Bug 489925 and bug 522030 branch-safe fix. Hold strong refs in the id table. r=jst

content/base/src/nsDocument.cpp

@@ -312,6 +312,11 @@ nsIdentifierMapEntry::~nsIdentifierMapEntry()
   if (mNameContentList && mNameContentList != NAME_NOT_VALID) {
     NS_RELEASE(mNameContentList);
   }
+
+  for (PRInt32 i = 0; i < mIdContentList.Count(); ++i) {
+    nsIContent* content = static_cast<nsIContent*>(mIdContentList[i]);
+    NS_RELEASE(content);
+  }
 }
 
 void
@@ -325,6 +330,12 @@ nsIdentifierMapEntry::Traverse(nsCycleCollectionTraversalCallback* aCallback)
 
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*aCallback, "mIdentifierMap mDocAllList");
   aCallback->NoteXPCOMChild(static_cast<nsIDOMNodeList*>(mDocAllList));
+
+  for (PRInt32 i = 0; i < mIdContentList.Count(); ++i) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*aCallback,
+                                       "mIdentifierMap mIdContentList element");
+    aCallback->NoteXPCOMChild(static_cast<nsIContent*>(mIdContentList[i]));
+  }
 }
 
 void
@@ -430,6 +441,7 @@ nsIdentifierMapEntry::AddIdContent(nsIContent* aContent)
   if (mIdContentList.Count() == 0) {
     if (!mIdContentList.AppendElement(aContent))
       return PR_FALSE;
+    NS_ADDREF(aContent);
     NS_ASSERTION(currentContent == nsnull, "How did that happen?");
     FireChangeCallbacks(nsnull, aContent);
     return PR_TRUE;
@@ -462,6 +474,7 @@ nsIdentifierMapEntry::AddIdContent(nsIContent* aContent)
 
   if (!mIdContentList.InsertElementAt(aContent, start))
     return PR_FALSE;
+  NS_ADDREF(aContent);
   if (start == 0) {
     nsIContent* oldContent =
       static_cast<nsIContent*>(mIdContentList.SafeElementAt(1));
@@ -482,6 +495,7 @@ nsIdentifierMapEntry::RemoveIdContent(nsIContent* aContent)
   nsIContent* currentContent = static_cast<nsIContent*>(mIdContentList.SafeElementAt(0));
   if (!mIdContentList.RemoveElement(aContent))
     return PR_FALSE;
+  NS_RELEASE(aContent);
   if (currentContent == aContent) {
     FireChangeCallbacks(currentContent,
                         static_cast<nsIContent*>(mIdContentList.SafeElementAt(0)));
@@ -6942,6 +6956,10 @@ nsDocument::Destroy()
   // XXX We really should let cycle collection do this, but that currently still
   //     leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
   nsContentUtils::ReleaseWrapper(static_cast<nsINode*>(this), this);
+
+  // Try really really hard to make sure we don't leak things through
+  // mIdentifierMap
+  mIdentifierMap.Clear();
 }
 
 void

content/base/src/nsDocument.h

@@ -320,7 +320,8 @@ public:
 private:
   void FireChangeCallbacks(nsIContent* aOldContent, nsIContent* aNewContent);
 
-  // empty if there are no nodes with this ID
+  // empty if there are no nodes with this ID.
+  // The content nodes are stored addrefed.
   nsSmallVoidArray mIdContentList;
   // NAME_NOT_VALID if this id cannot be used as a 'name'
   nsBaseContentList *mNameContentList;