Backout revisions fa5326c011b8, 8b22441911b0, and cfa10b01b1f6 (bug 531585) on suspicion of causing random orange bug 536382.

layout/base/nsPresContext.cpp

@@ -259,13 +259,7 @@ nsPresContext::~nsPresContext()
   NS_PRECONDITION(!mShell, "Presshell forgot to clear our mShell pointer");
   SetShell(nsnull);
 
-  if (mRefreshDriver) {
-    mRefreshDriver->Disconnect();
-  }
-
-  if (mTransitionManager) {
-    mTransitionManager->Disconnect();
-  }
+  delete mTransitionManager;
 
   if (mEventManager) {
     // unclear if these are needed, but can't hurt
@@ -879,12 +873,6 @@ nsPresContext::Init(nsIDeviceContext* aDeviceContext)
   NS_ADDREF(mEventManager);
 
   mTransitionManager = new nsTransitionManager(this);
-  if (!mTransitionManager)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  mRefreshDriver = new nsRefreshDriver(this);
-  if (!mRefreshDriver)
-    return NS_ERROR_OUT_OF_MEMORY;
 
   mLangService = do_GetService(NS_LANGUAGEATOMSERVICE_CONTRACTID);
 

layout/base/nsPresContext.h

@@ -72,6 +72,7 @@
 #include "nsContentUtils.h"
 #include "nsIWidget.h"
 #include "mozilla/TimeStamp.h"
+#include "nsRefreshDriver.h"
 
 class nsImageLoader;
 #ifdef IBMBIDI
@@ -102,7 +103,6 @@ class nsUserFontSet;
 struct nsFontFaceRuleContainer;
 class nsObjectFrame;
 class nsTransitionManager;
-class nsRefreshDriver;
 class imgIContainer;
 
 #ifdef MOZ_REFLOW_PERF
@@ -233,7 +233,13 @@ public:
 
   nsTransitionManager* TransitionManager() { return mTransitionManager; }
 
-  nsRefreshDriver* RefreshDriver() { return mRefreshDriver; }
+  nsRefreshDriver* RefreshDriver() { return &mRefreshDriver; }
+
+  static nsPresContext* FromRefreshDriver(nsRefreshDriver* aRefreshDriver) {
+    return reinterpret_cast<nsPresContext*>(
+             reinterpret_cast<char*>(aRefreshDriver) -
+             offsetof(nsPresContext, mRefreshDriver));
+  }
 #endif
 
   /**
@@ -951,8 +957,8 @@ protected:
                                         // from gfx back to layout.
   nsIEventStateManager* mEventManager;  // [STRONG]
   nsILookAndFeel*       mLookAndFeel;   // [STRONG]
-  nsRefPtr<nsRefreshDriver> mRefreshDriver;
-  nsRefPtr<nsTransitionManager> mTransitionManager;
+  nsRefreshDriver       mRefreshDriver;
+  nsTransitionManager*  mTransitionManager; // owns; it aggregates our refcount
   nsIAtom*              mMedium;        // initialized by subclass ctors;
                                         // weak pointer to static atom
 

layout/base/nsRefreshDriver.cpp

@@ -44,7 +44,6 @@
 #include "nsPresContext.h"
 #include "nsComponentManagerUtils.h"
 #include "prlog.h"
-#include "nsAutoPtr.h"
 
 /*
  * TODO:
@@ -57,8 +56,7 @@
 
 using mozilla::TimeStamp;
 
-nsRefreshDriver::nsRefreshDriver(nsPresContext *aPresContext)
-  : mPresContext(aPresContext)
+nsRefreshDriver::nsRefreshDriver()
 {
 }
 
@@ -172,7 +170,11 @@ nsRefreshDriver::ArrayFor(mozFlushType aFlushType)
  * nsISupports implementation
  */
 
-NS_IMPL_ISUPPORTS1(nsRefreshDriver, nsITimerCallback)
+NS_IMPL_ADDREF_USING_AGGREGATOR(nsRefreshDriver,
+                                nsPresContext::FromRefreshDriver(this))
+NS_IMPL_RELEASE_USING_AGGREGATOR(nsRefreshDriver,
+                                 nsPresContext::FromRefreshDriver(this))
+NS_IMPL_QUERY_INTERFACE1(nsRefreshDriver, nsITimerCallback)
 
 /*
  * nsITimerCallback implementation
@@ -183,34 +185,18 @@ nsRefreshDriver::Notify(nsITimer *aTimer)
 {
   UpdateMostRecentRefresh();
 
-  if (!mPresContext) {
-    // Things are being destroyed.
-    NS_ABORT_IF_FALSE(!mTimer, "timer should have been stopped");
-    return NS_OK;
-  }
-  nsCOMPtr<nsIPresShell> presShell = mPresContext->GetPresShell();
+  nsPresContext *presContext = nsPresContext::FromRefreshDriver(this);
+  nsCOMPtr<nsIPresShell> presShell = presContext->GetPresShell();
   if (!presShell) {
     // Things are being destroyed.
     StopTimer();
     return NS_OK;
   }
 
-  /*
-   * The timer holds a reference to |this| while calling |Notify|.
-   * However, implementations of |WillRefresh| are permitted to destroy
-   * the pres context, which will cause our |mPresContext| to become
-   * null.  If this happens, we must stop notifying observers.
-   */
   for (PRUint32 i = 0; i < NS_ARRAY_LENGTH(mObservers); ++i) {
     ObserverArray::EndLimitedIterator etor(mObservers[i]);
     while (etor.HasMore()) {
-      nsRefPtr<nsARefreshObserver> obs = etor.GetNext();
-      obs->WillRefresh(mMostRecentRefresh);
-      
-      if (!mPresContext || !mPresContext->GetPresShell()) {
-        StopTimer();
-        return NS_OK;
-      }
+      etor.GetNext()->WillRefresh(mMostRecentRefresh);
     }
     if (i == 0) {
       // This is the Flush_Style case.

layout/base/nsRefreshDriver.h

@@ -49,8 +49,6 @@
 #include "nsCOMPtr.h"
 #include "nsTObserverArray.h"
 
-class nsPresContext;
-
 /**
  * An abstract base class to be implemented by callers wanting to be
  * notified at refresh times.  When nothing needs to be painted, callers
@@ -58,29 +56,19 @@ class nsPresContext;
  */
 class nsARefreshObserver {
 public:
-  // AddRef and Release signatures that match nsISupports.  Implementors
-  // must implement reference counting, and those that do implement
-  // nsISupports will already have methods with the correct signature.
-  //
-  // The refresh driver does NOT hold references to refresh observers
-  // except while it is notifying them.  
-  NS_IMETHOD_(nsrefcnt) AddRef(void) = 0;
-  NS_IMETHOD_(nsrefcnt) Release(void) = 0;
-
   virtual void WillRefresh(mozilla::TimeStamp aTime) = 0;
 };
 
-class nsRefreshDriver : public nsITimerCallback {
+/*
+ * nsRefreshDriver MUST ONLY be constructed as a sub-object of
+ * nsPresContext (since its reference counting methods forward to the
+ * pres context of which it is an mRefreshDriver)
+ */
+class nsRefreshDriver : private nsITimerCallback {
 public:
-  nsRefreshDriver(nsPresContext *aPresContext);
+  nsRefreshDriver();
   ~nsRefreshDriver();
 
-  // nsISupports implementation
-  NS_DECL_ISUPPORTS
-
-  // nsITimerCallback implementation
-  NS_DECL_NSITIMERCALLBACK
-
   /**
    * Return the time of the most recent refresh.  This is intended to be
    * used by callers who want to start an animation now and want to know
@@ -102,26 +90,18 @@ public:
    *     painting, and, correspondingly, which get notified when there
    *     is a flush during such suppression
    * and it must be either Flush_Style, Flush_Layout, or Flush_Display.
-   *
-   * The refresh driver does NOT own a reference to these observers;
-   * they must remove themselves before they are destroyed.
    */
   PRBool AddRefreshObserver(nsARefreshObserver *aObserver,
                             mozFlushType aFlushType);
   PRBool RemoveRefreshObserver(nsARefreshObserver *aObserver,
                                mozFlushType aFlushType);
-
-  /**
-   * Tell the refresh driver that it is done driving refreshes and
-   * should stop its timer and forget about its pres context.  This may
-   * be called from within a refresh.
-   */
-  void Disconnect() {
-    StopTimer();
-    mPresContext = nsnull;
-  }
-
 private:
+  // nsISupports implementation
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsITimerCallback implementation
+  NS_IMETHOD Notify(nsITimer *aTimer);
+
   typedef nsTObserverArray<nsARefreshObserver*> ObserverArray;
 
   void EnsureTimerStarted();
@@ -133,9 +113,6 @@ private:
   nsCOMPtr<nsITimer> mTimer;
   mozilla::TimeStamp mMostRecentRefresh; // only valid when mTimer non-null
 
-  nsPresContext *mPresContext; // weak; pres context passed in constructor
-                               // and unset in Disconnect
-
   // separate arrays for each flush type we support
   ObserverArray mObservers[3];
 };

layout/style/nsTransitionManager.cpp

@@ -747,7 +747,9 @@ nsTransitionManager::AddElementTransitions(ElementTransitions* aElementTransitio
  * nsISupports implementation
  */
 
-NS_IMPL_ISUPPORTS1(nsTransitionManager, nsIStyleRuleProcessor)
+NS_IMPL_ADDREF_USING_AGGREGATOR(nsTransitionManager, mPresContext)
+NS_IMPL_RELEASE_USING_AGGREGATOR(nsTransitionManager, mPresContext)
+NS_IMPL_QUERY_INTERFACE1(nsTransitionManager, nsIStyleRuleProcessor)
 
 /*
  * nsIStyleRuleProcessor implementation
@@ -849,10 +851,6 @@ nsTransitionManager::MediumFeaturesChanged(nsPresContext* aPresContext,
 /* virtual */ void
 nsTransitionManager::WillRefresh(mozilla::TimeStamp aTime)
 {
-  NS_ABORT_IF_FALSE(mPresContext,
-                    "refresh driver should not notify additional observers "
-                    "after pres context has been destroyed");
-
   // Trim transitions that have completed, and post restyle events for
   // frames that are still transitioning.
   {

layout/style/nsTransitionManager.h

@@ -52,19 +52,16 @@ class nsCSSPropertySet;
 struct nsTransition;
 struct ElementTransitions;
 
+/**
+ * Must be created only as a sub-object of an nsPresContext (since its
+ * reference counting methods assume that).
+ */
 class nsTransitionManager : public nsIStyleRuleProcessor,
                             public nsARefreshObserver {
 public:
   nsTransitionManager(nsPresContext *aPresContext);
   ~nsTransitionManager();
 
-  /**
-   * Notify the transition manager that the pres context is going away.
-   */
-  void Disconnect() {
-    mPresContext = nsnull;
-  }
-
   /**
    * StyleContextChanged 
    *
@@ -85,7 +82,7 @@ public:
                         nsStyleContext *aNewStyleContext);
 
   // nsISupports
-  NS_DECL_ISUPPORTS
+  NS_DECL_ISUPPORTS_INHERITED
 
   // nsIStyleRuleProcessor
   NS_IMETHOD RulesMatching(ElementRuleProcessorData* aData);
@@ -123,7 +120,7 @@ private:
 			      nsCSSPseudoElements::Type aPseudoType);
 
   PRCList mElementTransitions;
-  nsPresContext *mPresContext; // weak (non-null from ctor to Disconnect)
+  nsPresContext *mPresContext;
 };
 
 #endif /* !defined(nsTransitionManager_h_) */