Bug 349880 - Fix filter crash with nsSVGUtils::RemoveObserver. r=tor,sr=roc

layout/svg/base/src/nsSVGContainerFrame.cpp

@@ -122,6 +122,13 @@ nsSVGDisplayContainerFrame::InitSVG()
   return NS_OK;
 }
 
+void
+nsSVGDisplayContainerFrame::Destroy()
+{
+  nsSVGUtils::StyleEffects(this);
+  nsSVGContainerFrame::Destroy();
+}
+
 NS_IMETHODIMP
 nsSVGDisplayContainerFrame::InsertFrames(nsIAtom* aListName,
                                          nsIFrame* aPrevFrame,

layout/svg/base/src/nsSVGContainerFrame.h

@@ -97,6 +97,7 @@ private:
 
 public:
   // nsIFrame:
+  virtual void Destroy();
   NS_IMETHOD InsertFrames(nsIAtom*        aListName,
                           nsIFrame*       aPrevFrame,
                           nsIFrame*       aFrameList);

layout/svg/base/src/nsSVGForeignObjectFrame.cpp

@@ -97,6 +97,12 @@ NS_INTERFACE_MAP_END_INHERITING(nsSVGForeignObjectFrameBase)
 //----------------------------------------------------------------------
 // nsIFrame methods
 
+void nsSVGForeignObjectFrame::Destroy()
+{
+  nsSVGUtils::StyleEffects(this);
+  nsSVGForeignObjectFrameBase::Destroy();
+}
+
 nsIAtom *
 nsSVGForeignObjectFrame::GetType() const
 {

layout/svg/base/src/nsSVGForeignObjectFrame.h

@@ -68,6 +68,7 @@ private:
   NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }  
 public:
   // nsIFrame:  
+  virtual void Destroy();
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
                                nsIAtom*        aAttribute,
                                PRInt32         aModType);

layout/svg/base/src/nsSVGPathGeometryFrame.cpp

@@ -99,17 +99,6 @@ nsSVGPathGeometryFrame::nsSVGPathGeometryFrame(nsStyleContext* aContext)
 #endif
 }
 
-nsSVGPathGeometryFrame::~nsSVGPathGeometryFrame()
-{
-#ifdef DEBUG
-//  printf("~nsSVGPathGeometryFrame %p\n", this);
-#endif
-  
-  if (GetStateBits() & NS_STATE_SVG_HAS_MARKERS) {
-    DeleteProperty(nsGkAtoms::marker);
-  }
-}
-
 //----------------------------------------------------------------------
 // nsISupports methods
 
@@ -120,6 +109,13 @@ NS_INTERFACE_MAP_END_INHERITING(nsSVGPathGeometryFrameBase)
 //----------------------------------------------------------------------
 // nsIFrame methods
 
+void
+nsSVGPathGeometryFrame::Destroy()
+{
+  RemovePathProperties();
+  nsSVGPathGeometryFrameBase::Destroy();
+}
+
 NS_IMETHODIMP
 nsSVGPathGeometryFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                          nsIAtom*        aAttribute,
@@ -139,12 +135,7 @@ nsSVGPathGeometryFrame::DidSetStyleContext()
 {
   nsSVGPathGeometryFrameBase::DidSetStyleContext();
 
-  nsSVGUtils::StyleEffects(this);
-
-  if (GetStateBits() & NS_STATE_SVG_HAS_MARKERS) {
-    DeleteProperty(nsGkAtoms::marker);
-    RemoveStateBits(NS_STATE_SVG_HAS_MARKERS);
-  }
+  RemovePathProperties();
 
   // XXX: we'd like to use the style_hint mechanism and the
   // ContentStateChanged/AttributeChanged functions for style changes
@@ -253,6 +244,17 @@ nsSVGPathGeometryFrame::UpdateMarkerProperty()
   }
 }
 
+void
+nsSVGPathGeometryFrame::RemovePathProperties()
+{
+  nsSVGUtils::StyleEffects(this);
+
+  if (GetStateBits() & NS_STATE_SVG_HAS_MARKERS) {
+    DeleteProperty(nsGkAtoms::marker);
+    RemoveStateBits(NS_STATE_SVG_HAS_MARKERS);
+  }
+}
+
 //----------------------------------------------------------------------
 // nsISVGChildFrame methods
 

layout/svg/base/src/nsSVGPathGeometryFrame.h

@@ -64,7 +64,6 @@ class nsSVGPathGeometryFrame : public nsSVGPathGeometryFrameBase,
 {
 public:
   nsSVGPathGeometryFrame(nsStyleContext* aContext);
-  virtual ~nsSVGPathGeometryFrame();
 
    // nsISupports interface:
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
@@ -72,6 +71,7 @@ public:
   NS_IMETHOD_(nsrefcnt) Release() { return 1; }
 
   // nsIFrame interface:
+  virtual void Destroy();
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
                                nsIAtom*        aAttribute,
                                PRInt32         aModType);
@@ -151,6 +151,8 @@ private:
                           nsIURI              *aURI);
   void UpdateMarkerProperty();
 
+  void RemovePathProperties();
+
   nsCOMPtr<nsIDOMSVGMatrix> mOverrideCTM;
   PRPackedBool mPropagateTransform;
 };