Fixing bug 200058, standalone images and plugins leak (the whole document leaks), r=jst sr=bz

git-svn-id: svn://10.0.0.236/trunk@140662 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/html/document/src/nsImageDocument.cpp

@@ -119,8 +119,6 @@ protected:
 
   nsresult UpdateTitle();
 
-  nsRefPtr<nsMediaDocumentStreamListener>  mStreamListener;
-
   nsCOMPtr<nsIStringBundle>     mStringBundle;
   nsCOMPtr<nsIDOMElement>       mImageElement;
 
@@ -153,6 +151,8 @@ ImageListener::~ImageListener()
 NS_IMETHODIMP
 ImageListener::OnStartRequest(nsIRequest* request, nsISupports *ctxt)
 {
+  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+
   nsImageDocument *imgDoc = (nsImageDocument*)mDocument.get();
   nsCOMPtr<nsIChannel> channel = do_QueryInterface(request);
   if (!channel) {
@@ -172,6 +172,7 @@ NS_IMETHODIMP
 ImageListener::OnStopRequest(nsIRequest* request, nsISupports *ctxt,
                              nsresult status)
 {
+  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
   nsImageDocument *imgDoc = (nsImageDocument*)mDocument.get();
   imgDoc->UpdateTitle();
   
@@ -252,11 +253,11 @@ nsImageDocument::StartDocumentLoad(const char*         aCommand,
     return rv;
   }
 
-  mStreamListener = new ImageListener(this);
-  if (!mStreamListener)
-    return NS_ERROR_OUT_OF_MEMORY;
   NS_ASSERTION(aDocListener, "null aDocListener");
-  NS_ADDREF(*aDocListener = mStreamListener);
+  *aDocListener = new ImageListener(this);
+  if (!*aDocListener)
+    return NS_ERROR_OUT_OF_MEMORY;
+  NS_ADDREF(*aDocListener);
 
   return NS_OK;
 }

mozilla/content/html/document/src/nsMediaDocument.cpp

@@ -67,6 +67,8 @@ nsMediaDocumentStreamListener::SetStreamListener(nsIStreamListener *aListener)
 NS_IMETHODIMP
 nsMediaDocumentStreamListener::OnStartRequest(nsIRequest* request, nsISupports *ctxt)
 {
+  NS_ENSURE_TRUE(mDocument, NS_ERROR_FAILURE);
+
   mDocument->StartLayout();
 
   if (mNextStream) {
@@ -81,11 +83,15 @@ nsMediaDocumentStreamListener::OnStopRequest(nsIRequest* request,
                                              nsISupports *ctxt,
                                              nsresult status)
 {
+  nsresult rv = NS_OK;
   if (mNextStream) {
-    return mNextStream->OnStopRequest(request, ctxt, status);
+    rv = mNextStream->OnStopRequest(request, ctxt, status);
   }
 
-  return NS_OK;
+  // No more need for our document so clear our reference and prevent leaks
+  mDocument = nsnull;
+
+  return rv;
 }
 
 NS_IMETHODIMP

mozilla/content/html/document/src/nsPluginDocument.cpp

@@ -61,6 +61,8 @@ public:
                                PRBool              aReset = PR_TRUE,
                                nsIContentSink*     aSink = nsnull);
 
+  NS_IMETHOD SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject);
+
 protected:
   nsresult CreateSyntheticPluginDocument(nsACString &aMimeType);
 
@@ -92,6 +94,16 @@ NS_INTERFACE_MAP_BEGIN(nsPluginDocument)
 NS_INTERFACE_MAP_END_INHERITING(nsMediaDocument)
 
 
+NS_IMETHODIMP nsPluginDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject)
+{
+  if (!aScriptGlobalObject) {
+    mStreamListener = nsnull;
+  }
+
+  return nsMediaDocument::SetScriptGlobalObject(aScriptGlobalObject);
+}
+
+
 NS_IMETHODIMP
 nsPluginDocument::StartDocumentLoad(const char*         aCommand,
                                     nsIChannel*         aChannel,