Bug 821960 - Implement tearoffs for remaining SVG types. r=jwatt

content/svg/content/src/SVGAnimatedPreserveAspectRatio.cpp

@@ -8,6 +8,7 @@
 #include "SVGAnimatedPreserveAspectRatio.h"
 #include "nsWhitespaceTokenizer.h"
 #include "nsSMILValue.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "SMILEnumType.h"
 #include "nsAttrValueInlines.h"
 
@@ -67,6 +68,13 @@ static const char *sAlignStrings[] =
 
 static const char *sMeetOrSliceStrings[] = { "meet", "slice" };
 
+static nsSVGAttrTearoffTable<SVGAnimatedPreserveAspectRatio, SVGAnimatedPreserveAspectRatio::DOMAnimPAspectRatio>
+  sSVGAnimatedPAspectRatioTearoffTable;
+static nsSVGAttrTearoffTable<SVGAnimatedPreserveAspectRatio, SVGAnimatedPreserveAspectRatio::DOMBaseVal>
+  sBaseSVGPAspectRatioTearoffTable;
+static nsSVGAttrTearoffTable<SVGAnimatedPreserveAspectRatio, SVGAnimatedPreserveAspectRatio::DOMAnimVal>
+  sAnimSVGPAspectRatioTearoffTable;
+
 static uint16_t
 GetAlignForString(const nsAString &aAlignString)
 {
@@ -130,27 +138,43 @@ SVGAnimatedPreserveAspectRatio::ToDOMBaseVal(
   nsIDOMSVGPreserveAspectRatio **aResult,
   nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMBaseVal(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMBaseVal> domBaseVal =
+    sBaseSVGPAspectRatioTearoffTable.GetTearoff(this);
+  if (!domBaseVal) {
+    domBaseVal = new DOMBaseVal(this, aSVGElement);
+    sBaseSVGPAspectRatioTearoffTable.AddTearoff(this, domBaseVal);
+  }
 
-  NS_ADDREF(*aResult);
+  domBaseVal.forget(aResult);
   return NS_OK;
 }
 
+SVGAnimatedPreserveAspectRatio::DOMBaseVal::~DOMBaseVal()
+{
+  sBaseSVGPAspectRatioTearoffTable.RemoveTearoff(mVal);
+}
+
 nsresult
 SVGAnimatedPreserveAspectRatio::ToDOMAnimVal(
   nsIDOMSVGPreserveAspectRatio **aResult,
   nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimVal(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimVal> domAnimVal =
+    sAnimSVGPAspectRatioTearoffTable.GetTearoff(this);
+  if (!domAnimVal) {
+    domAnimVal = new DOMAnimVal(this, aSVGElement);
+    sAnimSVGPAspectRatioTearoffTable.AddTearoff(this, domAnimVal);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimVal.forget(aResult);
   return NS_OK;
 }
 
+SVGAnimatedPreserveAspectRatio::DOMAnimVal::~DOMAnimVal()
+{
+  sAnimSVGPAspectRatioTearoffTable.RemoveTearoff(mVal);
+}
+
 static nsresult
 ToPreserveAspectRatio(const nsAString &aString,
                       SVGPreserveAspectRatio *aValue)
@@ -306,14 +330,21 @@ SVGAnimatedPreserveAspectRatio::ToDOMAnimatedPreserveAspectRatio(
   nsIDOMSVGAnimatedPreserveAspectRatio **aResult,
   nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimPAspectRatio(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aResult);
+  nsRefPtr<DOMAnimPAspectRatio> domAnimatedPAspectRatio =
+    sSVGAnimatedPAspectRatioTearoffTable.GetTearoff(this);
+  if (!domAnimatedPAspectRatio) {
+    domAnimatedPAspectRatio = new DOMAnimPAspectRatio(this, aSVGElement);
+    sSVGAnimatedPAspectRatioTearoffTable.AddTearoff(this, domAnimatedPAspectRatio);
+  }
+  domAnimatedPAspectRatio.forget(aResult);
   return NS_OK;
 }
 
+SVGAnimatedPreserveAspectRatio::DOMAnimPAspectRatio::~DOMAnimPAspectRatio()
+{
+  sSVGAnimatedPAspectRatioTearoffTable.RemoveTearoff(mVal);
+}
+
 nsISMILAttr*
 SVGAnimatedPreserveAspectRatio::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/SVGAnimatedPreserveAspectRatio.h

@@ -155,6 +155,7 @@ public:
 
     DOMBaseVal(SVGAnimatedPreserveAspectRatio* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMBaseVal();
     
     SVGAnimatedPreserveAspectRatio* mVal; // kept alive because it belongs to mSVGElement
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -177,6 +178,7 @@ public:
 
     DOMAnimVal(SVGAnimatedPreserveAspectRatio* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimVal();
     
     SVGAnimatedPreserveAspectRatio* mVal; // kept alive because it belongs to mSVGElement
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -210,6 +212,7 @@ public:
     DOMAnimPAspectRatio(SVGAnimatedPreserveAspectRatio* aVal,
                         nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimPAspectRatio();
 
     // kept alive because it belongs to content:
     SVGAnimatedPreserveAspectRatio* mVal;

content/svg/content/src/nsSVGAngle.cpp

@@ -8,6 +8,7 @@
 #include "nsSVGAngle.h"
 #include "prdtoa.h"
 #include "nsTextFormatter.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsSVGMarkerElement.h"
 #include "nsMathUtils.h"
 #include "nsContentUtils.h" // NS_ENSURE_FINITE
@@ -127,6 +128,13 @@ static nsIAtom** const unitMap[] =
   &nsGkAtoms::grad
 };
 
+static nsSVGAttrTearoffTable<nsSVGAngle, nsSVGAngle::DOMAnimatedAngle>
+  sSVGAnimatedAngleTearoffTable;
+static nsSVGAttrTearoffTable<nsSVGAngle, nsSVGAngle::DOMBaseVal>
+  sBaseSVGAngleTearoffTable;
+static nsSVGAttrTearoffTable<nsSVGAngle, nsSVGAngle::DOMAnimVal>
+  sAnimSVGAngleTearoffTable;
+
 /* Helper functions */
 
 static bool
@@ -309,25 +317,41 @@ nsSVGAngle::NewValueSpecifiedUnits(uint16_t unitType,
 nsresult
 nsSVGAngle::ToDOMBaseVal(nsIDOMSVGAngle **aResult, nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMBaseVal(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMBaseVal> domBaseVal =
+    sBaseSVGAngleTearoffTable.GetTearoff(this);
+  if (!domBaseVal) {
+    domBaseVal = new DOMBaseVal(this, aSVGElement);
+    sBaseSVGAngleTearoffTable.AddTearoff(this, domBaseVal);
+  }
 
-  NS_ADDREF(*aResult);
+  domBaseVal.forget(aResult);
   return NS_OK;
 }
 
+nsSVGAngle::DOMBaseVal::~DOMBaseVal()
+{
+  sBaseSVGAngleTearoffTable.RemoveTearoff(mVal);
+}
+
 nsresult
 nsSVGAngle::ToDOMAnimVal(nsIDOMSVGAngle **aResult, nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimVal(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimVal> domAnimVal =
+    sAnimSVGAngleTearoffTable.GetTearoff(this);
+  if (!domAnimVal) {
+    domAnimVal = new DOMAnimVal(this, aSVGElement);
+    sAnimSVGAngleTearoffTable.AddTearoff(this, domAnimVal);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimVal.forget(aResult);
   return NS_OK;
 }
 
+nsSVGAngle::DOMAnimVal::~DOMAnimVal()
+{
+  sAnimSVGAngleTearoffTable.RemoveTearoff(mVal);
+}
+
 /* Implementation */
 
 nsresult
@@ -418,14 +442,22 @@ nsresult
 nsSVGAngle::ToDOMAnimatedAngle(nsIDOMSVGAnimatedAngle **aResult,
                                nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedAngle(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimatedAngle> domAnimatedAngle =
+    sSVGAnimatedAngleTearoffTable.GetTearoff(this);
+  if (!domAnimatedAngle) {
+    domAnimatedAngle = new DOMAnimatedAngle(this, aSVGElement);
+    sSVGAnimatedAngleTearoffTable.AddTearoff(this, domAnimatedAngle);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedAngle.forget(aResult);
   return NS_OK;
 }
 
+nsSVGAngle::DOMAnimatedAngle::~DOMAnimatedAngle()
+{
+  sSVGAnimatedAngleTearoffTable.RemoveTearoff(mVal);
+}
+
 nsresult
 NS_NewDOMSVGAngle(nsIDOMSVGAngle** aResult)
 {

content/svg/content/src/nsSVGAngle.h

@@ -84,6 +84,7 @@ public:
 
     DOMBaseVal(nsSVGAngle* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMBaseVal();
     
     nsSVGAngle* mVal; // kept alive because it belongs to mSVGElement
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -123,6 +124,7 @@ public:
 
     DOMAnimVal(nsSVGAngle* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimVal();
     
     nsSVGAngle* mVal; // kept alive because it belongs to mSVGElement
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -160,6 +162,7 @@ public:
 
     DOMAnimatedAngle(nsSVGAngle* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedAngle();
     
     nsSVGAngle* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGBoolean.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsError.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsSVGBoolean.h"
 #include "nsSMILValue.h"
 #include "SMILBoolType.h"
@@ -25,6 +26,9 @@ NS_INTERFACE_MAP_END
 
 /* Implementation */
 
+static nsSVGAttrTearoffTable<nsSVGBoolean, nsSVGBoolean::DOMAnimatedBoolean>
+  sSVGAnimatedBooleanTearoffTable;
+
 static nsresult
 GetValueFromString(const nsAString &aValueAsString,
                    bool *aValue)
@@ -117,14 +121,22 @@ nsresult
 nsSVGBoolean::ToDOMAnimatedBoolean(nsIDOMSVGAnimatedBoolean **aResult,
                                    nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedBoolean(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimatedBoolean> domAnimatedBoolean =
+    sSVGAnimatedBooleanTearoffTable.GetTearoff(this);
+  if (!domAnimatedBoolean) {
+    domAnimatedBoolean = new DOMAnimatedBoolean(this, aSVGElement);
+    sSVGAnimatedBooleanTearoffTable.AddTearoff(this, domAnimatedBoolean);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedBoolean.forget(aResult);
   return NS_OK;
 }
 
+nsSVGBoolean::DOMAnimatedBoolean::~DOMAnimatedBoolean()
+{
+  sSVGAnimatedBooleanTearoffTable.RemoveTearoff(mVal);
+}
+
 nsISMILAttr*
 nsSVGBoolean::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGBoolean.h

@@ -59,6 +59,7 @@ public:
 
     DOMAnimatedBoolean(nsSVGBoolean* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedBoolean();
 
     nsSVGBoolean* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGEnum.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsError.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsSVGEnum.h"
 #include "nsIAtom.h"
 #include "nsSVGElement.h"
@@ -25,6 +26,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGEnum::DOMAnimatedEnum)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGAnimatedEnumeration)
 NS_INTERFACE_MAP_END
 
+static nsSVGAttrTearoffTable<nsSVGEnum, nsSVGEnum::DOMAnimatedEnum>
+  sSVGAnimatedEnumTearoffTable;
+
 nsSVGEnumMapping *
 nsSVGEnum::GetMapping(nsSVGElement *aSVGElement)
 {
@@ -122,14 +126,22 @@ nsresult
 nsSVGEnum::ToDOMAnimatedEnum(nsIDOMSVGAnimatedEnumeration **aResult,
                              nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedEnum(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimatedEnum> domAnimatedEnum =
+    sSVGAnimatedEnumTearoffTable.GetTearoff(this);
+  if (!domAnimatedEnum) {
+    domAnimatedEnum = new DOMAnimatedEnum(this, aSVGElement);
+    sSVGAnimatedEnumTearoffTable.AddTearoff(this, domAnimatedEnum);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedEnum.forget(aResult);
   return NS_OK;
 }
 
+nsSVGEnum::DOMAnimatedEnum::~DOMAnimatedEnum()
+{
+  sSVGAnimatedEnumTearoffTable.RemoveTearoff(mVal);
+}
+
 nsISMILAttr*
 nsSVGEnum::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGEnum.h

@@ -70,6 +70,7 @@ public:
 
     DOMAnimatedEnum(nsSVGEnum* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedEnum();
 
     nsSVGEnum *mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGInteger.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsError.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsSVGInteger.h"
 #include "nsSMILValue.h"
 #include "SMILIntegerType.h"
@@ -25,6 +26,9 @@ NS_INTERFACE_MAP_END
 
 /* Implementation */
 
+static nsSVGAttrTearoffTable<nsSVGInteger, nsSVGInteger::DOMAnimatedInteger>
+  sSVGAnimatedIntegerTearoffTable;
+
 static nsresult
 GetValueFromString(const nsAString &aValueAsString,
                    int32_t *aValue)
@@ -112,14 +116,22 @@ nsresult
 nsSVGInteger::ToDOMAnimatedInteger(nsIDOMSVGAnimatedInteger **aResult,
                                    nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedInteger(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimatedInteger> domAnimatedInteger =
+    sSVGAnimatedIntegerTearoffTable.GetTearoff(this);
+  if (!domAnimatedInteger) {
+    domAnimatedInteger = new DOMAnimatedInteger(this, aSVGElement);
+    sSVGAnimatedIntegerTearoffTable.AddTearoff(this, domAnimatedInteger);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedInteger.forget(aResult);
   return NS_OK;
 }
 
+nsSVGInteger::DOMAnimatedInteger::~DOMAnimatedInteger()
+{
+  sSVGAnimatedIntegerTearoffTable.RemoveTearoff(mVal);
+}
+
 nsISMILAttr*
 nsSVGInteger::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGInteger.h

@@ -69,6 +69,7 @@ public:
 
     DOMAnimatedInteger(nsSVGInteger* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedInteger();
 
     nsSVGInteger* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGIntegerPair.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsSVGIntegerPair.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsCharSeparatedTokenizer.h"
 #include "nsError.h"
 #include "nsMathUtils.h"
@@ -26,6 +27,11 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGIntegerPair::DOMAnimatedInteger)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGAnimatedInteger)
 NS_INTERFACE_MAP_END
 
+static nsSVGAttrTearoffTable<nsSVGIntegerPair, nsSVGIntegerPair::DOMAnimatedInteger>
+  sSVGFirstAnimatedIntegerTearoffTable;
+static nsSVGAttrTearoffTable<nsSVGIntegerPair, nsSVGIntegerPair::DOMAnimatedInteger>
+  sSVGSecondAnimatedIntegerTearoffTable;
+
 /* Implementation */
 
 static nsresult
@@ -167,11 +173,31 @@ nsSVGIntegerPair::ToDOMAnimatedInteger(nsIDOMSVGAnimatedInteger **aResult,
                                        PairIndex aIndex,
                                        nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedInteger(this, aIndex, aSVGElement);
-  NS_ADDREF(*aResult);
+  nsRefPtr<DOMAnimatedInteger> domAnimatedInteger =
+    aIndex == eFirst ? sSVGFirstAnimatedIntegerTearoffTable.GetTearoff(this) :
+                       sSVGSecondAnimatedIntegerTearoffTable.GetTearoff(this);
+  if (!domAnimatedInteger) {
+    domAnimatedInteger = new DOMAnimatedInteger(this, aIndex, aSVGElement);
+    if (aIndex == eFirst) {
+      sSVGFirstAnimatedIntegerTearoffTable.AddTearoff(this, domAnimatedInteger);
+    } else {
+      sSVGSecondAnimatedIntegerTearoffTable.AddTearoff(this, domAnimatedInteger);
+    }
+  }
+
+  domAnimatedInteger.forget(aResult);
   return NS_OK;
 }
 
+nsSVGIntegerPair::DOMAnimatedInteger::~DOMAnimatedInteger()
+{
+  if (mIndex == eFirst) {
+    sSVGFirstAnimatedIntegerTearoffTable.RemoveTearoff(mVal);
+  } else {
+    sSVGSecondAnimatedIntegerTearoffTable.RemoveTearoff(mVal);
+  }
+}
+
 nsISMILAttr*
 nsSVGIntegerPair::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGIntegerPair.h

@@ -76,6 +76,7 @@ public:
 
     DOMAnimatedInteger(nsSVGIntegerPair* aVal, PairIndex aIndex, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement), mIndex(aIndex) {}
+    virtual ~DOMAnimatedInteger();
 
     nsSVGIntegerPair* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGNumber2.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsError.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsSVGNumber2.h"
 #include "nsTextFormatter.h"
 #include "prdtoa.h"
@@ -57,6 +58,9 @@ NS_INTERFACE_MAP_END
 
 /* Implementation */
 
+static nsSVGAttrTearoffTable<nsSVGNumber2, nsSVGNumber2::DOMAnimatedNumber>
+  sSVGAnimatedNumberTearoffTable;
+
 static nsresult
 GetValueFromString(const nsAString &aValueAsString,
                    bool aPercentagesAllowed,
@@ -151,14 +155,22 @@ nsresult
 nsSVGNumber2::ToDOMAnimatedNumber(nsIDOMSVGAnimatedNumber **aResult,
                                   nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedNumber(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimatedNumber> domAnimatedNumber =
+    sSVGAnimatedNumberTearoffTable.GetTearoff(this);
+  if (!domAnimatedNumber) {
+    domAnimatedNumber = new DOMAnimatedNumber(this, aSVGElement);
+    sSVGAnimatedNumberTearoffTable.AddTearoff(this, domAnimatedNumber);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedNumber.forget(aResult);
   return NS_OK;
 }
 
+nsSVGNumber2::DOMAnimatedNumber::~DOMAnimatedNumber()
+{
+  sSVGAnimatedNumberTearoffTable.RemoveTearoff(mVal);
+}
+
 nsISMILAttr*
 nsSVGNumber2::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGNumber2.h

@@ -69,6 +69,7 @@ public:
 
     DOMAnimatedNumber(nsSVGNumber2* aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedNumber();
 
     nsSVGNumber2* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGNumberPair.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsSVGNumberPair.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsCharSeparatedTokenizer.h"
 #include "prdtoa.h"
 #include "nsError.h"
@@ -29,6 +30,11 @@ NS_INTERFACE_MAP_END
 
 /* Implementation */
 
+static nsSVGAttrTearoffTable<nsSVGNumberPair, nsSVGNumberPair::DOMAnimatedNumber>
+  sSVGFirstAnimatedNumberTearoffTable;
+static nsSVGAttrTearoffTable<nsSVGNumberPair, nsSVGNumberPair::DOMAnimatedNumber>
+  sSVGSecondAnimatedNumberTearoffTable;
+
 static nsresult
 ParseNumberOptionalNumber(const nsAString& aValue,
                           float aValues[2])
@@ -165,11 +171,31 @@ nsSVGNumberPair::ToDOMAnimatedNumber(nsIDOMSVGAnimatedNumber **aResult,
                                      PairIndex aIndex,
                                      nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedNumber(this, aIndex, aSVGElement);
-  NS_ADDREF(*aResult);
+  nsRefPtr<DOMAnimatedNumber> domAnimatedNumber =
+    aIndex == eFirst ? sSVGFirstAnimatedNumberTearoffTable.GetTearoff(this) :
+                       sSVGSecondAnimatedNumberTearoffTable.GetTearoff(this);
+  if (!domAnimatedNumber) {
+    domAnimatedNumber = new DOMAnimatedNumber(this, aIndex, aSVGElement);
+    if (aIndex == eFirst) {
+      sSVGFirstAnimatedNumberTearoffTable.AddTearoff(this, domAnimatedNumber);
+    } else {
+      sSVGSecondAnimatedNumberTearoffTable.AddTearoff(this, domAnimatedNumber);
+    }
+  }
+
+  domAnimatedNumber.forget(aResult);
   return NS_OK;
 }
 
+nsSVGNumberPair::DOMAnimatedNumber::~DOMAnimatedNumber()
+{
+  if (mIndex == eFirst) {
+    sSVGFirstAnimatedNumberTearoffTable.RemoveTearoff(mVal);
+  } else {
+    sSVGSecondAnimatedNumberTearoffTable.RemoveTearoff(mVal);
+  }
+}
+
 nsISMILAttr*
 nsSVGNumberPair::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGNumberPair.h

@@ -77,6 +77,7 @@ public:
 
     DOMAnimatedNumber(nsSVGNumberPair* aVal, PairIndex aIndex, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement), mIndex(aIndex) {}
+    virtual ~DOMAnimatedNumber();
 
     nsSVGNumberPair* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGString.cpp

@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsSVGString.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "nsSMILValue.h"
 #include "SMILStringType.h"
 
@@ -22,6 +23,9 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGString::DOMAnimatedString)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGAnimatedString)
 NS_INTERFACE_MAP_END
 
+static nsSVGAttrTearoffTable<nsSVGString, nsSVGString::DOMAnimatedString>
+  sSVGAnimatedStringTearoffTable;
+
 /* Implementation */
 
 void
@@ -72,14 +76,22 @@ nsresult
 nsSVGString::ToDOMAnimatedString(nsIDOMSVGAnimatedString **aResult,
                                  nsSVGElement *aSVGElement)
 {
-  *aResult = new DOMAnimatedString(this, aSVGElement);
-  if (!*aResult)
-    return NS_ERROR_OUT_OF_MEMORY;
+  nsRefPtr<DOMAnimatedString> domAnimatedString =
+    sSVGAnimatedStringTearoffTable.GetTearoff(this);
+  if (!domAnimatedString) {
+    domAnimatedString = new DOMAnimatedString(this, aSVGElement);
+    sSVGAnimatedStringTearoffTable.AddTearoff(this, domAnimatedString);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedString.forget(aResult);
   return NS_OK;
 }
 
+nsSVGString::DOMAnimatedString::~DOMAnimatedString()
+{
+  sSVGAnimatedStringTearoffTable.RemoveTearoff(mVal);
+}
+
 nsISMILAttr*
 nsSVGString::ToSMILAttr(nsSVGElement *aSVGElement)
 {

content/svg/content/src/nsSVGString.h

@@ -57,6 +57,7 @@ public:
 
     DOMAnimatedString(nsSVGString *aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedString();
 
     nsSVGString* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;

content/svg/content/src/nsSVGViewBox.cpp

@@ -9,6 +9,7 @@
 #include "nsCharSeparatedTokenizer.h"
 #include "nsMathUtils.h"
 #include "nsSMILValue.h"
+#include "nsSVGAttrTearoffTable.h"
 #include "SVGContentUtils.h"
 #include "SVGViewBoxSMILType.h"
 #include "nsAttrValueInlines.h"
@@ -65,6 +66,14 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsSVGViewBox::DOMAnimatedRect)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGAnimatedRect)
 NS_INTERFACE_MAP_END
 
+static nsSVGAttrTearoffTable<nsSVGViewBox, nsSVGViewBox::DOMAnimatedRect>
+  sSVGAnimatedRectTearoffTable;
+static nsSVGAttrTearoffTable<nsSVGViewBox, nsSVGViewBox::DOMBaseVal>
+  sBaseSVGViewBoxTearoffTable;
+static nsSVGAttrTearoffTable<nsSVGViewBox, nsSVGViewBox::DOMAnimVal>
+  sAnimSVGViewBoxTearoffTable;
+
+
 /* Implementation of nsSVGViewBox methods */
 
 void
@@ -187,33 +196,60 @@ nsresult
 nsSVGViewBox::ToDOMAnimatedRect(nsIDOMSVGAnimatedRect **aResult,
                                 nsSVGElement* aSVGElement)
 {
-  *aResult = new DOMAnimatedRect(this, aSVGElement);
-  NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
+  nsRefPtr<DOMAnimatedRect> domAnimatedRect =
+    sSVGAnimatedRectTearoffTable.GetTearoff(this);
+  if (!domAnimatedRect) {
+    domAnimatedRect = new DOMAnimatedRect(this, aSVGElement);
+    sSVGAnimatedRectTearoffTable.AddTearoff(this, domAnimatedRect);
+  }
 
-  NS_ADDREF(*aResult);
+  domAnimatedRect.forget(aResult);
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsSVGViewBox::DOMAnimatedRect::GetBaseVal(nsIDOMSVGRect **aResult)
+nsSVGViewBox::DOMAnimatedRect::~DOMAnimatedRect()
 {
-  *aResult = new nsSVGViewBox::DOMBaseVal(mVal, mSVGElement);
-  NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
+  sSVGAnimatedRectTearoffTable.RemoveTearoff(mVal);
+}
 
-  NS_ADDREF(*aResult);
+nsresult
+nsSVGViewBox::ToDOMBaseVal(nsIDOMSVGRect **aResult, nsSVGElement *aSVGElement)
+{
+  nsRefPtr<DOMBaseVal> domBaseVal =
+    sBaseSVGViewBoxTearoffTable.GetTearoff(this);
+  if (!domBaseVal) {
+    domBaseVal = new DOMBaseVal(this, aSVGElement);
+    sBaseSVGViewBoxTearoffTable.AddTearoff(this, domBaseVal);
+  }
+
+  domBaseVal.forget(aResult);
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsSVGViewBox::DOMAnimatedRect::GetAnimVal(nsIDOMSVGRect **aResult)
+nsSVGViewBox::DOMBaseVal::~DOMBaseVal()
 {
-  *aResult = new nsSVGViewBox::DOMAnimVal(mVal, mSVGElement);
-  NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
+  sBaseSVGViewBoxTearoffTable.RemoveTearoff(mVal);
+}
 
-  NS_ADDREF(*aResult);
+nsresult
+nsSVGViewBox::ToDOMAnimVal(nsIDOMSVGRect **aResult, nsSVGElement *aSVGElement)
+{
+  nsRefPtr<DOMAnimVal> domAnimVal =
+    sAnimSVGViewBoxTearoffTable.GetTearoff(this);
+  if (!domAnimVal) {
+    domAnimVal = new DOMAnimVal(this, aSVGElement);
+    sAnimSVGViewBoxTearoffTable.AddTearoff(this, domAnimVal);
+  }
+
+  domAnimVal.forget(aResult);
   return NS_OK;
 }
 
+nsSVGViewBox::DOMAnimVal::~DOMAnimVal()
+{
+  sAnimSVGViewBoxTearoffTable.RemoveTearoff(mVal);
+}
+
 NS_IMETHODIMP
 nsSVGViewBox::DOMBaseVal::SetX(float aX)
 {

content/svg/content/src/nsSVGViewBox.h

@@ -70,6 +70,8 @@ public:
 
   nsresult ToDOMAnimatedRect(nsIDOMSVGAnimatedRect **aResult,
                              nsSVGElement *aSVGElement);
+  nsresult ToDOMBaseVal(nsIDOMSVGRect **aResult, nsSVGElement* aSVGElement);
+  nsresult ToDOMAnimVal(nsIDOMSVGRect **aResult, nsSVGElement* aSVGElement);
   // Returns a new nsISMILAttr object that the caller must delete
   nsISMILAttr* ToSMILAttr(nsSVGElement* aSVGElement);
 
@@ -79,6 +81,7 @@ private:
   nsAutoPtr<nsSVGViewBoxRect> mAnimVal;
   bool mHasBaseVal;
 
+public:
   struct DOMBaseVal MOZ_FINAL : public nsIDOMSVGRect
   {
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
@@ -86,6 +89,7 @@ private:
 
     DOMBaseVal(nsSVGViewBox *aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMBaseVal();
 
     nsSVGViewBox* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -112,6 +116,7 @@ private:
 
     DOMAnimVal(nsSVGViewBox *aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimVal();
 
     nsSVGViewBox* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -153,7 +158,6 @@ private:
       { return NS_ERROR_DOM_NO_MODIFICATION_ALLOWED_ERR; }
   };
 
-public:
   struct DOMAnimatedRect MOZ_FINAL : public nsIDOMSVGAnimatedRect
   {
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
@@ -161,12 +165,16 @@ public:
 
     DOMAnimatedRect(nsSVGViewBox *aVal, nsSVGElement *aSVGElement)
       : mVal(aVal), mSVGElement(aSVGElement) {}
+    virtual ~DOMAnimatedRect();
 
     nsSVGViewBox* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;
 
-    NS_IMETHOD GetBaseVal(nsIDOMSVGRect **aResult);
-    NS_IMETHOD GetAnimVal(nsIDOMSVGRect **aResult);
+    NS_IMETHOD GetBaseVal(nsIDOMSVGRect **aBaseVal)
+      { return mVal->ToDOMBaseVal(aBaseVal, mSVGElement); }
+
+    NS_IMETHOD GetAnimVal(nsIDOMSVGRect **aAnimVal)
+      { return mVal->ToDOMAnimVal(aAnimVal, mSVGElement); }
   };
 
   struct SMILViewBox : public nsISMILAttr