Bug 406852: Fix docshell leak by properly killing the frameloaders in object-loading-content when the document is destroyed. r/sr=peterv

content/html/content/src/nsHTMLObjectElement.cpp

@@ -103,6 +103,7 @@ public:
   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom *aAttribute) const;
   virtual PRInt32 IntrinsicState() const;
+  virtual void DestroyContent();
 
   // nsObjectLoadingContent
   virtual PRUint32 GetCapabilities() const;
@@ -436,3 +437,10 @@ nsHTMLObjectElement::GetCapabilities() const
 {
   return nsObjectLoadingContent::GetCapabilities() | eSupportClassID;
 }
+
+void
+nsHTMLObjectElement::DestroyContent()
+{
+  RemovedFromDocument();
+  nsGenericHTMLFormElement::DestroyContent();
+}

content/html/content/src/nsHTMLSharedObjectElement.cpp

@@ -122,6 +122,7 @@ public:
   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
   NS_IMETHOD_(PRBool) IsAttributeMapped(const nsIAtom *aAttribute) const;
   virtual PRInt32 IntrinsicState() const;
+  virtual void DestroyContent();
 
   // nsObjectLoadingContent
   virtual PRUint32 GetCapabilities() const;
@@ -440,3 +441,10 @@ nsHTMLSharedObjectElement::GetCapabilities() const
 
   return capabilities;
 }
+
+void
+nsHTMLSharedObjectElement::DestroyContent()
+{
+  RemovedFromDocument();
+  nsGenericHTMLElement::DestroyContent();
+}