Bug 1028588 - Fix dangerous public destructors in content/svg/ - r=heycam

content/svg/content/src/DOMSVGLength.h

@@ -79,6 +79,8 @@ class DOMSVGLength MOZ_FINAL : public nsIDOMSVGLength,
    */
   DOMSVGLength(nsSVGLength2* aVal, nsSVGElement* aSVGElement, bool aAnimVal);
 
+  ~DOMSVGLength();
+
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(MOZILLA_DOMSVGLENGTH_IID)
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
@@ -99,8 +101,6 @@ public:
    */
   DOMSVGLength();
 
-  ~DOMSVGLength();
-
   static already_AddRefed<DOMSVGLength> GetTearOff(nsSVGLength2* aVal,
                                                    nsSVGElement* aSVGElement,
                                                    bool aAnimVal);

content/svg/content/src/DOMSVGLengthList.h

@@ -44,6 +44,15 @@ class DOMSVGLengthList MOZ_FINAL : public nsISupports,
   friend class AutoChangeLengthListNotifier;
   friend class DOMSVGLength;
 
+  ~DOMSVGLengthList() {
+    // Our mAList's weak ref to us must be nulled out when we die. If GC has
+    // unlinked us using the cycle collector code, then that has already
+    // happened, and mAList is null.
+    if (mAList) {
+      ( IsAnimValList() ? mAList->mAnimVal : mAList->mBaseVal ) = nullptr;
+    }
+  }
+
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGLengthList)
@@ -62,15 +71,6 @@ public:
     InternalListLengthWillChange(aInternalList.Length()); // Sync mItems
   }
 
-  ~DOMSVGLengthList() {
-    // Our mAList's weak ref to us must be nulled out when we die. If GC has
-    // unlinked us using the cycle collector code, then that has already
-    // happened, and mAList is null.
-    if (mAList) {
-      ( IsAnimValList() ? mAList->mAnimVal : mAList->mBaseVal ) = nullptr;
-    }
-  }
-
   virtual JSObject* WrapObject(JSContext *cx) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()

content/svg/content/src/DOMSVGNumber.h

@@ -38,6 +38,15 @@ class DOMSVGNumber MOZ_FINAL : public nsISupports
 {
   friend class AutoChangeNumberNotifier;
 
+  ~DOMSVGNumber() {
+    // Our mList's weak ref to us must be nulled out when we die. If GC has
+    // unlinked us using the cycle collector code, then that has already
+    // happened, and mList is null.
+    if (mList) {
+      mList->mItems[mListIndex] = nullptr;
+    }
+  }
+
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGNumber)
@@ -56,15 +65,6 @@ public:
    */
   explicit DOMSVGNumber(nsISupports* aParent);
 
-  ~DOMSVGNumber() {
-    // Our mList's weak ref to us must be nulled out when we die. If GC has
-    // unlinked us using the cycle collector code, then that has already
-    // happened, and mList is null.
-    if (mList) {
-      mList->mItems[mListIndex] = nullptr;
-    }
-  }
-
   /**
    * Create an unowned copy. The caller is responsible for the first AddRef().
    */

content/svg/content/src/DOMSVGNumberList.h

@@ -44,6 +44,15 @@ class DOMSVGNumberList MOZ_FINAL : public nsISupports,
   friend class AutoChangeNumberListNotifier;
   friend class DOMSVGNumber;
 
+  ~DOMSVGNumberList() {
+    // Our mAList's weak ref to us must be nulled out when we die. If GC has
+    // unlinked us using the cycle collector code, then that has already
+    // happened, and mAList is null.
+    if (mAList) {
+      ( IsAnimValList() ? mAList->mAnimVal : mAList->mBaseVal ) = nullptr;
+    }
+  }
+
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGNumberList)
@@ -62,15 +71,6 @@ public:
     InternalListLengthWillChange(aInternalList.Length()); // Sync mItems
   }
 
-  ~DOMSVGNumberList() {
-    // Our mAList's weak ref to us must be nulled out when we die. If GC has
-    // unlinked us using the cycle collector code, then that has already
-    // happened, and mAList is null.
-    if (mAList) {
-      ( IsAnimValList() ? mAList->mAnimVal : mAList->mBaseVal ) = nullptr;
-    }
-  }
-
   virtual JSObject* WrapObject(JSContext *cx) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()

content/svg/content/src/DOMSVGTransformList.h

@@ -39,6 +39,15 @@ class DOMSVGTransformList MOZ_FINAL : public nsISupports,
   friend class AutoChangeTransformListNotifier;
   friend class dom::SVGTransform;
 
+  ~DOMSVGTransformList() {
+    // Our mAList's weak ref to us must be nulled out when we die. If GC has
+    // unlinked us using the cycle collector code, then that has already
+    // happened, and mAList is null.
+    if (mAList) {
+      ( IsAnimValList() ? mAList->mAnimVal : mAList->mBaseVal ) = nullptr;
+    }
+  }
+
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGTransformList)
@@ -57,15 +66,6 @@ public:
     InternalListLengthWillChange(aInternalList.Length()); // Sync mItems
   }
 
-  ~DOMSVGTransformList() {
-    // Our mAList's weak ref to us must be nulled out when we die. If GC has
-    // unlinked us using the cycle collector code, then that has already
-    // happened, and mAList is null.
-    if (mAList) {
-      ( IsAnimValList() ? mAList->mAnimVal : mAList->mBaseVal ) = nullptr;
-    }
-  }
-
   virtual JSObject* WrapObject(JSContext *cx) MOZ_OVERRIDE;
 
   nsISupports* GetParentObject()

content/svg/content/src/SVGAngle.h

@@ -33,8 +33,6 @@ public:
     SetIsDOMBinding();
   }
 
-  ~SVGAngle();
-
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
@@ -49,6 +47,8 @@ public:
   void ConvertToSpecifiedUnits(uint16_t unitType, ErrorResult& rv);
 
 protected:
+  ~SVGAngle();
+
   nsSVGAngle* mVal; // if mType is CreatedValue, we own the angle.  Otherwise, the element does.
   nsRefPtr<nsSVGElement> mSVGElement;
   AngleType mType;

content/svg/content/src/SVGAnimatedAngle.h

@@ -28,7 +28,6 @@ public:
   {
     SetIsDOMBinding();
   }
-  ~SVGAnimatedAngle();
 
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
@@ -37,6 +36,8 @@ public:
   already_AddRefed<SVGAngle> AnimVal();
 
 protected:
+  ~SVGAnimatedAngle();
+
   nsSVGAngle* mVal; // kept alive because it belongs to content
   nsRefPtr<nsSVGElement> mSVGElement;
 };

content/svg/content/src/SVGAnimatedBoolean.h

@@ -24,7 +24,6 @@ class SVGAnimatedBoolean MOZ_FINAL : public nsWrapperCache
   {
     SetIsDOMBinding();
   }
-  ~SVGAnimatedBoolean();
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
@@ -34,6 +33,8 @@ class SVGAnimatedBoolean MOZ_FINAL : public nsWrapperCache
   bool AnimVal() const { mSVGElement->FlushAnimations(); return mVal->GetAnimValue(); }
 
 protected:
+  ~SVGAnimatedBoolean();
+
   nsSVGBoolean* mVal; // kept alive because it belongs to content
   nsRefPtr<nsSVGElement> mSVGElement;
 };

content/svg/content/src/SVGAnimatedLength.h

@@ -27,8 +27,6 @@ public:
     : mVal(aVal), mSVGElement(aSVGElement)
   { SetIsDOMBinding(); }
 
-  ~SVGAnimatedLength();
-
   // WebIDL
   nsSVGElement* GetParentObject() { return mSVGElement; }
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
@@ -36,6 +34,8 @@ public:
   already_AddRefed<DOMSVGLength> AnimVal();
 
 protected:
+  ~SVGAnimatedLength();
+
   nsSVGLength2* mVal; // kept alive because it belongs to content
   nsRefPtr<nsSVGElement> mSVGElement;
 };

content/svg/content/src/SVGAnimatedPreserveAspectRatio.h

@@ -115,6 +115,8 @@ namespace dom {
 class DOMSVGAnimatedPreserveAspectRatio MOZ_FINAL : public nsISupports,
                                                     public nsWrapperCache
 {
+  ~DOMSVGAnimatedPreserveAspectRatio();
+
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMSVGAnimatedPreserveAspectRatio)
 
@@ -124,7 +126,6 @@ class DOMSVGAnimatedPreserveAspectRatio MOZ_FINAL : public nsISupports,
   {
     SetIsDOMBinding();
   }
-  ~DOMSVGAnimatedPreserveAspectRatio();
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }

content/svg/content/src/SVGAnimatedRect.h

@@ -26,8 +26,6 @@ public:
 
   SVGAnimatedRect(nsSVGViewBox* aVal, nsSVGElement* aSVGElement);
 
-  virtual ~SVGAnimatedRect();
-
   nsSVGElement* GetParentObject() const
   {
     return mSVGElement;
@@ -40,6 +38,8 @@ public:
   already_AddRefed<SVGIRect> GetAnimVal();
 
 private:
+  virtual ~SVGAnimatedRect();
+
   nsSVGViewBox* mVal; // kept alive because it belongs to content
   nsRefPtr<nsSVGElement> mSVGElement;
 };

content/svg/content/src/SVGGraphicsElement.cpp

@@ -26,5 +26,9 @@ SVGGraphicsElement::SVGGraphicsElement(already_AddRefed<mozilla::dom::NodeInfo>&
 {
 }
 
+SVGGraphicsElement::~SVGGraphicsElement()
+{
+}
+
 } // namespace dom
 } // namespace mozilla

content/svg/content/src/SVGGraphicsElement.h

@@ -19,6 +19,7 @@ class SVGGraphicsElement : public SVGGraphicsElementBase,
 {
 protected:
   SVGGraphicsElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  ~SVGGraphicsElement();
 
 public:
   // interfaces:

content/svg/content/src/SVGMatrix.h

@@ -111,6 +111,8 @@ public:
   already_AddRefed<SVGMatrix> SkewY(float angle, ErrorResult& rv);
 
 private:
+  ~SVGMatrix() {}
+
   void SetMatrix(const gfxMatrix& aMatrix) {
     if (mTransform) {
       mTransform->SetMatrix(aMatrix);

content/svg/content/src/SVGPreserveAspectRatio.h

@@ -127,7 +127,6 @@ public:
   {
     SetIsDOMBinding();
   }
-  ~DOMSVGPreserveAspectRatio();
 
   // WebIDL
   nsSVGElement* GetParentObject() const { return mSVGElement; }
@@ -139,6 +138,8 @@ public:
   void SetMeetOrSlice(uint16_t aMeetOrSlice, ErrorResult& rv);
 
 protected:
+  ~DOMSVGPreserveAspectRatio();
+
   SVGAnimatedPreserveAspectRatio* mVal; // kept alive because it belongs to mSVGElement
   nsRefPtr<nsSVGElement> mSVGElement;
   const bool mIsBaseValue;

content/svg/content/src/SVGRect.h

@@ -72,6 +72,8 @@ public:
   }
 
 protected:
+  ~SVGRect() {}
+
   nsCOMPtr<nsIContent> mParent;
   float mX, mY, mWidth, mHeight;
 };

content/svg/content/src/SVGSVGElement.cpp

@@ -70,6 +70,10 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DOMSVGTranslatePoint)
   NS_INTERFACE_MAP_ENTRY(nsISupports)
 NS_INTERFACE_MAP_END
 
+SVGSVGElement::~SVGSVGElement()
+{
+}
+
 nsISVGPoint*
 DOMSVGTranslatePoint::Clone()
 {

content/svg/content/src/SVGSVGElement.h

@@ -99,6 +99,8 @@ class SVGSVGElement MOZ_FINAL : public SVGSVGElementBase
                                          already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
                                          mozilla::dom::FromParser aFromParser));
 
+  ~SVGSVGElement();
+
 public:
   // interfaces:
   NS_DECL_ISUPPORTS_INHERITED

content/svg/content/src/SVGTests.h

@@ -30,7 +30,6 @@ public:
   NS_DECL_ISUPPORTS
 
   SVGTests();
-  virtual ~SVGTests() {}
 
   friend class mozilla::DOMSVGStringList;
   typedef mozilla::SVGStringList SVGStringList;
@@ -95,6 +94,9 @@ public:
   already_AddRefed<DOMSVGStringList> SystemLanguage();
   bool HasExtension(const nsAString& aExtension);
 
+protected:
+  virtual ~SVGTests() {}
+
 private:
   enum { FEATURES, EXTENSIONS, LANGUAGE };
   SVGStringList mStringListAttributes[3];

content/svg/content/src/SVGTransform.h

@@ -60,8 +60,6 @@ public:
    */
   explicit SVGTransform(const nsSVGTransform &aMatrix);
 
-  ~SVGTransform();
-
   /**
    * Create an unowned copy of an owned transform. The caller is responsible for
    * the first AddRef().
@@ -132,6 +130,8 @@ public:
   void SetSkewY(float angle, ErrorResult& rv);
 
 protected:
+  ~SVGTransform();
+
   // Interface for SVGMatrix's use
   friend class dom::SVGMatrix;
   const bool IsAnimVal() const {

content/svg/content/src/nsISVGPoint.h

@@ -63,6 +63,7 @@ public:
     mPt.mY = aPt->GetY();
   }
 
+protected:
   virtual ~nsISVGPoint()
   {
     // Our mList's weak ref to us must be nulled out when we die. If GC has
@@ -73,6 +74,7 @@ public:
     }
   }
 
+public:
   /**
    * Create an unowned copy of this object. The caller is responsible for the
    * first AddRef()!

content/svg/content/src/nsSVGClass.cpp

@@ -35,6 +35,9 @@ struct DOMAnimatedString MOZ_FINAL : public SVGAnimatedString
   }
 
   void GetAnimVal(nsAString& aResult) MOZ_OVERRIDE;
+
+private:
+  ~DOMAnimatedString() {}
 };
 
 NS_SVG_VAL_IMPL_CYCLE_COLLECTION_WRAPPERCACHED(DOMAnimatedString, mSVGElement)

content/svg/content/src/nsSVGString.h

@@ -61,8 +61,6 @@ public:
       , mVal(aVal)
     {}
 
-    virtual ~DOMAnimatedString();
-
     nsSVGString* mVal; // kept alive because it belongs to content
 
     void GetBaseVal(nsAString & aResult) MOZ_OVERRIDE
@@ -81,6 +79,8 @@ public:
       mVal->GetAnimValue(aResult, mSVGElement);
     }
 
+  private:
+    virtual ~DOMAnimatedString();
   };
   struct SMILString : public nsISMILAttr
   {

content/svg/content/src/nsSVGViewBox.h

@@ -40,7 +40,6 @@ struct nsSVGViewBoxRect
 
 class nsSVGViewBox
 {
-
 public:
 
   void Init();
@@ -109,7 +108,6 @@ public:
       , mVal(aVal)
       , mSVGElement(aSVGElement)
     {}
-    virtual ~DOMBaseVal();
 
     nsSVGViewBox* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -143,6 +141,9 @@ public:
     {
       return mSVGElement;
     }
+
+  private:
+    virtual ~DOMBaseVal();
   };
 
   struct DOMAnimVal MOZ_FINAL : public mozilla::dom::SVGIRect
@@ -155,7 +156,6 @@ public:
       , mVal(aVal)
       , mSVGElement(aSVGElement)
     {}
-    virtual ~DOMAnimVal();
 
     nsSVGViewBox* mVal; // kept alive because it belongs to content
     nsRefPtr<nsSVGElement> mSVGElement;
@@ -210,6 +210,10 @@ public:
     {
       return mSVGElement;
     }
+
+  private:
+    virtual ~DOMAnimVal();
+
   };
 
   struct SMILViewBox : public nsISMILAttr
@@ -238,4 +242,12 @@ public:
     sSVGAnimatedRectTearoffTable;
 };
 
+namespace mozilla {
+template<>
+struct HasDangerousPublicDestructor<nsSVGViewBox>
+{
+  static const bool value = true;
+};
+}
+
 #endif // __NS_SVGVIEWBOX_H__