From 6a35658a80f005a07700cb9ac07847445ce11ae4 Mon Sep 17 00:00:00 2001
From: "bechen@mozilla.com" <bechen@mozilla.com>
Date: Tue, 5 Dec 2017 15:32:12 +0800
Subject: [PATCH] Bug 1421004 - Break the mDocument reference cycle at
 Destroy(). r=jwwang,smaug

We break the cycle reference between VideoDocument/Plugindocument and MediaDocumentStreamListener when the document be destroyed.

MozReview-Commit-ID: Aowla95zMgg

--HG--
extra : rebase_source : 89efc6c480ba97476926ba561d386803fbb14412
---
 dom/html/MediaDocument.h    | 9 +++++++--
 dom/html/PluginDocument.cpp | 8 ++++++++
 dom/html/VideoDocument.cpp  | 8 ++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/dom/html/MediaDocument.h b/dom/html/MediaDocument.h
index 7ead0f57ffc9..78706e052c8f 100644
--- a/dom/html/MediaDocument.h
+++ b/dom/html/MediaDocument.h
@@ -95,8 +95,13 @@ public:
 
   NS_DECL_NSISTREAMLISTENER
 
-  RefPtr<MediaDocument>      mDocument;
-  nsCOMPtr<nsIStreamListener>  mNextStream;
+  void DropDocumentRef()
+  {
+    mDocument = nullptr;
+  }
+
+  RefPtr<MediaDocument> mDocument;
+  nsCOMPtr<nsIStreamListener> mNextStream;
 };
 
 } // namespace dom
diff --git a/dom/html/PluginDocument.cpp b/dom/html/PluginDocument.cpp
index 588ba58cc945..b72b69313187 100644
--- a/dom/html/PluginDocument.cpp
+++ b/dom/html/PluginDocument.cpp
@@ -48,6 +48,14 @@ public:
 
   void StartLayout() { MediaDocument::StartLayout(); }
 
+  virtual void Destroy()
+  {
+    if (mStreamListener) {
+      mStreamListener->DropDocumentRef();
+    }
+    MediaDocument::Destroy();
+  }
+
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(PluginDocument, MediaDocument)
 protected:
   ~PluginDocument() override;
diff --git a/dom/html/VideoDocument.cpp b/dom/html/VideoDocument.cpp
index 9ca616a5ec53..909f0c918531 100644
--- a/dom/html/VideoDocument.cpp
+++ b/dom/html/VideoDocument.cpp
@@ -28,6 +28,14 @@ public:
                                      nsIContentSink*     aSink = nullptr);
   virtual void SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject);
 
+  virtual void Destroy()
+  {
+    if (mStreamListener) {
+      mStreamListener->DropDocumentRef();
+    }
+    MediaDocument::Destroy();
+  }
+
 protected:
 
   // Sets document <title> to reflect the file name and description.