Bug 1062832 - Make nsSVGFilterChainObserver participate in cycle collection. r=roc

layout/svg/nsSVGEffects.cpp

@@ -16,6 +16,7 @@
 #include "nsSVGMaskFrame.h"
 #include "nsIReflowCallback.h"
 #include "RestyleManager.h"
+#include "nsCycleCollectionParticipant.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -231,9 +232,24 @@ nsSVGRenderingObserverProperty::DoUpdate()
   }
 }
 
-NS_IMPL_ISUPPORTS_INHERITED(nsSVGFilterReference,
-                            nsSVGIDRenderingObserver,
-                            nsISVGFilterReference);
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsSVGFilterReference)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsSVGFilterReference)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsSVGFilterReference)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsSVGFilterReference)
+  tmp->mElement.Unlink();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsSVGFilterReference)
+  tmp->mElement.Traverse(&cb);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGFilterReference)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsSVGIDRenderingObserver)
+  NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
+  NS_INTERFACE_MAP_ENTRY(nsISVGFilterReference)
+NS_INTERFACE_MAP_END
 
 nsSVGFilterFrame *
 nsSVGFilterReference::GetFilterFrame()
@@ -252,7 +268,14 @@ nsSVGFilterReference::DoUpdate()
   }
 }
 
-NS_IMPL_ISUPPORTS(nsSVGFilterChainObserver, nsISupports)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsSVGFilterChainObserver)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsSVGFilterChainObserver)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGFilterChainObserver)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTION(nsSVGFilterChainObserver, mReferences)
 
 nsSVGFilterChainObserver::nsSVGFilterChainObserver(const nsTArray<nsStyleFilter>& aFilters,
                                                    nsIContent* aFilteredElement)

layout/svg/nsSVGEffects.h

@@ -21,6 +21,7 @@
 #include "nsSVGUtils.h"
 #include "nsTHashtable.h"
 #include "nsURIHashKey.h"
+#include "nsCycleCollectionParticipant.h"
 
 class nsIAtom;
 class nsIPresShell;
@@ -218,7 +219,8 @@ public:
   nsSVGFilterFrame *GetFilterFrame();
 
   // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsSVGFilterReference, nsSVGIDRenderingObserver)
 
   // nsISVGFilterReference
   virtual void Invalidate() MOZ_OVERRIDE { DoUpdate(); };
@@ -253,7 +255,8 @@ public:
   void Invalidate() { DoUpdate(); }
 
   // nsISupports
-  NS_DECL_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(nsSVGFilterChainObserver)
 
 protected:
   virtual ~nsSVGFilterChainObserver();
@@ -272,6 +275,8 @@ public:
     , mFrameReference(aFilteredFrame)
   {}
 
+  void DetachFromFrame() { mFrameReference.Detach(); }
+
 protected:
   virtual void DoUpdate() MOZ_OVERRIDE;
 
@@ -390,12 +395,24 @@ public:
     (static_cast<nsISupports*>(aPropertyValue))->Release();
   }
 
+  static void DestroyFilterProperty(void* aPropertyValue)
+  {
+    auto* prop = static_cast<nsSVGFilterProperty*>(aPropertyValue);
+
+    // nsSVGFilterProperty is cycle-collected, so dropping the last reference
+    // doesn't necessarily destroy it. We need to tell it that the frame
+    // has now become invalid.
+    prop->DetachFromFrame();
+
+    prop->Release();
+  }
+
   static void DestroyHashtable(void* aPropertyValue)
   {
     delete static_cast<URIObserverHashtable*> (aPropertyValue);
   }
 
-  NS_DECLARE_FRAME_PROPERTY(FilterProperty, DestroySupports)
+  NS_DECLARE_FRAME_PROPERTY(FilterProperty, DestroyFilterProperty)
   NS_DECLARE_FRAME_PROPERTY(MaskProperty, DestroySupports)
   NS_DECLARE_FRAME_PROPERTY(ClipPathProperty, DestroySupports)
   NS_DECLARE_FRAME_PROPERTY(MarkerBeginProperty, DestroySupports)