame(aOldFrame, REMOVE_FIXED_CONTINUATIONS);
     if (hasFloats) {
       MarkSameFloatManagerLinesDirty(this);
     }
@@ -5871,10 +5874,10 @@ void nsBlockFrame::RemoveFrame(ChildListID aListID, nsIFrame* aOldFrame) {
       MarkSameFloatManagerLinesDirty(
           static_cast<nsBlockFrame*>(f->GetParent()));
     }
-    DoRemoveOutOfFlowFrame(aOldFrame, context);
+    DoRemoveOutOfFlowFrame(aOldFrame);
   } else if (FrameChildListID::NoReflowPrincipal == aListID) {
     // Skip the call to |FrameNeedsReflow| below by returning now.
-    DoRemoveFrame(aOldFrame, REMOVE_FIXED_CONTINUATIONS, context);
+    DoRemoveFrame(aOldFrame, REMOVE_FIXED_CONTINUATIONS);
     return;
   } else {
     MOZ_CRASH("unexpected child list");
@@ -6128,8 +6131,7 @@ void nsBlockFrame::RemoveFloat(nsIFrame* aFloat) {
   }
 }
 
-void nsBlockFrame::DoRemoveOutOfFlowFrame(nsIFrame* aFrame,
+void nsBlockFrame::DoRemoveOutOfFlowFrame(nsIFrame* aFrame) {
-                                          DestroyContext& aContext) {
   // The containing block is always the parent of aFrame.
   nsBlockFrame* block = (nsBlockFrame*)aFrame->GetParent();
 
@@ -6147,7 +6149,7 @@ void nsBlockFrame::DoRemoveOutOfFlowFrame(nsIFrame* aFrame,
     // Now remove aFrame from its child list and Destroy it.
     block->RemoveFloatFromFloatCache(aFrame);
     block->RemoveFloat(aFrame);
-    aFrame->Destroy(aContext);
+    aFrame->Destroy();
   }
 }
 
@@ -6429,8 +6431,9 @@ bool nsBlockInFlowLineIterator::FindValidLine() {
 // aDeletedFrame and remove aDeletedFrame from that line. But here we
 // start by locating aDeletedFrame and then scanning from that point
 // on looking for continuations.
-void nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, uint32_t aFlags,
+void nsBlockFrame::DoRemoveFrameInternal(nsIFrame* aDeletedFrame,
-                                 DestroyContext& aContext) {
+                                         uint32_t aFlags,
+                                         PostDestroyData& aPostDestroyData) {
   // Clear our line cursor, since our lines may change.
   ClearLineCursors();
 
@@ -6439,9 +6442,8 @@ void nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, uint32_t aFlags,
     if (!aDeletedFrame->GetPrevInFlow()) {
       NS_ASSERTION(aDeletedFrame->HasAnyStateBits(NS_FRAME_OUT_OF_FLOW),
                    "Expected out-of-flow frame");
-      DoRemoveOutOfFlowFrame(aDeletedFrame, aContext);
+      DoRemoveOutOfFlowFrame(aDeletedFrame);
     } else {
-      // FIXME(emilio): aContext is lost here, maybe it's not a big deal?
       nsContainerFrame::DeleteNextInFlowChild(aDeletedFrame,
                                               (aFlags & FRAMES_ARE_EMPTY) != 0);
     }
@@ -6557,7 +6559,7 @@ void nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, uint32_t aFlags,
       deletedNextContinuation = nullptr;
     }
 
-    aDeletedFrame->Destroy(aContext);
+    aDeletedFrame->DestroyFrom(aDeletedFrame, aPostDestroyData);
     aDeletedFrame = deletedNextContinuation;
 
     bool haveAdvancedToNextLine = false;
@@ -6664,7 +6666,7 @@ void nsBlockFrame::DoRemoveFrame(nsIFrame* aDeletedFrame, uint32_t aFlags,
   nsBlockFrame* nextBlock = do_QueryFrame(aDeletedFrame->GetParent());
   NS_ASSERTION(nextBlock, "Our child's continuation's parent is not a block?");
   uint32_t flags = (aFlags & REMOVE_FIXED_CONTINUATIONS);
-  nextBlock->DoRemoveFrame(aDeletedFrame, flags, aContext);
+  nextBlock->DoRemoveFrameInternal(aDeletedFrame, flags, aPostDestroyData);
 }
 
 static bool FindBlockLineFor(nsIFrame* aChild, nsLineList::iterator aBegin,
@@ -6778,9 +6780,7 @@ void nsBlockFrame::DeleteNextInFlowChild(nsIFrame* aNextInFlow,
       nsLayoutUtils::AssertTreeOnlyEmptyNextInFlows(aNextInFlow);
     }
 #endif
-    DestroyContext context(aNextInFlow);
+    DoRemoveFrame(aNextInFlow, aDeletingEmptyFrames ? FRAMES_ARE_EMPTY : 0);
-    DoRemoveFrame(aNextInFlow, aDeletingEmptyFrames ? FRAMES_ARE_EMPTY : 0,
-                  context);
   }
 }
 

layout/generic/nsBlockFrame.h

@@ -136,8 +136,8 @@ class nsBlockFrame : public nsContainerFrame {
       mozilla::WritingMode aWM, BaselineSharingGroup aBaselineGroup,
       BaselineExportContext aExportContext) const override;
   nscoord GetCaretBaseline() const override;
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
-
+                   PostDestroyData& aPostDestroyData) override;
   bool IsFloatContainingBlock() const override;
   void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                         const nsDisplayListSet& aLists) override;
@@ -551,14 +551,19 @@ class nsBlockFrame : public nsContainerFrame {
    * -- destroys all removed frames
    */
   enum { REMOVE_FIXED_CONTINUATIONS = 0x02, FRAMES_ARE_EMPTY = 0x04 };
-  void DoRemoveFrame(nsIFrame* aDeletedFrame, uint32_t aFlags, DestroyContext&);
+  void DoRemoveFrame(nsIFrame* aDeletedFrame, uint32_t aFlags) {
+    AutoPostDestroyData data(PresContext());
+    DoRemoveFrameInternal(aDeletedFrame, aFlags, data.mData);
+  }
 
   void ReparentFloats(nsIFrame* aFirstFrame, nsBlockFrame* aOldParent,
                       bool aReparentSiblings);
 
-  bool ComputeCustomOverflow(mozilla::OverflowAreas&) override;
+  virtual bool ComputeCustomOverflow(
+      mozilla::OverflowAreas& aOverflowAreas) override;
 
-  void UnionChildOverflow(mozilla::OverflowAreas&) override;
+  virtual void UnionChildOverflow(
+      mozilla::OverflowAreas& aOverflowAreas) override;
 
   /**
    * Load all of aFrame's floats into the float manager iff aFrame is not a
@@ -596,6 +601,10 @@ class nsBlockFrame : public nsContainerFrame {
   bool IsInLineClampContext() const;
 
  protected:
+  /** @see DoRemoveFrame */
+  void DoRemoveFrameInternal(nsIFrame* aDeletedFrame, uint32_t aFlags,
+                             PostDestroyData& data);
+
   /** grab overflow lines from this block's prevInFlow, and make them
    * part of this block's mLines list.
    * @return true if any lines were drained.
@@ -668,7 +677,7 @@ class nsBlockFrame : public nsContainerFrame {
                        bool aCollectFromSiblings);
 
   // Remove a float, abs, rel positioned frame from the appropriate block's list
-  static void DoRemoveOutOfFlowFrame(nsIFrame* aFrame, DestroyContext&);
+  static void DoRemoveOutOfFlowFrame(nsIFrame* aFrame);
 
   /** set up the conditions necessary for an resize reflow
    * the primary task is to mark the minimumly sufficient lines dirty.

layout/generic/nsCanvasFrame.cpp

@@ -203,18 +203,19 @@ void nsCanvasFrame::AppendAnonymousContentTo(nsTArray<nsIContent*>& aElements,
   }
 }
 
-void nsCanvasFrame::Destroy(DestroyContext& aContext) {
+void nsCanvasFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                PostDestroyData& aPostDestroyData) {
   nsIScrollableFrame* sf =
       PresContext()->GetPresShell()->GetRootScrollFrameAsScrollable();
   if (sf) {
     sf->RemoveScrollPositionListener(this);
   }
 
-  aContext.AddAnonymousContent(mCustomContentContainer.forget());
+  aPostDestroyData.AddAnonymousContent(mCustomContentContainer.forget());
   if (mTooltipContent) {
-    aContext.AddAnonymousContent(mTooltipContent.forget());
+    aPostDestroyData.AddAnonymousContent(mTooltipContent.forget());
   }
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsCanvasFrame::ScrollPositionWillChange(nscoord aX, nscoord aY) {

layout/generic/nsCanvasFrame.h

@@ -46,7 +46,8 @@ class nsCanvasFrame final : public nsContainerFrame,
 
   Element* GetDefaultTooltip() override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   void SetInitialChildList(ChildListID aListID,
                            nsFrameList&& aChildList) override;

layout/generic/nsContainerFrame.cpp

@@ -183,8 +183,7 @@ void nsContainerFrame::RemoveFrame(ChildListID aListID, nsIFrame* aOldFrame) {
     // We really MUST use StealFrame() and nothing else here.
     // @see nsInlineFrame::StealFrame for details.
     parent->StealFrame(continuation);
-    DestroyContext context(continuation);
+    continuation->Destroy();
-    continuation->Destroy(context);
     if (generateReflowCommand && parent != lastParent) {
       presShell->FrameNeedsReflow(parent, IntrinsicDirty::FrameAndAncestors,
                                   NS_FRAME_HAS_DIRTY_CHILDREN);
@@ -193,23 +192,25 @@ void nsContainerFrame::RemoveFrame(ChildListID aListID, nsIFrame* aOldFrame) {
   }
 }
 
-void nsContainerFrame::DestroyAbsoluteFrames(DestroyContext& aContext) {
+void nsContainerFrame::DestroyAbsoluteFrames(
+    nsIFrame* aDestructRoot, PostDestroyData& aPostDestroyData) {
   if (IsAbsoluteContainer()) {
-    GetAbsoluteContainingBlock()->DestroyFrames(aContext);
+    GetAbsoluteContainingBlock()->DestroyFrames(this, aDestructRoot,
+                                                aPostDestroyData);
     MarkAsNotAbsoluteContainingBlock();
   }
 }
 
 void nsContainerFrame::SafelyDestroyFrameListProp(
-    DestroyContext& aContext, mozilla::PresShell* aPresShell,
+    nsIFrame* aDestructRoot, PostDestroyData& aPostDestroyData,
-    FrameListPropertyDescriptor aProp) {
+    mozilla::PresShell* aPresShell, FrameListPropertyDescriptor aProp) {
   // Note that the last frame can be removed through another route and thus
   // delete the property -- that's why we fetch the property again before
   // removing each frame rather than fetching it once and iterating the list.
   while (nsFrameList* frameList = GetProperty(aProp)) {
     nsIFrame* frame = frameList->RemoveFirstChild();
     if (MOZ_LIKELY(frame)) {
-      frame->Destroy(aContext);
+      frame->DestroyFrom(aDestructRoot, aPostDestroyData);
     } else {
       Unused << TakeProperty(aProp);
       frameList->Delete(aPresShell);
@@ -218,16 +219,17 @@ void nsContainerFrame::SafelyDestroyFrameListProp(
   }
 }
 
-void nsContainerFrame::Destroy(DestroyContext& aContext) {
+void nsContainerFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                   PostDestroyData& aPostDestroyData) {
   // Prevent event dispatch during destruction.
   if (HasView()) {
     GetView()->SetFrame(nullptr);
   }
 
-  DestroyAbsoluteFrames(aContext);
+  DestroyAbsoluteFrames(aDestructRoot, aPostDestroyData);
 
   // Destroy frames on the principal child list.
-  mFrames.DestroyFrames(aContext);
+  mFrames.DestroyFramesFrom(aDestructRoot, aPostDestroyData);
 
   // If we have any IB split siblings, clear their references to us.
   if (HasAnyStateBits(NS_FRAME_PART_OF_IBSPLIT)) {
@@ -273,18 +275,19 @@ void nsContainerFrame::Destroy(DestroyContext& aContext) {
     nsPresContext* pc = PresContext();
     mozilla::PresShell* presShell = pc->PresShell();
     if (hasO) {
-      SafelyDestroyFrameListProp(aContext, presShell, OverflowProperty());
+      SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
+                                 OverflowProperty());
     }
 
     MOZ_ASSERT(
         IsFrameOfType(eCanContainOverflowContainers) || !(hasOC || hasEOC),
         "this type of frame shouldn't have overflow containers");
     if (hasOC) {
-      SafelyDestroyFrameListProp(aContext, presShell,
+      SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
                                  OverflowContainersProperty());
     }
     if (hasEOC) {
-      SafelyDestroyFrameListProp(aContext, presShell,
+      SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
                                  ExcessOverflowContainersProperty());
     }
 
@@ -292,11 +295,12 @@ void nsContainerFrame::Destroy(DestroyContext& aContext) {
                    StyleDisplay()->mTopLayer != StyleTopLayer::None,
                "only top layer frame may have backdrop");
     if (hasBackdrop) {
-      SafelyDestroyFrameListProp(aContext, presShell, BackdropProperty());
+      SafelyDestroyFrameListProp(aDestructRoot, aPostDestroyData, presShell,
+                                 BackdropProperty());
     }
   }
 
-  nsSplittableFrame::Destroy(aContext);
+  nsSplittableFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 /////////////////////////////////////////////////////////////////////////////
@@ -892,7 +896,8 @@ void nsContainerFrame::ReflowChild(
   // but only if the NoDeleteNextInFlowChild flag isn't set.
   if (!aStatus.IsInlineBreakBefore() && aStatus.IsFullyComplete() &&
       !(aFlags & ReflowChildFlags::NoDeleteNextInFlowChild)) {
-    if (nsIFrame* kidNextInFlow = aKidFrame->GetNextInFlow()) {
+    nsIFrame* kidNextInFlow = aKidFrame->GetNextInFlow();
+    if (kidNextInFlow) {
       // Remove all of the childs next-in-flows. Make sure that we ask
       // the right parent to do the removal (it's possible that the
       // parent is not this because we are executing pullup code)
@@ -931,7 +936,8 @@ void nsContainerFrame::ReflowChild(nsIFrame* aKidFrame,
   // but only if the NoDeleteNextInFlowChild flag isn't set.
   if (aStatus.IsFullyComplete() &&
       !(aFlags & ReflowChildFlags::NoDeleteNextInFlowChild)) {
-    if (nsIFrame* kidNextInFlow = aKidFrame->GetNextInFlow()) {
+    nsIFrame* kidNextInFlow = aKidFrame->GetNextInFlow();
+    if (kidNextInFlow) {
       // Remove all of the childs next-in-flows. Make sure that we ask
       // the right parent to do the removal (it's possible that the
       // parent is not this because we are executing pullup code)
@@ -1375,8 +1381,8 @@ void nsContainerFrame::DeleteNextInFlowChild(nsIFrame* aNextInFlow,
       frames.AppendElement(f);
     }
     for (nsIFrame* delFrame : Reversed(frames)) {
-      nsContainerFrame* parent = delFrame->GetParent();
+      delFrame->GetParent()->DeleteNextInFlowChild(delFrame,
-      parent->DeleteNextInFlowChild(delFrame, aDeletingEmptyFrames);
+                                                   aDeletingEmptyFrames);
     }
   }
 
@@ -1391,8 +1397,7 @@ void nsContainerFrame::DeleteNextInFlowChild(nsIFrame* aNextInFlow,
 
   // Delete the next-in-flow frame and its descendants. This will also
   // remove it from its next-in-flow/prev-in-flow chain.
-  DestroyContext context(aNextInFlow);
+  aNextInFlow->Destroy();
-  aNextInFlow->Destroy(context);
 
   MOZ_ASSERT(!prevInFlow->GetNextInFlow(), "non null next-in-flow");
 }

layout/generic/nsContainerFrame.h

@@ -46,19 +46,19 @@ class nsContainerFrame : public nsSplittableFrame {
   NS_DECL_QUERYFRAME
 
   // nsIFrame overrides
-  void Init(nsIContent* aContent, nsContainerFrame* aParent,
+  virtual void Init(nsIContent* aContent, nsContainerFrame* aParent,
                     nsIFrame* aPrevInFlow) override;
-  nsContainerFrame* GetContentInsertionFrame() override { return this; }
+  virtual nsContainerFrame* GetContentInsertionFrame() override { return this; }
 
-  const nsFrameList& GetChildList(ChildListID aList) const override;
+  virtual const nsFrameList& GetChildList(ChildListID aList) const override;
-  void GetChildLists(nsTArray<ChildList>* aLists) const override;
+  virtual void GetChildLists(nsTArray<ChildList>* aLists) const override;
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
+  virtual void ChildIsDirty(nsIFrame* aChild) override;
 
-  void ChildIsDirty(nsIFrame* aChild) override;
+  virtual FrameSearchResult PeekOffsetNoAmount(bool aForward,
-
-  FrameSearchResult PeekOffsetNoAmount(bool aForward,
                                                int32_t* aOffset) override;
-  FrameSearchResult PeekOffsetCharacter(
+  virtual FrameSearchResult PeekOffsetCharacter(
       bool aForward, int32_t* aOffset,
       PeekOffsetCharacterOptions aOptions =
           PeekOffsetCharacterOptions()) override;
@@ -523,7 +523,8 @@ class nsContainerFrame : public nsSplittableFrame {
    * Derived classes must do that too, if they destroy such frame lists.
    * See nsBlockFrame::DestroyFrom for an example.
    */
-  void DestroyAbsoluteFrames(DestroyContext&);
+  void DestroyAbsoluteFrames(nsIFrame* aDestructRoot,
+                             PostDestroyData& aPostDestroyData);
 
   /**
    * Helper for StealFrame.  Returns true if aChild was removed from its list.
@@ -851,7 +852,8 @@ class nsContainerFrame : public nsSplittableFrame {
    * frame then remove the property and delete the frame list.
    * Nothing happens if the property doesn't exist.
    */
-  void SafelyDestroyFrameListProp(DestroyContext&,
+  void SafelyDestroyFrameListProp(nsIFrame* aDestructRoot,
+                                  PostDestroyData& aPostDestroyData,
                                   mozilla::PresShell* aPresShell,
                                   FrameListPropertyDescriptor aProp);
 

layout/generic/nsFrameList.cpp

@@ -37,15 +37,17 @@ void nsFrameList::Delete(mozilla::PresShell* aPresShell) {
 
 void nsFrameList::DestroyFrames() {
   while (nsIFrame* frame = RemoveFirstChild()) {
-    FrameDestroyContext context(frame);
+    frame->Destroy();
-    frame->Destroy(context);
   }
   mLastChild = nullptr;
 }
 
-void nsFrameList::DestroyFrames(FrameDestroyContext& aContext) {
+void nsFrameList::DestroyFramesFrom(nsIFrame* aDestructRoot,
+                                    PostFrameDestroyData& aPostDestroyData) {
+  MOZ_ASSERT(aDestructRoot, "Missing destruct root");
+
   while (nsIFrame* frame = RemoveFirstChild()) {
-    frame->Destroy(aContext);
+    frame->DestroyFrom(aDestructRoot, aPostDestroyData);
   }
   mLastChild = nullptr;
 }
@@ -106,8 +108,7 @@ nsIFrame* nsFrameList::RemoveFirstChild() {
 void nsFrameList::DestroyFrame(nsIFrame* aFrame) {
   MOZ_ASSERT(aFrame, "null ptr");
   RemoveFrame(aFrame);
-  FrameDestroyContext context(aFrame);
+  aFrame->Destroy();
-  aFrame->Destroy(context);
 }
 
 nsFrameList::Slice nsFrameList::InsertFrames(nsContainerFrame* aParent,

layout/generic/nsFrameList.h

@@ -26,9 +26,6 @@ class nsIFrame;
 class nsPresContext;
 
 namespace mozilla {
-
-struct FrameDestroyContext;
-
 class PresShell;
 class FrameChildList;
 enum class FrameChildListID {
@@ -52,6 +49,17 @@ enum class FrameChildListID {
   NoReflowPrincipal,
 };
 
+// A helper class for nsIFrame::Destroy[From].  It's defined here because
+// nsFrameList needs it and we can't use nsIFrame here.
+struct PostFrameDestroyData {
+  PostFrameDestroyData(const PostFrameDestroyData&) = delete;
+  PostFrameDestroyData() = default;
+
+  AutoTArray<RefPtr<nsIContent>, 100> mAnonymousContent;
+  void AddAnonymousContent(already_AddRefed<nsIContent>&& aContent) {
+    mAnonymousContent.AppendElement(aContent);
+  }
+};
 }  // namespace mozilla
 
 // Uncomment this to enable expensive frame-list integrity checking
@@ -133,9 +141,10 @@ class nsFrameList {
 
   /**
    * For each frame in this list: remove it from the list then call
-   * Destroy() on it with the passed context as an argument.
+   * DestroyFrom(aDestructRoot, aPostDestroyData) on it.
    */
-  void DestroyFrames(mozilla::FrameDestroyContext&);
+  void DestroyFramesFrom(nsIFrame* aDestructRoot,
+                         mozilla::PostFrameDestroyData& aPostDestroyData);
 
   void Clear() { mFirstChild = mLastChild = nullptr; }
 

layout/generic/nsGfxScrollFrame.cpp

@@ -315,8 +315,9 @@ void nsHTMLScrollFrame::ScrollbarActivityStopped() const {
   }
 }
 
-void nsHTMLScrollFrame::Destroy(DestroyContext& aContext) {
+void nsHTMLScrollFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  DestroyAbsoluteFrames(aContext);
+                                    PostDestroyData& aPostDestroyData) {
+  DestroyAbsoluteFrames(aDestructRoot, aPostDestroyData);
   if (mIsRoot) {
     PresShell()->ResetVisualViewportOffset();
   }
@@ -329,10 +330,10 @@ void nsHTMLScrollFrame::Destroy(DestroyContext& aContext) {
   }
 
   // Unbind the content created in CreateAnonymousContent later...
-  aContext.AddAnonymousContent(mHScrollbarContent.forget());
+  aPostDestroyData.AddAnonymousContent(mHScrollbarContent.forget());
-  aContext.AddAnonymousContent(mVScrollbarContent.forget());
+  aPostDestroyData.AddAnonymousContent(mVScrollbarContent.forget());
-  aContext.AddAnonymousContent(mScrollCornerContent.forget());
+  aPostDestroyData.AddAnonymousContent(mScrollCornerContent.forget());
-  aContext.AddAnonymousContent(mResizerContent.forget());
+  aPostDestroyData.AddAnonymousContent(mResizerContent.forget());
 
   if (mPostedReflowCallback) {
     PresShell()->CancelReflowCallback(this);
@@ -361,7 +362,7 @@ void nsHTMLScrollFrame::Destroy(DestroyContext& aContext) {
   if (mScrollEndEvent) {
     mScrollEndEvent->Revoke();
   }
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsHTMLScrollFrame::SetInitialChildList(ChildListID aListID,

layout/generic/nsGfxScrollFrame.h

@@ -150,7 +150,7 @@ class nsHTMLScrollFrame : public nsContainerFrame,
 
   void DidSetComputedStyle(ComputedStyle* aOldComputedStyle) final;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData&) override;
 
   nsIScrollableFrame* GetScrollTargetFrame() const final {
     return const_cast<nsHTMLScrollFrame*>(this);

layout/generic/nsHTMLCanvasFrame.cpp

@@ -346,11 +346,12 @@ NS_QUERYFRAME_TAIL_INHERITING(nsContainerFrame)
 
 NS_IMPL_FRAMEARENA_HELPERS(nsHTMLCanvasFrame)
 
-void nsHTMLCanvasFrame::Destroy(DestroyContext& aContext) {
+void nsHTMLCanvasFrame::DestroyFrom(nsIFrame* aDestroyRoot,
+                                    PostDestroyData& aPostDestroyData) {
   if (IsPrimaryFrame()) {
     HTMLCanvasElement::FromNode(*mContent)->ResetPrintCallback();
   }
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestroyRoot, aPostDestroyData);
 }
 
 nsHTMLCanvasFrame::~nsHTMLCanvasFrame() = default;

layout/generic/nsHTMLCanvasFrame.h

@@ -43,7 +43,7 @@ class nsHTMLCanvasFrame final : public nsContainerFrame {
   virtual void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                                 const nsDisplayListSet& aLists) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame*, PostDestroyData&) override;
 
   bool UpdateWebRenderCanvasData(nsDisplayListBuilder* aBuilder,
                                  WebRenderCanvasData* aCanvasData);

layout/generic/nsIFrame.cpp

@@ -217,10 +217,11 @@ static void SetOrUpdateRectValuedProperty(
   }
 }
 
-FrameDestroyContext::~FrameDestroyContext() {
+/* static */
-  auto* ps = mPresContext->PresShell();
+void nsIFrame::DestroyAnonymousContent(
-  for (auto& content : mozilla::Reversed(mAnonymousContent)) {
+    nsPresContext* aPresContext, already_AddRefed<nsIContent>&& aContent) {
-    ps->NativeAnonymousContentRemoved(content);
+  if (nsCOMPtr<nsIContent> content = aContent) {
+    aPresContext->PresShell()->NativeAnonymousContentRemoved(content);
     content->UnbindFromTree();
   }
 }
@@ -763,12 +764,13 @@ void nsIFrame::InitPrimaryFrame() {
   HandleLastRememberedSize();
 }
 
-void nsIFrame::Destroy(DestroyContext& aContext) {
+void nsIFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) {
   NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
                "destroy called on frame while scripts not blocked");
   NS_ASSERTION(!GetNextSibling() && !GetPrevSibling(),
                "Frames should be removed before destruction.");
-  NS_ASSERTION(aContext.DestructRoot(), "Must specify destruct root");
+  NS_ASSERTION(aDestructRoot, "Must specify destruct root");
   MOZ_ASSERT(!HasAbsolutelyPositionedChildren());
   MOZ_ASSERT(!HasAnyStateBits(NS_FRAME_PART_OF_IBSPLIT),
              "NS_FRAME_PART_OF_IBSPLIT set on non-nsContainerFrame?");
@@ -794,10 +796,10 @@ void nsIFrame::Destroy(DestroyContext& aContext) {
   if (HasAnyStateBits(NS_FRAME_OUT_OF_FLOW)) {
     nsPlaceholderFrame* placeholder = GetPlaceholderFrame();
     NS_ASSERTION(
-        !placeholder || aContext.DestructRoot() != this,
+        !placeholder || (aDestructRoot != this),
         "Don't call Destroy() on OOFs, call Destroy() on the placeholder.");
     NS_ASSERTION(!placeholder || nsLayoutUtils::IsProperAncestorFrame(
-                                     aContext.DestructRoot(), placeholder),
+                                     aDestructRoot, placeholder),
                  "Placeholder relationship should have been torn down already; "
                  "this might mean we have a stray placeholder in the tree.");
     if (placeholder) {
@@ -867,7 +869,7 @@ void nsIFrame::Destroy(DestroyContext& aContext) {
     // aPostDestroyData to unbind it after frame destruction is done.
     if (HasAnyStateBits(NS_FRAME_GENERATED_CONTENT) &&
         mContent->IsRootOfNativeAnonymousSubtree()) {
-      aContext.AddAnonymousContent(mContent.forget());
+      aPostDestroyData.AddAnonymousContent(mContent.forget());
     }
   }
 

layout/generic/nsIFrame.h

@@ -493,37 +493,6 @@ static void ReleaseValue(T* aPropertyValue) {
 
 //----------------------------------------------------------------------
 
-namespace mozilla {
-
-// A simple class to group stuff that we need to keep around when tearing down
-// a frame tree.
-//
-// Native anonymous content created by the frames need to get unbound _after_
-// the frame has been destroyed, see bug 1400618.
-//
-// We destroy the anonymous content bottom-up (so, in reverse order), because
-// it's a bit simpler, though we generally don't have that much nested anonymous
-// content (except for scrollbars).
-struct MOZ_RAII FrameDestroyContext {
-  explicit FrameDestroyContext(nsIFrame* aRoot);
-
-  nsIFrame* DestructRoot() const { return mDestructRoot; }
-  void AddAnonymousContent(already_AddRefed<nsIContent>&& aContent) {
-    if (RefPtr<nsIContent> content = aContent) {
-      mAnonymousContent.AppendElement(std::move(content));
-    }
-  }
-
-  ~FrameDestroyContext();
-
- private:
-  nsIFrame* const mDestructRoot;
-  nsPresContext* const mPresContext;
-  AutoTArray<RefPtr<nsIContent>, 100> mAnonymousContent;
-};
-
-}  // namespace mozilla
-
 /**
  * A frame in the layout model. This interface is supported by all frame
  * objects.
@@ -662,7 +631,31 @@ class nsIFrame : public nsQueryFrame {
 
   void* operator new(size_t, mozilla::PresShell*) MOZ_MUST_OVERRIDE;
 
-  using DestroyContext = mozilla::FrameDestroyContext;
+  using PostDestroyData = mozilla::PostFrameDestroyData;
+  struct MOZ_RAII AutoPostDestroyData {
+    explicit AutoPostDestroyData(nsPresContext* aPresContext)
+        : mPresContext(aPresContext) {}
+    ~AutoPostDestroyData() {
+      for (auto& content : mozilla::Reversed(mData.mAnonymousContent)) {
+        nsIFrame::DestroyAnonymousContent(mPresContext, content.forget());
+      }
+    }
+    nsPresContext* mPresContext;
+    PostDestroyData mData;
+  };
+  /**
+   * Destroys this frame and each of its child frames (recursively calls
+   * Destroy() for each child). If this frame is a first-continuation, this
+   * also removes the frame from the primary frame map and clears undisplayed
+   * content for its content node.
+   * If the frame is a placeholder, it also ensures the out-of-flow frame's
+   * removal and destruction.
+   */
+  void Destroy() {
+    AutoPostDestroyData data(PresContext());
+    DestroyFrom(this, data.mData);
+    // Note that |this| is deleted at this point.
+  }
 
   /**
    * Flags for PeekOffsetCharacter, PeekOffsetNoAmount, PeekOffsetWord return
@@ -696,19 +689,32 @@ class nsIFrame : public nsQueryFrame {
         : mRespectClusters(true), mIgnoreUserStyleAll(false) {}
   };
 
-  virtual void Destroy(DestroyContext&);
-
  protected:
+  friend class nsBlockFrame;  // for access to DestroyFrom
+
   /**
    * Return true if the frame is part of a Selection.
    * Helper method to implement the public IsSelected() API.
    */
   virtual bool IsFrameSelected() const;
 
+  /**
+   * Implements Destroy(). Do not call this directly except from within a
+   * DestroyFrom() implementation.
+   *
+   * @note This will always be called, so it is not necessary to override
+   *       Destroy() in subclasses of nsFrame, just DestroyFrom().
+   *
+   * @param  aDestructRoot is the root of the subtree being destroyed
+   */
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData);
+  friend class nsFrameList;  // needed to pass aDestructRoot through to children
+  friend class nsLineBox;    // needed to pass aDestructRoot through to children
+  friend class nsContainerFrame;  // needed to pass aDestructRoot through to
+                                  // children
   template <class Source>
   friend class do_QueryFrameHelper;  // to read mClass
-  friend class nsBlockFrame;         // for GetCaretBaseline
-  friend class nsContainerFrame;     // for ReparentFrameViewTo
 
   virtual ~nsIFrame();
 
@@ -4894,6 +4900,9 @@ class nsIFrame : public nsQueryFrame {
   void HandleLastRememberedSize();
 
  protected:
+  static void DestroyAnonymousContent(nsPresContext* aPresContext,
+                                      already_AddRefed<nsIContent>&& aContent);
+
   /**
    * Reparent this frame's view if it has one.
    */
@@ -5615,13 +5624,4 @@ inline nsIFrame* nsFrameList::BackwardFrameTraversal::Prev(nsIFrame* aFrame) {
   return aFrame->GetNextSibling();
 }
 
-namespace mozilla {
-
-inline FrameDestroyContext::FrameDestroyContext(nsIFrame* aRoot)
-    : mDestructRoot(aRoot), mPresContext(aRoot->PresContext()) {
-  MOZ_ASSERT(mDestructRoot);
-}
-
-}  // namespace mozilla
-
 #endif /* nsIFrame_h___ */

layout/generic/nsImageFrame.cpp

@@ -485,7 +485,8 @@ void nsImageFrame::DisconnectMap() {
 #endif
 }
 
-void nsImageFrame::Destroy(DestroyContext& aContext) {
+void nsImageFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                               PostDestroyData& aPostDestroyData) {
   MaybeSendIntrinsicSizeAndRatioToEmbedder(Nothing(), Nothing());
 
   if (mReflowCallbackPosted) {
@@ -523,7 +524,7 @@ void nsImageFrame::Destroy(DestroyContext& aContext) {
     BrokenImageIcon::RemoveObserver(this);
   }
 
-  nsAtomicContainerFrame::Destroy(aContext);
+  nsAtomicContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsImageFrame::DeinitOwnedRequest() {

layout/generic/nsImageFrame.h

@@ -70,7 +70,7 @@ class nsImageFrame : public nsAtomicContainerFrame, public nsIReflowCallback {
   NS_DECL_FRAMEARENA_HELPERS(nsImageFrame)
   NS_DECL_QUERYFRAME
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot, PostDestroyData&) override;
   void DidSetComputedStyle(ComputedStyle* aOldStyle) final;
 
   void Init(nsIContent* aContent, nsContainerFrame* aParent,

layout/generic/nsInlineFrame.cpp

@@ -166,7 +166,8 @@ nsIFrame::FrameSearchResult nsInlineFrame::PeekOffsetCharacter(
   return CONTINUE;
 }
 
-void nsInlineFrame::Destroy(DestroyContext& aContext) {
+void nsInlineFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                PostDestroyData& aPostDestroyData) {
   nsFrameList* overflowFrames = GetOverflowFrames();
   if (overflowFrames) {
     // Fixup the parent pointers for any child frames on the OverflowList.
@@ -174,7 +175,7 @@ void nsInlineFrame::Destroy(DestroyContext& aContext) {
     // container (an ancestor).
     overflowFrames->ApplySetParent(this);
   }
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsInlineFrame::StealFrame(nsIFrame* aChild) {

layout/generic/nsInlineFrame.h

@@ -68,8 +68,8 @@ class nsInlineFrame : public nsContainerFrame {
       PeekOffsetCharacterOptions aOptions =
           PeekOffsetCharacterOptions()) override;
 
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
-
+                           PostDestroyData& aPostDestroyData) override;
   void StealFrame(nsIFrame* aChild) override;
 
   // nsIHTMLReflow overrides

layout/generic/nsLineBox.cpp

@@ -348,7 +348,8 @@ bool nsLineBox::CachedIsEmpty() {
 }
 
 void nsLineBox::DeleteLineList(nsPresContext* aPresContext, nsLineList& aLines,
-                               nsFrameList* aFrames, DestroyContext& aContext) {
+                               nsIFrame* aDestructRoot, nsFrameList* aFrames,
+                               PostDestroyData& aPostDestroyData) {
   PresShell* presShell = aPresContext->PresShell();
 
   // Keep our line list and frame list up to date as we
@@ -365,7 +366,7 @@ void nsLineBox::DeleteLineList(nsPresContext* aPresContext, nsLineList& aLines,
       MOZ_DIAGNOSTIC_ASSERT(child == line->mFirstChild, "Lines out of sync");
       line->mFirstChild = aFrames->FirstChild();
       line->NoteFrameRemoved(child);
-      child->Destroy(aContext);
+      child->DestroyFrom(aDestructRoot, aPostDestroyData);
     }
     MOZ_DIAGNOSTIC_ASSERT(line == aLines.front(),
                           "destroying child frames messed up our lines!");

layout/generic/nsLineBox.h

@@ -396,9 +396,10 @@ class nsLineBox final : public nsLineLink {
     mBounds.BSize(mWritingMode) = 0;
   }
 
-  using DestroyContext = nsIFrame::DestroyContext;
+  using PostDestroyData = nsIFrame::PostDestroyData;
   static void DeleteLineList(nsPresContext* aPresContext, nsLineList& aLines,
-                             nsFrameList* aFrames, DestroyContext&);
+                             nsIFrame* aDestructRoot, nsFrameList* aFrames,
+                             PostDestroyData& aPostDestroyData);
 
   // search from end to beginning of [aBegin, aEnd)
   // Returns true if it found the line and false if not.

layout/generic/nsPlaceholderFrame.cpp

@@ -146,18 +146,19 @@ static FrameChildListID ChildListIDForOutOfFlow(nsFrameState aPlaceholderState,
   return FrameChildListID::Float;
 }
 
-void nsPlaceholderFrame::Destroy(DestroyContext& aContext) {
+void nsPlaceholderFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                     PostDestroyData& aPostDestroyData) {
   nsIFrame* oof = mOutOfFlowFrame;
   if (oof) {
     mOutOfFlowFrame = nullptr;
     oof->RemoveProperty(nsIFrame::PlaceholderFrameProperty());
 
-    // If the destruct root is not an ancestor of the out-of-flow frame, then
+    // If aDestructRoot is not an ancestor of the out-of-flow frame,
-    // call RemoveFrame on it here.
+    // then call RemoveFrame on it here.
     // Also destroy it here if it's a popup frame. (Bug 96291)
     // FIXME(emilio): Is the popup special-case still needed?
     if (oof->IsMenuPopupFrame() ||
-        !nsLayoutUtils::IsProperAncestorFrame(aContext.DestructRoot(), oof)) {
+        !nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, oof)) {
       ChildListID listId = ChildListIDForOutOfFlow(GetStateBits(), oof);
       nsFrameManager* fm = PresContext()->FrameConstructor();
       fm->RemoveFrame(listId, oof);
@@ -165,7 +166,7 @@ void nsPlaceholderFrame::Destroy(DestroyContext& aContext) {
     // else oof will be destroyed by its parent
   }
 
-  nsIFrame::Destroy(aContext);
+  nsIFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 /* virtual */

layout/generic/nsPlaceholderFrame.h

@@ -102,7 +102,8 @@ class nsPlaceholderFrame final : public nsIFrame {
               const ReflowInput& aReflowInput,
               nsReflowStatus& aStatus) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
 #if defined(DEBUG) || (defined(MOZ_REFLOW_PERF_DSP) && defined(MOZ_REFLOW_PERF))
   void BuildDisplayList(nsDisplayListBuilder* aBuilder,

layout/generic/nsRubyFrame.cpp

@@ -260,7 +260,8 @@ void nsRubyFrame::ReflowSegment(nsPresContext* aPresContext,
     // line layout is not aware of the ruby text containers, hence
     // it is necessary to remove them here.
     for (uint32_t i = 0; i < rtcCount; i++) {
-      if (nsIFrame* nextRTC = textContainers[i]->GetNextInFlow()) {
+      nsIFrame* nextRTC = textContainers[i]->GetNextInFlow();
+      if (nextRTC) {
         nextRTC->GetParent()->DeleteNextInFlowChild(nextRTC, true);
       }
     }

layout/generic/nsSplittableFrame.cpp

@@ -26,14 +26,15 @@ void nsSplittableFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   nsIFrame::Init(aContent, aParent, aPrevInFlow);
 }
 
-void nsSplittableFrame::Destroy(DestroyContext& aContext) {
+void nsSplittableFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                    PostDestroyData& aPostDestroyData) {
   // Disconnect from the flow list
   if (mPrevContinuation || mNextContinuation) {
     RemoveFromFlow(this);
   }
 
   // Let the base class destroy the frame
-  nsIFrame::Destroy(aContext);
+  nsIFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsIFrame* nsSplittableFrame::GetPrevContinuation() const {

layout/generic/nsSplittableFrame.h

@@ -23,7 +23,8 @@ class nsSplittableFrame : public nsIFrame {
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   /*
    * Frame continuations can be either fluid or non-fluid.

layout/generic/nsSubDocumentFrame.cpp

@@ -937,7 +937,8 @@ class nsHideViewer : public Runnable {
 
 static nsView* BeginSwapDocShellsForViews(nsView* aSibling);
 
-void nsSubDocumentFrame::Destroy(DestroyContext& aContext) {
+void nsSubDocumentFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                     PostDestroyData& aPostDestroyData) {
   PropagateIsUnderHiddenEmbedderElementToSubView(true);
   if (mPostedReflowCallback) {
     PresShell()->CancelReflowCallback(this);
@@ -970,7 +971,7 @@ void nsSubDocumentFrame::Destroy(DestroyContext& aContext) {
     }
   }
 
-  nsAtomicContainerFrame::Destroy(aContext);
+  nsAtomicContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsFrameLoader* nsSubDocumentFrame::FrameLoader() const {

layout/generic/nsSubDocumentFrame.h

@@ -53,7 +53,8 @@ class nsSubDocumentFrame final : public nsAtomicContainerFrame,
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   nscoord GetMinISize(gfxContext* aRenderingContext) override;
   nscoord GetPrefISize(gfxContext* aRenderingContext) override;

layout/generic/nsTextFrame.cpp

@@ -3868,7 +3868,8 @@ void nsTextFrame::ClearFrameOffsetCache() {
   }
 }
 
-void nsTextFrame::Destroy(DestroyContext& aContext) {
+void nsTextFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                              PostDestroyData& aPostDestroyData) {
   ClearFrameOffsetCache();
 
   // We might want to clear NS_CREATE_FRAME_IF_NON_WHITESPACE or
@@ -3879,7 +3880,7 @@ void nsTextFrame::Destroy(DestroyContext& aContext) {
     mNextContinuation->SetPrevInFlow(nullptr);
   }
   // Let the base class destroy the frame
-  nsIFrame::Destroy(aContext);
+  nsIFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsTArray<nsTextFrame*>* nsTextFrame::GetContinuations() {
@@ -3921,7 +3922,8 @@ class nsContinuingTextFrame final : public nsTextFrame {
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) final;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) final;
 
   nsTextFrame* GetPrevContinuation() const final { return mPrevContinuation; }
 
@@ -4087,7 +4089,8 @@ void nsContinuingTextFrame::Init(nsIContent* aContent,
   }  // prev frame is bidi
 }
 
-void nsContinuingTextFrame::Destroy(DestroyContext& aContext) {
+void nsContinuingTextFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                        PostDestroyData& aPostDestroyData) {
   ClearFrameOffsetCache();
 
   // The text associated with this frame will become associated with our
@@ -4110,7 +4113,7 @@ void nsContinuingTextFrame::Destroy(DestroyContext& aContext) {
   }
   nsSplittableFrame::RemoveFromFlow(this);
   // Let the base class destroy the frame
-  nsIFrame::Destroy(aContext);
+  nsIFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsIFrame* nsContinuingTextFrame::FirstInFlow() const {
@@ -8893,8 +8896,7 @@ static void RemoveEmptyInFlows(nsTextFrame* aFrame,
     // Manually call DoRemoveFrame so we can tell it that we're
     // removing empty frames; this will keep it from blowing away
     // text runs.
-    nsIFrame::DestroyContext context(aFrame);
+    parentBlock->DoRemoveFrame(aFrame, nsBlockFrame::FRAMES_ARE_EMPTY);
-    parentBlock->DoRemoveFrame(aFrame, nsBlockFrame::FRAMES_ARE_EMPTY, context);
   } else {
     // Just remove it normally; use FrameChildListID::NoReflowPrincipal to avoid
     // posting new reflows.

layout/generic/nsTextFrame.h

@@ -222,7 +222,8 @@ class nsTextFrame : public nsIFrame {
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   mozilla::Maybe<Cursor> GetCursor(const nsPoint&) final;
 

layout/generic/nsVideoFrame.cpp

@@ -147,13 +147,14 @@ nsIContent* nsVideoFrame::GetVideoControls() const {
   return mContent->GetShadowRoot()->GetFirstChild();
 }
 
-void nsVideoFrame::Destroy(DestroyContext& aContext) {
+void nsVideoFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                               PostDestroyData& aPostDestroyData) {
   if (mReflowCallbackPosted) {
     PresShell()->CancelReflowCallback(this);
   }
-  aContext.AddAnonymousContent(mCaptionDiv.forget());
+  aPostDestroyData.AddAnonymousContent(mCaptionDiv.forget());
-  aContext.AddAnonymousContent(mPosterImage.forget());
+  aPostDestroyData.AddAnonymousContent(mPosterImage.forget());
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 class DispatchResizeEvent : public Runnable {

layout/generic/nsVideoFrame.h

@@ -58,7 +58,8 @@ class nsVideoFrame final : public nsContainerFrame,
       mozilla::ComputeSizeFlags aFlags) override;
   nscoord GetMinISize(gfxContext* aRenderingContext) override;
   nscoord GetPrefISize(gfxContext* aRenderingContext) override;
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   void Reflow(nsPresContext* aPresContext, ReflowOutput& aDesiredSize,
               const ReflowInput& aReflowInput,

layout/mathml/nsMathMLmunderoverFrame.cpp

@@ -75,11 +75,12 @@ nsMathMLmunderoverFrame::InheritAutomaticData(nsIFrame* aParent) {
   return NS_OK;
 }
 
-void nsMathMLmunderoverFrame::Destroy(DestroyContext& aContext) {
+void nsMathMLmunderoverFrame::DestroyFrom(nsIFrame* aDestroyRoot,
+                                          PostDestroyData& aPostDestroyData) {
   if (!mPostReflowIncrementScriptLevelCommands.IsEmpty()) {
     PresShell()->CancelReflowCallback(this);
   }
-  nsMathMLContainerFrame::Destroy(aContext);
+  nsMathMLContainerFrame::DestroyFrom(aDestroyRoot, aPostDestroyData);
 }
 
 uint8_t nsMathMLmunderoverFrame::ScriptIncrement(nsIFrame* aFrame) {

layout/mathml/nsMathMLmunderoverFrame.h

@@ -37,7 +37,7 @@ class nsMathMLmunderoverFrame final : public nsMathMLContainerFrame,
   NS_IMETHOD UpdatePresentationData(uint32_t aFlagsValues,
                                     uint32_t aFlagsToUpdate) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aRoot, PostDestroyData& aPostDestroyData) override;
 
   nsresult AttributeChanged(int32_t aNameSpaceID, nsAtom* aAttribute,
                             int32_t aModType) override;

layout/svg/SVGFEImageFrame.cpp

@@ -42,7 +42,8 @@ class SVGFEImageFrame final : public nsIFrame {
 
   virtual void Init(nsIContent* aContent, nsContainerFrame* aParent,
                     nsIFrame* aPrevInFlow) override;
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   bool IsFrameOfType(uint32_t aFlags) const override {
     if (aFlags & eSupportsContainLayoutAndPaint) {
@@ -84,7 +85,8 @@ namespace mozilla {
 NS_IMPL_FRAMEARENA_HELPERS(SVGFEImageFrame)
 
 /* virtual */
-void SVGFEImageFrame::Destroy(DestroyContext& aContext) {
+void SVGFEImageFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                  PostDestroyData& aPostDestroyData) {
   DecApproximateVisibleCount();
 
   nsCOMPtr<nsIImageLoadingContent> imageLoader =
@@ -93,7 +95,7 @@ void SVGFEImageFrame::Destroy(DestroyContext& aContext) {
     imageLoader->FrameDestroyed(this);
   }
 
-  nsIFrame::Destroy(aContext);
+  nsIFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void SVGFEImageFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,

layout/svg/SVGImageFrame.cpp

@@ -121,7 +121,8 @@ void SVGImageFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
 }
 
 /* virtual */
-void SVGImageFrame::Destroy(DestroyContext& aContext) {
+void SVGImageFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                PostDestroyData& aPostDestroyData) {
   if (HasAnyStateBits(NS_FRAME_IS_NONDISPLAY)) {
     DecApproximateVisibleCount();
   }
@@ -138,7 +139,7 @@ void SVGImageFrame::Destroy(DestroyContext& aContext) {
     imageLoader->FrameDestroyed(this);
   }
 
-  nsIFrame::Destroy(aContext);
+  nsIFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 /* virtual */

layout/svg/SVGImageFrame.h

@@ -89,8 +89,8 @@ class SVGImageFrame final : public nsIFrame,
 
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
-
+                   PostDestroyData& aPostDestroyData) override;
   void DidSetComputedStyle(ComputedStyle* aOldStyle) final;
 
   bool IsSVGTransformed(Matrix* aOwnTransforms = nullptr,

layout/svg/SVGOuterSVGFrame.cpp

@@ -774,14 +774,15 @@ void SVGOuterSVGFrame::DidSetComputedStyle(ComputedStyle* aOldComputedStyle) {
   }
 }
 
-void SVGOuterSVGFrame::Destroy(DestroyContext& aContext) {
+void SVGOuterSVGFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                   PostDestroyData& aPostDestroyData) {
   // This handles both the case when the root <svg> element is made display:none
   // (and thus loses its intrinsic size and aspect ratio), and when the frame
   // is navigated elsewhere & we need to reset parent <object>/<embed>'s
   // recorded intrinsic size/ratio values.
   MaybeSendIntrinsicSizeAndRatioToEmbedder(Nothing(), Nothing());
 
-  SVGDisplayContainerFrame::Destroy(aContext);
+  SVGDisplayContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 }  // namespace mozilla

layout/svg/SVGOuterSVGFrame.h

@@ -88,7 +88,8 @@ class SVGOuterSVGFrame final : public SVGDisplayContainerFrame,
 
   void DidSetComputedStyle(ComputedStyle* aOldComputedStyle) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   nsresult AttributeChanged(int32_t aNameSpaceID, nsAtom* aAttribute,
                             int32_t aModType) override;

layout/tables/nsTableCellFrame.cpp

@@ -81,10 +81,10 @@ void nsTableCellFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   }
 }
 
-void nsTableCellFrame::Destroy(DestroyContext& aContext) {
+void nsTableCellFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  nsTableFrame::MaybeUnregisterPositionedTablePart(this,
+                                   PostDestroyData& aPostDestroyData) {
-                                                   aContext.DestructRoot());
+  nsTableFrame::MaybeUnregisterPositionedTablePart(this, aDestructRoot);
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 // nsIPercentBSizeObserver methods

layout/tables/nsTableCellFrame.h

@@ -66,7 +66,8 @@ class nsTableCellFrame : public nsContainerFrame,
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
 #ifdef ACCESSIBILITY
   mozilla::a11y::AccType AccessibleType() override;

layout/tables/nsTableFrame.cpp

@@ -210,9 +210,10 @@ void nsTableFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
 // the header only has forward declarations of them.
 nsTableFrame::~nsTableFrame() = default;
 
-void nsTableFrame::Destroy(DestroyContext& aContext) {
+void nsTableFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  mColGroups.DestroyFrames(aContext);
+                               PostDestroyData& aPostDestroyData) {
-  nsContainerFrame::Destroy(aContext);
+  mColGroups.DestroyFramesFrom(aDestructRoot, aPostDestroyData);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 // Make sure any views are positioned properly

layout/tables/nsTableFrame.h

@@ -197,7 +197,8 @@ class nsTableFrame : public nsContainerFrame {
   void RowOrColSpanChanged(nsTableCellFrame* aCellFrame);
 
   /** @see nsIFrame::DestroyFrom */
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   /** @see nsIFrame::DidSetComputedStyle */
   virtual void DidSetComputedStyle(ComputedStyle* aOldComputedStyle) override;

layout/tables/nsTableRowFrame.cpp

@@ -154,10 +154,10 @@ void nsTableRowFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   }
 }
 
-void nsTableRowFrame::Destroy(DestroyContext& aContext) {
+void nsTableRowFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  nsTableFrame::MaybeUnregisterPositionedTablePart(this,
+                                  PostDestroyData& aPostDestroyData) {
-                                                   aContext.DestructRoot());
+  nsTableFrame::MaybeUnregisterPositionedTablePart(this, aDestructRoot);
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 /* virtual */

layout/tables/nsTableRowFrame.h

@@ -39,7 +39,8 @@ class nsTableRowFrame : public nsContainerFrame {
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   void DidSetComputedStyle(ComputedStyle* aOldComputedStyle) override;
 

layout/tables/nsTableRowGroupFrame.cpp

@@ -62,10 +62,10 @@ nsTableRowGroupFrame::nsTableRowGroupFrame(ComputedStyle* aStyle,
 
 nsTableRowGroupFrame::~nsTableRowGroupFrame() = default;
 
-void nsTableRowGroupFrame::Destroy(DestroyContext& aContext) {
+void nsTableRowGroupFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  nsTableFrame::MaybeUnregisterPositionedTablePart(this,
+                                       PostDestroyData& aPostDestroyData) {
-                                                   aContext.DestructRoot());
+  nsTableFrame::MaybeUnregisterPositionedTablePart(this, aDestructRoot);
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 NS_QUERYFRAME_HEAD(nsTableRowGroupFrame)

layout/tables/nsTableRowGroupFrame.h

@@ -57,7 +57,8 @@ class nsTableRowGroupFrame final : public nsContainerFrame,
     }
   }
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   /** @see nsIFrame::DidSetComputedStyle */
   void DidSetComputedStyle(ComputedStyle* aOldComputedStyle) override;

layout/tables/nsTableWrapperFrame.cpp

@@ -82,10 +82,11 @@ a11y::AccType nsTableWrapperFrame::AccessibleType() {
 }
 #endif
 
-void nsTableWrapperFrame::Destroy(DestroyContext& aContext) {
+void nsTableWrapperFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  DestroyAbsoluteFrames(aContext);
+                                      PostDestroyData& aPostDestroyData) {
-  mCaptionFrames.DestroyFrames(aContext);
+  DestroyAbsoluteFrames(aDestructRoot, aPostDestroyData);
-  nsContainerFrame::Destroy(aContext);
+  mCaptionFrames.DestroyFramesFrom(aDestructRoot, aPostDestroyData);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 const nsFrameList& nsTableWrapperFrame::GetChildList(

layout/tables/nsTableWrapperFrame.h

@@ -36,7 +36,8 @@ class nsTableWrapperFrame : public nsContainerFrame {
 
   // nsIFrame overrides - see there for a description
 
-  void Destroy(DestroyContext&) override;
+  virtual void DestroyFrom(nsIFrame* aDestructRoot,
+                           PostDestroyData& aPostDestroyData) override;
 
   virtual const nsFrameList& GetChildList(ChildListID aListID) const override;
   virtual void GetChildLists(nsTArray<ChildList>* aLists) const override;

layout/xul/nsMenuPopupFrame.cpp

@@ -2159,7 +2159,8 @@ void nsMenuPopupFrame::MoveToAttributePosition() {
       this, IntrinsicDirty::FrameAncestorsAndDescendants, NS_FRAME_IS_DIRTY);
 }
 
-void nsMenuPopupFrame::Destroy(DestroyContext& aContext) {
+void nsMenuPopupFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                   PostDestroyData& aPostDestroyData) {
   // XXX: Currently we don't fire popuphidden for these popups, that seems wrong
   // but alas, also pre-existing.
   HidePopup(/* aDeselectMenu = */ false, ePopupClosed,
@@ -2169,7 +2170,7 @@ void nsMenuPopupFrame::Destroy(DestroyContext& aContext) {
     pm->PopupDestroyed(this);
   }
 
-  nsBlockFrame::Destroy(aContext);
+  nsBlockFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsMargin nsMenuPopupFrame::GetMargin() const {

layout/xul/nsMenuPopupFrame.h

@@ -195,7 +195,8 @@ class nsMenuPopupFrame final : public nsBlockFrame {
                             int32_t aModType) override;
 
   // FIXME: This shouldn't run script (this can end up calling HidePopup).
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY void Destroy(DestroyContext&) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void DestroyFrom(
+      nsIFrame* aDestructRoot, PostDestroyData& aPostDestroyData) override;
 
   bool HasRemoteContent() const;
 

layout/xul/nsScrollbarButtonFrame.cpp

@@ -264,9 +264,10 @@ nsresult nsScrollbarButtonFrame::GetParentWithTag(nsAtom* toFind,
   return NS_OK;
 }
 
-void nsScrollbarButtonFrame::Destroy(DestroyContext& aContext) {
+void nsScrollbarButtonFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                         PostDestroyData& aPostDestroyData) {
   // Ensure our repeat service isn't going... it's possible that a scrollbar can
   // disappear out from under you while you're in the process of scrolling.
   StopRepeat();
-  SimpleXULLeafFrame::Destroy(aContext);
+  SimpleXULLeafFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }

layout/xul/nsScrollbarButtonFrame.h

@@ -32,7 +32,8 @@ class nsScrollbarButtonFrame final : public mozilla::SimpleXULLeafFrame {
       : mozilla::SimpleXULLeafFrame(aStyle, aPresContext, kClassID) {}
 
   // Overrides
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   friend nsIFrame* NS_NewScrollbarButtonFrame(mozilla::PresShell* aPresShell,
                                               ComputedStyle* aStyle);

layout/xul/nsScrollbarFrame.cpp

@@ -58,13 +58,14 @@ void nsScrollbarFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   AddStateBits(NS_FRAME_REFLOW_ROOT);
 }
 
-void nsScrollbarFrame::Destroy(DestroyContext& aContext) {
+void nsScrollbarFrame::DestroyFrom(nsIFrame* aDestructRoot,
-  aContext.AddAnonymousContent(mUpTopButton.forget());
+                                   PostDestroyData& aPostDestroyData) {
-  aContext.AddAnonymousContent(mDownTopButton.forget());
+  aPostDestroyData.AddAnonymousContent(mUpTopButton.forget());
-  aContext.AddAnonymousContent(mSlider.forget());
+  aPostDestroyData.AddAnonymousContent(mDownTopButton.forget());
-  aContext.AddAnonymousContent(mUpBottomButton.forget());
+  aPostDestroyData.AddAnonymousContent(mSlider.forget());
-  aContext.AddAnonymousContent(mDownBottomButton.forget());
+  aPostDestroyData.AddAnonymousContent(mUpBottomButton.forget());
-  nsContainerFrame::Destroy(aContext);
+  aPostDestroyData.AddAnonymousContent(mDownBottomButton.forget());
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsScrollbarFrame::Reflow(nsPresContext* aPresContext,

layout/xul/nsScrollbarFrame.h

@@ -83,7 +83,8 @@ class nsScrollbarFrame final : public nsContainerFrame,
   nsSize ScrollbarMinSize() const;
   bool IsHorizontal() const;
 
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;

layout/xul/nsSliderFrame.cpp

@@ -1437,7 +1437,8 @@ nsSliderFrame::HandleRelease(nsPresContext* aPresContext,
   return NS_OK;
 }
 
-void nsSliderFrame::Destroy(DestroyContext& aContext) {
+void nsSliderFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                PostDestroyData& aPostDestroyData) {
   // tell our mediator if we have one we are gone.
   if (mMediator) {
     mMediator->SetSlider(nullptr);
@@ -1446,7 +1447,7 @@ void nsSliderFrame::Destroy(DestroyContext& aContext) {
   StopRepeat();
 
   // call base class Destroy()
-  nsContainerFrame::Destroy(aContext);
+  nsContainerFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsSliderFrame::Notify() {

layout/xul/nsSliderFrame.h

@@ -73,7 +73,8 @@ class nsSliderFrame final : public nsContainerFrame {
               nsReflowStatus& aStatus) override;
 
   // nsIFrame overrides
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   void BuildDisplayList(nsDisplayListBuilder* aBuilder,
                         const nsDisplayListSet& aLists) override;

layout/xul/nsSplitterFrame.cpp

@@ -216,13 +216,14 @@ nsSplitterFrame::nsSplitterFrame(ComputedStyle* aStyle,
                                  nsPresContext* aPresContext)
     : SimpleXULLeafFrame(aStyle, aPresContext, kClassID) {}
 
-void nsSplitterFrame::Destroy(DestroyContext& aContext) {
+void nsSplitterFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                  PostDestroyData& aPostDestroyData) {
   if (mInner) {
     mInner->RemoveListener();
     mInner->Disconnect();
     mInner = nullptr;
   }
-  SimpleXULLeafFrame::Destroy(aContext);
+  SimpleXULLeafFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 nsresult nsSplitterFrame::AttributeChanged(int32_t aNameSpaceID,

layout/xul/nsSplitterFrame.h

@@ -29,7 +29,8 @@ class nsSplitterFrame final : public mozilla::SimpleXULLeafFrame {
   NS_DECL_FRAMEARENA_HELPERS(nsSplitterFrame)
 
   explicit nsSplitterFrame(ComputedStyle* aStyle, nsPresContext* aPresContext);
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
 #ifdef DEBUG_FRAME_DUMP
   nsresult GetFrameName(nsAString& aResult) const override {

layout/xul/tree/nsTreeBodyFrame.cpp

@@ -298,7 +298,8 @@ void nsTreeBodyFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   }
 }
 
-void nsTreeBodyFrame::Destroy(DestroyContext& aContext) {
+void nsTreeBodyFrame::DestroyFrom(nsIFrame* aDestructRoot,
+                                  PostDestroyData& aPostDestroyData) {
   if (mScrollbarActivity) {
     mScrollbarActivity->Destroy();
     mScrollbarActivity = nullptr;
@@ -333,7 +334,7 @@ void nsTreeBodyFrame::Destroy(DestroyContext& aContext) {
     mTree->BodyDestroyed(mTopRowIndex);
   }
 
-  SimpleXULLeafFrame::Destroy(aContext);
+  SimpleXULLeafFrame::DestroyFrom(aDestructRoot, aPostDestroyData);
 }
 
 void nsTreeBodyFrame::EnsureView() {

layout/xul/tree/nsTreeBodyFrame.h

@@ -157,7 +157,8 @@ class nsTreeBodyFrame final : public mozilla::SimpleXULLeafFrame,
   // Overridden from nsIFrame to cache our pres context.
   void Init(nsIContent* aContent, nsContainerFrame* aParent,
             nsIFrame* aPrevInFlow) override;
-  void Destroy(DestroyContext&) override;
+  void DestroyFrom(nsIFrame* aDestructRoot,
+                   PostDestroyData& aPostDestroyData) override;
 
   mozilla::Maybe<Cursor> GetCursor(const nsPoint&) override;