Fix for bug 374449 (Most callers of nsIDocument::RemoveReference leak). r/sr=jst.

content/base/public/nsIDocument.h

@@ -613,7 +613,7 @@ public:
 
   virtual void AddReference(void *aKey, nsISupports *aReference) = 0;
   virtual nsISupports *GetReference(void *aKey) = 0;
-  virtual already_AddRefed<nsISupports> RemoveReference(void *aKey) = 0;
+  virtual void RemoveReference(void *aKey) = 0;
 
   /**
    * Set the container (docshell) for this document.

content/base/src/nsContentUtils.cpp

@@ -719,11 +719,10 @@ nsContentUtils::doReparentContentWrapper(nsIContent *aNode,
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (aOldDocument) {
-    nsCOMPtr<nsISupports> old_ref = aOldDocument->RemoveReference(aNode);
-    
+    nsCOMPtr<nsISupports> old_ref = aOldDocument->GetReference(aNode);
     if (old_ref) {
       // Transfer the reference from aOldDocument to aNewDocument
-      
+      aOldDocument->RemoveReference(aNode);
       aNewDocument->AddReference(aNode, old_ref);
     }
   }

content/base/src/nsDocument.cpp

@@ -4866,17 +4866,12 @@ nsDocument::GetReference(void *aKey)
   return nsnull;
 }
 
-already_AddRefed<nsISupports>
+void
 nsDocument::RemoveReference(void *aKey)
 {
-  nsISupports* oldReference = nsnull;
-
   if (mContentWrapperHash) {
-    mContentWrapperHash->Get(aKey, &oldReference);    
     mContentWrapperHash->Remove(aKey);
   }
-
-  return oldReference;
 }
 
 nsIScriptEventManager*

content/base/src/nsDocument.h

@@ -497,7 +497,7 @@ public:
   virtual void FlushPendingNotifications(mozFlushType aType);
   virtual void AddReference(void *aKey, nsISupports *aReference);
   virtual nsISupports *GetReference(void *aKey);
-  virtual already_AddRefed<nsISupports> RemoveReference(void *aKey);
+  virtual void RemoveReference(void *aKey);
   virtual nsIScriptEventManager* GetScriptEventManager();
   virtual void SetXMLDeclaration(const PRUnichar *aVersion,
                                  const PRUnichar *aEncoding,

content/base/src/nsNodeUtils.cpp

@@ -432,15 +432,30 @@ nsNodeUtils::CloneAndAdopt(nsINode *aNode, PRBool aClone, PRBool aDeep,
     }
   }
   else if (nodeInfoManager) {
+    nsCOMPtr<nsISupports> oldRef;
+    nsIDocument* oldDoc = aNode->GetOwnerDoc();
+    if (oldDoc) {
+      oldRef = oldDoc->GetReference(aNode);
+      if (oldRef) {
+        oldDoc->RemoveReference(aNode);
+      }
+    }
+
     aNode->mNodeInfo.swap(newNodeInfo);
 
     nsIDocument* newDoc = aNode->GetOwnerDoc();
-    nsPIDOMWindow* window = newDoc ? newDoc->GetInnerWindow() : nsnull;
-    if (window) {
-      nsCOMPtr<nsIEventListenerManager> elm;
-      aNode->GetListenerManager(PR_FALSE, getter_AddRefs(elm));
-      if (elm) {
-        window->SetMutationListeners(elm->MutationListenerBits());
+    if (newDoc) {
+      if (oldRef) {
+        newDoc->AddReference(aNode, oldRef);
+      }
+
+      nsPIDOMWindow* window = newDoc->GetInnerWindow();
+      if (window) {
+        nsCOMPtr<nsIEventListenerManager> elm;
+        aNode->GetListenerManager(PR_FALSE, getter_AddRefs(elm));
+        if (elm) {
+          window->SetMutationListeners(elm->MutationListenerBits());
+        }
       }
     }
 

dom/src/base/nsGlobalWindow.cpp

@@ -779,11 +779,12 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGlobalWindow)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mListenerManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mSessionStorage)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDocumentPrincipal)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDoc)
 
   // Unlink any associated preserved wrapper.
-  if (tmp->mDoc)
+  if (tmp->mDoc) {
     tmp->mDoc->RemoveReference(tmp->mDoc.get());
+    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDoc)
+  }
 
   // Unlink stuff from nsPIDOMWindow
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mChromeEventHandler)