ref counting, destruction fixes

git-svn-id: svn://10.0.0.236/trunk@7802 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/html/forms/src/nsForm.cpp

@@ -251,9 +251,10 @@ nsForm::~nsForm()
   int numChildren = GetFormControlCount();
   for (int i = 0; i < numChildren; i++) {
     nsIFormControl* child = GetFormControlAt(i);
-    RemoveFormControl(child, PR_FALSE);
-    child->SetFormManager(nsnull, PR_FALSE);
-    NS_RELEASE(child);
+    if (child) {
+      RemoveFormControl(child, PR_FALSE);
+      child->SetFormManager(nsnull, PR_FALSE);
+    }
   }
   if (nsnull != mAction) delete mAction;
   if (nsnull != mEncoding) delete mEncoding;
@@ -309,13 +310,9 @@ nsrefcnt nsForm::Release()
   PRBool externalRefsToChildren = PR_FALSE;  // are there refs to any children besides my ref
   for (int i = 0; i < numChildren; i++) {
     nsIFormControl* child = GetFormControlAt(i);
-    if (child) {
-      PRInt32 refCnt = child->GetRefCount();
-      NS_RELEASE(child);
-      if (refCnt > 1) {
-        externalRefsToChildren = PR_TRUE;
-        break;
-      }
+    if (child && (child->GetRefCount() > 1)) {
+      externalRefsToChildren = PR_TRUE;
+      break;
     }
   }
   if (!externalRefsToChildren && ((int)mRefCnt == numChildren)) {
@@ -335,8 +332,8 @@ nsForm::GetFormControlCount() const
 nsIFormControl* 
 nsForm::GetFormControlAt(PRInt32 aIndex) const 
 { 
+  // do not addref ctl
   nsIFormControl* ctl = (nsIFormControl*) mChildren.ElementAt(aIndex);
-  NS_IF_ADDREF(ctl);
   return ctl;
 }
 
@@ -983,7 +980,6 @@ void nsForm::Init(PRBool aReinit)
 	      }
       }
     }
-    NS_RELEASE(control);
   }
 
   // if there is only one text field, it can submit on "return" 
@@ -1190,7 +1186,6 @@ nsForm::NamedItem(const nsString& aName, nsIDOMElement** aReturn)
         }
         NS_RELEASE(content);
       }
-      NS_RELEASE(control);
     }
   }
   
@@ -1473,7 +1468,6 @@ nsFormElementList::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
     control = mForm->GetFormControlAt(aIndex);
     if (nsnull != control) {
       res = control->QueryInterface(kIDOMNodeIID, (void**)aReturn);
-      NS_RELEASE(control);
     }
     else {
       *aReturn = nsnull;
@@ -1510,7 +1504,6 @@ nsFormElementList::NamedItem(const nsString& aName, nsIDOMNode** aReturn)
         }
         NS_RELEASE(content);
       }
-      NS_RELEASE(control);
     }
   }
   

mozilla/layout/html/forms/src/nsInput.cpp

@@ -65,7 +65,7 @@ nsInput::~nsInput()
     delete mName;
   }
   if (nsnull != mValue) {
-    delete mName;
+    delete mValue;
   }
   if (nsnull != mFormMan) {
     // prevent mFormMan from decrementing its ref count on us
@@ -160,7 +160,7 @@ PRBool nsInput::IsSuccessful(nsIFormControl* aSubmitter) const
 nsrefcnt nsInput::Release()
 {
   --mRefCnt;
-	if (mRefCnt == 0) {
+	if (mRefCnt <= 0) {
     delete this;                                       
     return 0;                                          
   }
@@ -175,9 +175,7 @@ nsrefcnt nsInput::Release()
   } else {
     for (int i = 0; i < numSiblings; i++) {
       nsIFormControl* sibling = mFormMan->GetFormControlAt(i);
-      PRInt32 refCnt = sibling->GetRefCount();
-      NS_RELEASE(sibling);
-      if (refCnt > 1) {
+      if (sibling->GetRefCount() > 1) {
         externalRefs = PR_TRUE;
         break;
       }

mozilla/layout/html/forms/src/nsInputButton.cpp

@@ -158,9 +158,6 @@ nsInputButton::nsInputButton(nsIAtom* aTag, nsIFormManager* aManager,
 
 nsInputButton::~nsInputButton()
 {
-  if (nsnull != mValue) {
-    delete mValue;
-  }
 }
 
 PRBool nsInputButton::IsSuccessful(nsIFormControl* aSubmitter) const

mozilla/layout/html/forms/src/nsInputFrame.cpp

@@ -59,7 +59,7 @@ nsInputFrame::nsInputFrame(nsIContent* aContent, nsIFrame* aParentFrame)
 
 nsInputFrame::~nsInputFrame()
 {
-  printf("nsInputFrame::~nsInputFrame \n");
+  //printf("nsInputFrame::~nsInputFrame \n");
 }
 
 NS_METHOD nsInputFrame::SetRect(const nsRect& aRect)