Fix some nsFloatCache leaks. Bug 302438, r+sr=dbaron

git-svn-id: svn://10.0.0.236/trunk@182747 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/generic/nsBlockReflowState.cpp

@@ -638,6 +638,9 @@ nsBlockReflowState::AddFloat(nsLineLayout&       aLineLayout,
       // Record this float in the current-line list
       mCurrentLineFloats.Append(fc);
     }
+    else {
+      delete fc;
+    }
 
     // Restore coordinate system
     mSpaceManager->Translate(dx, dy);

mozilla/layout/generic/nsLineBox.cpp

@@ -472,6 +472,7 @@ nsLineBox::RemoveFloat(nsIFrame* aFrame)
       // Note: the placeholder is part of the line's child list
       // and will be removed later.
       mInlineData->mFloats.Remove(fc);
+      delete fc;
       MaybeFreeData();
       return PR_TRUE;
     }
@@ -845,6 +846,16 @@ nsLineIterator::GetNextSiblingOnLine(nsIFrame*& aFrame, PRInt32 aLineNumber)
 
 //----------------------------------------------------------------------
 
+MOZ_DECL_CTOR_COUNTER(nsFloatCacheList)
+
+#ifdef NS_BUILD_REFCNT_LOGGING
+nsFloatCacheList::nsFloatCacheList() :
+  mHead(nsnull)
+{
+  MOZ_COUNT_CTOR(nsFloatCacheList);
+}
+#endif
+
 nsFloatCacheList::~nsFloatCacheList()
 {
   nsFloatCache* fc = mHead;
@@ -854,6 +865,7 @@ nsFloatCacheList::~nsFloatCacheList()
     fc = next;
   }
   mHead = nsnull;
+  MOZ_COUNT_DTOR(nsFloatCacheList);
 }
 
 nsFloatCache*
@@ -874,9 +886,11 @@ nsFloatCacheList::Append(nsFloatCacheFreeList& aList)
 {
   nsFloatCache* tail = Tail();
   if (tail) {
+    NS_ASSERTION(!tail->mNext, "Bogus!");
     tail->mNext = aList.mHead;
   }
   else {
+    NS_ASSERTION(!mHead, "Bogus!");
     mHead = aList.mHead;
   }
   aList.mHead = nsnull;
@@ -912,13 +926,30 @@ nsFloatCacheList::Remove(nsFloatCache* aElement)
 
 //----------------------------------------------------------------------
 
+MOZ_DECL_CTOR_COUNTER(nsFloatCacheFreeList)
+
+#ifdef NS_BUILD_REFCNT_LOGGING
+nsFloatCacheFreeList::nsFloatCacheFreeList() :
+  mTail(nsnull)
+{
+  MOZ_COUNT_CTOR(nsFloatCacheFreeList);
+}
+
+nsFloatCacheFreeList::~nsFloatCacheFreeList()
+{
+  MOZ_COUNT_DTOR(nsFloatCacheFreeList);
+}
+#endif
+  
 void
 nsFloatCacheFreeList::Append(nsFloatCacheList& aList)
 {
   if (mTail) {
+    NS_ASSERTION(!mTail->mNext, "Bogus");
     mTail->mNext = aList.mHead;
   }
   else {
+    NS_ASSERTION(!mHead, "Bogus");
     mHead = aList.mHead;
   }
   mTail = aList.Tail();
@@ -947,12 +978,15 @@ nsFloatCacheFreeList::Alloc()
 void
 nsFloatCacheFreeList::Append(nsFloatCache* aFloat)
 {
+  NS_ASSERTION(!aFloat->mNext, "Bogus!");
   aFloat->mNext = nsnull;
   if (mTail) {
+    NS_ASSERTION(!mTail->mNext, "Bogus!");
     mTail->mNext = aFloat;
     mTail = aFloat;
   }
   else {
+    NS_ASSERTION(!mHead, "Bogus!");
     mHead = mTail = aFloat;
   }
 }

mozilla/layout/generic/nsLineBox.h

@@ -97,7 +97,11 @@ protected:
 
 class nsFloatCacheList {
 public:
+#ifdef NS_BUILD_REFCNT_LOGGING
+  nsFloatCacheList();
+#else
   nsFloatCacheList() : mHead(nsnull) { }
+#endif
   ~nsFloatCacheList();
 
   PRBool IsEmpty() const {
@@ -116,6 +120,8 @@ public:
 
   nsFloatCache* Find(nsIFrame* aOutOfFlowFrame);
 
+  // Remove a nsFloatCache from this list.  Deleting this nsFloatCache
+  // becomes the caller's responsibility.
   void Remove(nsFloatCache* aElement);
 
   void Append(nsFloatCacheFreeList& aList);
@@ -130,8 +136,13 @@ protected:
 
 class nsFloatCacheFreeList : public nsFloatCacheList {
 public:
+#ifdef NS_BUILD_REFCNT_LOGGING
+  nsFloatCacheFreeList();
+  ~nsFloatCacheFreeList();
+#else
   nsFloatCacheFreeList() : mTail(nsnull) { }
   ~nsFloatCacheFreeList() { }
+#endif
 
   // Steal away aList's nsFloatCache objects and put them on this
   // free-list.