Bug 1421004 - Break the mDocument reference cycle at Destroy(). r=jwwang,smaug

We break the cycle reference between VideoDocument/Plugindocument and MediaDocumentStreamListener when the document be destroyed.

MozReview-Commit-ID: Aowla95zMgg

--HG--
extra : rebase_source : 89efc6c480ba97476926ba561d386803fbb14412

dom/html/MediaDocument.h

@@ -95,8 +95,13 @@ public:
 
   NS_DECL_NSISTREAMLISTENER
 
-  RefPtr<MediaDocument>      mDocument;
-  nsCOMPtr<nsIStreamListener>  mNextStream;
+  void DropDocumentRef()
+  {
+    mDocument = nullptr;
+  }
+
+  RefPtr<MediaDocument> mDocument;
+  nsCOMPtr<nsIStreamListener> mNextStream;
 };
 
 } // namespace dom

dom/html/PluginDocument.cpp

@@ -48,6 +48,14 @@ public:
 
   void StartLayout() { MediaDocument::StartLayout(); }
 
+  virtual void Destroy()
+  {
+    if (mStreamListener) {
+      mStreamListener->DropDocumentRef();
+    }
+    MediaDocument::Destroy();
+  }
+
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(PluginDocument, MediaDocument)
 protected:
   ~PluginDocument() override;

dom/html/VideoDocument.cpp

@@ -28,6 +28,14 @@ public:
                                      nsIContentSink*     aSink = nullptr);
   virtual void SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject);
 
+  virtual void Destroy()
+  {
+    if (mStreamListener) {
+      mStreamListener->DropDocumentRef();
+    }
+    MediaDocument::Destroy();
+  }
+
 protected:
 
   // Sets document <title> to reflect the file name and description.