From 4d76e7570ed410c5630699f55ac3e8de858cb052 Mon Sep 17 00:00:00 2001
From: Keegan McAllister <kmcallister@mozilla.com>
Date: Fri, 19 Jul 2013 16:31:25 -0700
Subject: [PATCH] Bump layout data ref count in unsafe_set_layout_data

We need this or else we double-free the layout data box and crash.
---
 src/components/script/dom/node.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/components/script/dom/node.rs b/src/components/script/dom/node.rs
index e2716bfca83..53da705f9c5 100644
--- a/src/components/script/dom/node.rs
+++ b/src/components/script/dom/node.rs
@@ -223,6 +223,10 @@ impl<'self, View> AbstractNode<View> {
     /// Sets the layout data, unsafely casting the type as layout wishes. Only layout is allowed
     /// to call this. This is wildly unsafe and is therefore marked as such.
     pub unsafe fn unsafe_set_layout_data<T>(self, data: @mut T) {
+        // Don't decrement the refcount on data, since we're giving it to the
+        // base structure.
+        cast::forget(data);
+
         do self.with_mut_base |base| {
             base.layout_data = Some(transmute(data))
         }