Fix leak on setting innerHTML in XML, as well as leaks when the parent of a

not-yet-parsed script is removed from the document.  Bug 294274, r+sr=peterv,
a=chofmann

content/html/document/src/nsHTMLContentSink.cpp

@@ -4096,7 +4096,11 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
         loader->SetEnabled(PR_FALSE);
       }
     }
-  } else {
+  } else if (parent->GetCurrentDoc() == mDocument) {
+    // We test the current doc of |parent| because if it doesn't have one we
+    // won't actually try to evaluate the script, so we shouldn't be blocking
+    // or appending to mScriptElements or anything.
+    
     // Don't include script loading and evaluation in the stopwatch
     // that is measuring content creation time
     MOZ_TIMER_DEBUGLOG(("Stop: nsHTMLContentSink::ProcessSCRIPTTag()\n"));

content/xml/document/src/nsXMLContentSink.cpp

@@ -468,7 +468,8 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
 
 
 nsresult
-nsXMLContentSink::CloseElement(nsIContent* aContent, PRBool* aAppendContent)
+nsXMLContentSink::CloseElement(nsIContent* aContent, nsIContent* aParent,
+                               PRBool* aAppendContent)
 {
   NS_ASSERTION(aContent, "missing element to close");
 
@@ -502,7 +503,7 @@ nsXMLContentSink::CloseElement(nsIContent* aContent, PRBool* aAppendContent)
       || nodeInfo->Equals(nsSVGAtoms::script, kNameSpaceID_SVG)
 #endif
     ) {
-    rv = ProcessEndSCRIPTTag(aContent);
+    rv = ProcessEndSCRIPTTag(aContent, aParent);
     *aAppendContent = PR_TRUE;
     return rv;
   }
@@ -981,14 +982,17 @@ nsXMLContentSink::HandleEndElement(const PRUnichar *aName)
                "Wrong element being closed");
 #endif  
 
-  result = CloseElement(content, &appendContent);
+  nsCOMPtr<nsIContent> parent = GetCurrentContent();
+  
+  result = CloseElement(content, parent, &appendContent);
   NS_ENSURE_SUCCESS(result, result);
 
   if (mDocElement == content) {
+    // XXXbz for roots that don't want to be appended on open, we
+    // probably need to deal here.... (and stop appending them on open).
     mState = eXMLContentSinkState_InEpilog;
   }
   else if (appendContent) {
-    nsCOMPtr<nsIContent> parent = GetCurrentContent();
     NS_ENSURE_TRUE(parent, NS_ERROR_UNEXPECTED);
 
     parent->AppendChildTo(content, PR_FALSE);
@@ -1354,21 +1358,24 @@ nsXMLContentSink::AddText(const PRUnichar* aText,
 }
 
 nsresult
-nsXMLContentSink::ProcessEndSCRIPTTag(nsIContent* aContent)
+nsXMLContentSink::ProcessEndSCRIPTTag(nsIContent* aContent,
+                                      nsIContent* aParent)
 {
   nsresult result = NS_OK;
 
+  mConstrainSize = PR_TRUE; 
   nsCOMPtr<nsIScriptElement> scriptElement(do_QueryInterface(aContent));
   NS_ASSERTION(scriptElement, "null script element in XML content sink");
-  mScriptElements.AppendObject(scriptElement);
 
   scriptElement->SetScriptLineNumber(mScriptLineNo);
 
-  mConstrainSize = PR_TRUE; 
-  // Assume that we're going to block the parser with a script load.
-  // If it's an inline script, we'll be told otherwise in the call
-  // to our ScriptAvailable method.
-  mNeedToBlockParser = PR_TRUE;
+  if (!aParent || aParent->GetCurrentDoc() == mDocument) {
+    // Assume that we're going to block the parser with a script load.
+    // If it's an inline script, we'll be told otherwise in the call
+    // to our ScriptAvailable method.
+    mScriptElements.AppendObject(scriptElement);
+    mNeedToBlockParser = PR_TRUE;
+  }
 
   return result;
 }

content/xml/document/src/nsXMLContentSink.h

@@ -97,7 +97,7 @@ protected:
 
   nsresult AddAttributes(const PRUnichar** aNode, nsIContent* aContent);
   nsresult AddText(const PRUnichar* aString, PRInt32 aLength);
-  nsresult ProcessEndSCRIPTTag(nsIContent* aContent);
+  nsresult ProcessEndSCRIPTTag(nsIContent* aContent, nsIContent* aParent);
 
   virtual PRBool OnOpenContainer(const PRUnichar **aAtts, 
                                  PRUint32 aAttsCount, 
@@ -114,7 +114,10 @@ protected:
                                  nsINodeInfo* aNodeInfo, PRUint32 aLineNumber,
                                  nsIContent** aResult, PRBool* aAppendContent);
 
-  virtual nsresult CloseElement(nsIContent* aContent, PRBool* aAppendContent);
+  // aParent is allowed to be null here if this is the root content
+  // being closed
+  virtual nsresult CloseElement(nsIContent* aContent, nsIContent* aParent,
+                                PRBool* aAppendContent);
 
   virtual nsresult FlushText(PRBool aCreateTextNode=PR_TRUE,
                              PRBool* aDidFlush=nsnull);

content/xml/document/src/nsXMLFragmentContentSink.cpp

@@ -98,7 +98,8 @@ protected:
   virtual nsresult CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
                                  nsINodeInfo* aNodeInfo, PRUint32 aLineNumber,
                                  nsIContent** aResult, PRBool* aAppendContent);
-  virtual nsresult CloseElement(nsIContent* aContent, PRBool* aAppendContent);
+  virtual nsresult CloseElement(nsIContent* aContent, nsIContent* aParent,
+                                PRBool* aAppendContent);
 
   // nsContentSink overrides
   virtual nsresult ProcessStyleLink(nsIContent* aElement,
@@ -186,7 +187,8 @@ NS_IMETHODIMP
 nsXMLFragmentContentSink::DidBuildModel()
 {
   if (mAllContent) {
-    PopContent();  // remove mRoot pushed above
+    // Need the nsCOMPtr to properly release
+    nsCOMPtr<nsIContent> root = PopContent();  // remove mRoot pushed above
   }
 
   nsCOMPtr<nsIParser> kungFuDeathGrip(mParser);
@@ -245,7 +247,9 @@ nsXMLFragmentContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsC
 }
 
 nsresult
-nsXMLFragmentContentSink::CloseElement(nsIContent* aContent, PRBool* aAppendContent)
+nsXMLFragmentContentSink::CloseElement(nsIContent* aContent,
+                                       nsIContent* aParent,
+                                       PRBool* aAppendContent)
 {
   // don't do fancy stuff in nsXMLContentSink
   *aAppendContent = PR_FALSE;
@@ -413,7 +417,8 @@ nsXMLFragmentContentSink::DidBuildContent()
     if (!mParseError) {
       FlushText();
     }
-    PopContent();
+    // Need the nsCOMPtr to properly release
+    nsCOMPtr<nsIContent> root = PopContent();
   }
 
   return NS_OK;