Use an iterative algorithm when deleting lists to avoid exhausting the stack space. b=460444 r+sr=dbaron r=jst

content/base/public/nsContentUtils.h

@@ -1683,4 +1683,17 @@ inline NS_HIDDEN_(PRBool) NS_FloatIsFinite(jsdouble f) {
     return (rv);                                                              \
   }
 
+// Deletes a linked list iteratively to avoid blowing up the stack (bug 460444).
+#define NS_CONTENT_DELETE_LIST_MEMBER(type_, ptr_, member_)                   \
+  {                                                                           \
+    type_ *cur = (ptr_)->member_;                                             \
+    (ptr_)->member_ = nsnull;                                                 \
+    while (cur) {                                                             \
+      type_ *next = cur->member_;                                             \
+      cur->member_ = nsnull;                                                  \
+      delete cur;                                                             \
+      cur = next;                                                             \
+    }                                                                         \
+  }
+
 #endif /* nsContentUtils_h___ */

content/base/src/nsImageLoadingContent.h

@@ -46,9 +46,11 @@
 #define nsImageLoadingContent_h__
 
 #include "nsIImageLoadingContent.h"
+#include "nsINode.h"
 #include "imgIRequest.h"
 #include "prtypes.h"
 #include "nsCOMPtr.h"
+#include "nsContentUtils.h"
 #include "nsString.h"
 
 class nsIURI;
@@ -163,7 +165,7 @@ private:
     ~ImageObserver()
     {
       MOZ_COUNT_DTOR(ImageObserver);
-      delete mNext;
+      NS_CONTENT_DELETE_LIST_MEMBER(ImageObserver, this, mNext);
     }
 
     nsCOMPtr<imgIDecoderObserver> mObserver;

content/xbl/src/nsXBLProtoImplField.cpp

@@ -71,7 +71,7 @@ nsXBLProtoImplField::~nsXBLProtoImplField()
   if (mFieldText)
     nsMemory::Free(mFieldText);
   NS_Free(mName);
-  delete mNext;
+  NS_CONTENT_DELETE_LIST_MEMBER(nsXBLProtoImplField, this, mNext);
 }
 
 void 

content/xbl/src/nsXBLProtoImplMember.h

@@ -47,6 +47,7 @@
 #include "nsIJSRuntimeService.h"
 #include "nsIServiceManager.h"
 #include "nsReadableUtils.h"
+#include "nsContentUtils.h"
 #include "nsCycleCollectionParticipant.h"
 
 class nsIScriptContext;
@@ -99,7 +100,10 @@ class nsXBLProtoImplMember
 {
 public:
   nsXBLProtoImplMember(const PRUnichar* aName) :mNext(nsnull) { mName = ToNewUnicode(nsDependentString(aName)); }
-  virtual ~nsXBLProtoImplMember() { nsMemory::Free(mName); delete mNext; }
+  virtual ~nsXBLProtoImplMember() {
+    nsMemory::Free(mName);
+    NS_CONTENT_DELETE_LIST_MEMBER(nsXBLProtoImplMember, this, mNext);
+  }
 
   nsXBLProtoImplMember* GetNext() { return mNext; }
   void SetNext(nsXBLProtoImplMember* aNext) { mNext = aNext; }

content/xbl/src/nsXBLProtoImplMethod.h

@@ -59,7 +59,7 @@ struct nsXBLParameter {
   ~nsXBLParameter() {
     MOZ_COUNT_DTOR(nsXBLParameter);
     nsMemory::Free(mName);
-    delete mNext;
+    NS_CONTENT_DELETE_LIST_MEMBER(nsXBLParameter, this, mNext);
   }
 };
 

content/xbl/src/nsXBLPrototypeBinding.cpp

@@ -123,7 +123,9 @@ protected:
       mDstNameSpace(aDstNameSpace),
       mNext(nsnull) { }
 
-  ~nsXBLAttributeEntry() { delete mNext; }
+  ~nsXBLAttributeEntry() {
+    NS_CONTENT_DELETE_LIST_MEMBER(nsXBLAttributeEntry, this, mNext);
+  }
 
 private:
   // Hide so that only Create() and Destroy() can be used to

content/xbl/src/nsXBLPrototypeHandler.cpp

@@ -67,7 +67,6 @@
 #include "nsPIWindowRoot.h"
 #include "nsIDOMWindowInternal.h"
 #include "nsIServiceManager.h"
-#include "nsContentUtils.h"
 #include "nsIScriptError.h"
 #include "nsXPIDLString.h"
 #include "nsReadableUtils.h"
@@ -156,7 +155,7 @@ nsXBLPrototypeHandler::~nsXBLPrototypeHandler()
   }
 
   // We own the next handler in the chain, so delete it now.
-  delete mNextHandler;
+  NS_CONTENT_DELETE_LIST_MEMBER(nsXBLPrototypeHandler, this, mNextHandler);
 }
 
 already_AddRefed<nsIContent>

content/xbl/src/nsXBLResourceLoader.h

@@ -39,6 +39,7 @@
 #include "nsCOMPtr.h"
 #include "nsICSSLoaderObserver.h"
 #include "nsCOMArray.h"
+#include "nsContentUtils.h"
 #include "nsCycleCollectionParticipant.h"
 
 class nsIContent;
@@ -66,7 +67,7 @@ struct nsXBLResource {
 
   ~nsXBLResource() { 
     MOZ_COUNT_DTOR(nsXBLResource);  
-    delete mNext; 
+    NS_CONTENT_DELETE_LIST_MEMBER(nsXBLResource, this, mNext);
   }
 };