From 1d10ec322f9d4383bb27121856185d5615252933 Mon Sep 17 00:00:00 2001
From: Markus Stange <mstange@themasta.com>
Date: Tue, 9 Sep 2014 17:14:46 +0200
Subject: [PATCH] Bug 1062832 - Make nsSVGFilterChainObserver participate in
 cycle collection. r=roc

---
 layout/svg/nsSVGEffects.cpp | 31 +++++++++++++++++++++++++++----
 layout/svg/nsSVGEffects.h   | 23 ++++++++++++++++++++---
 2 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/layout/svg/nsSVGEffects.cpp b/layout/svg/nsSVGEffects.cpp
index fe0ceee9ef99..0ed497a04dfb 100644
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -16,6 +16,7 @@
 #include "nsSVGMaskFrame.h"
 #include "nsIReflowCallback.h"
 #include "RestyleManager.h"
+#include "nsCycleCollectionParticipant.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -231,9 +232,24 @@ nsSVGRenderingObserverProperty::DoUpdate()
   }
 }
 
-NS_IMPL_ISUPPORTS_INHERITED(nsSVGFilterReference,
-                            nsSVGIDRenderingObserver,
-                            nsISVGFilterReference);
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsSVGFilterReference)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsSVGFilterReference)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsSVGFilterReference)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsSVGFilterReference)
+  tmp->mElement.Unlink();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsSVGFilterReference)
+  tmp->mElement.Traverse(&cb);
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGFilterReference)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsSVGIDRenderingObserver)
+  NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
+  NS_INTERFACE_MAP_ENTRY(nsISVGFilterReference)
+NS_INTERFACE_MAP_END
 
 nsSVGFilterFrame *
 nsSVGFilterReference::GetFilterFrame()
@@ -252,7 +268,14 @@ nsSVGFilterReference::DoUpdate()
   }
 }
 
-NS_IMPL_ISUPPORTS(nsSVGFilterChainObserver, nsISupports)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsSVGFilterChainObserver)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsSVGFilterChainObserver)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGFilterChainObserver)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTION(nsSVGFilterChainObserver, mReferences)
 
 nsSVGFilterChainObserver::nsSVGFilterChainObserver(const nsTArray<nsStyleFilter>& aFilters,
                                                    nsIContent* aFilteredElement)
diff --git a/layout/svg/nsSVGEffects.h b/layout/svg/nsSVGEffects.h
index 348c1d222c80..9c093ee0a2d0 100644
--- a/layout/svg/nsSVGEffects.h
+++ b/layout/svg/nsSVGEffects.h
@@ -21,6 +21,7 @@
 #include "nsSVGUtils.h"
 #include "nsTHashtable.h"
 #include "nsURIHashKey.h"
+#include "nsCycleCollectionParticipant.h"
 
 class nsIAtom;
 class nsIPresShell;
@@ -218,7 +219,8 @@ public:
   nsSVGFilterFrame *GetFilterFrame();
 
   // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsSVGFilterReference, nsSVGIDRenderingObserver)
 
   // nsISVGFilterReference
   virtual void Invalidate() MOZ_OVERRIDE { DoUpdate(); };
@@ -253,7 +255,8 @@ public:
   void Invalidate() { DoUpdate(); }
 
   // nsISupports
-  NS_DECL_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(nsSVGFilterChainObserver)
 
 protected:
   virtual ~nsSVGFilterChainObserver();
@@ -272,6 +275,8 @@ public:
     , mFrameReference(aFilteredFrame)
   {}
 
+  void DetachFromFrame() { mFrameReference.Detach(); }
+
 protected:
   virtual void DoUpdate() MOZ_OVERRIDE;
 
@@ -390,12 +395,24 @@ public:
     (static_cast<nsISupports*>(aPropertyValue))->Release();
   }
 
+  static void DestroyFilterProperty(void* aPropertyValue)
+  {
+    auto* prop = static_cast<nsSVGFilterProperty*>(aPropertyValue);
+
+    // nsSVGFilterProperty is cycle-collected, so dropping the last reference
+    // doesn't necessarily destroy it. We need to tell it that the frame
+    // has now become invalid.
+    prop->DetachFromFrame();
+
+    prop->Release();
+  }
+
   static void DestroyHashtable(void* aPropertyValue)
   {
     delete static_cast<URIObserverHashtable*> (aPropertyValue);
   }
 
-  NS_DECLARE_FRAME_PROPERTY(FilterProperty, DestroySupports)
+  NS_DECLARE_FRAME_PROPERTY(FilterProperty, DestroyFilterProperty)
   NS_DECLARE_FRAME_PROPERTY(MaskProperty, DestroySupports)
   NS_DECLARE_FRAME_PROPERTY(ClipPathProperty, DestroySupports)
   NS_DECLARE_FRAME_PROPERTY(MarkerBeginProperty, DestroySupports)