Bug 413447 - "nsXBLDocumentInfo can keep closed global window alive". r=jst, sr=sicking, a=blocking1.9+. Relanding.

content/xbl/src/nsXBLPrototypeBinding.cpp

@@ -368,12 +368,6 @@ nsXBLPrototypeBinding::UnlinkJSObjects()
 {
   if (mImplementation)
     mImplementation->UnlinkJSObjects();
-
-  nsXBLPrototypeHandler* curr = mPrototypeHandler;
-  while (curr) {
-    curr->UnlinkJSObjects();
-    curr = curr->GetNextHandler();
-  }
 }
 
 void
@@ -381,12 +375,6 @@ nsXBLPrototypeBinding::Trace(TraceCallback aCallback, void *aClosure) const
 {
   if (mImplementation)
     mImplementation->Trace(aCallback, aClosure);
-
-  nsXBLPrototypeHandler* curr = mPrototypeHandler;
-  while (curr) {
-    curr->Trace(aCallback, aClosure);
-    curr = curr->GetNextHandler();
-  }
 }
 
 void

content/xbl/src/nsXBLPrototypeHandler.cpp

@@ -118,7 +118,6 @@ nsXBLPrototypeHandler::nsXBLPrototypeHandler(const PRUnichar* aEvent,
                                              PRUint32 aLineNumber)
   : mHandlerText(nsnull),
     mLineNumber(aLineNumber),
-    mCachedHandler(nsnull),
     mNextHandler(nsnull),
     mPrototypeBinding(aBinding)
 {
@@ -135,7 +134,6 @@ nsXBLPrototypeHandler::nsXBLPrototypeHandler(const PRUnichar* aEvent,
 nsXBLPrototypeHandler::nsXBLPrototypeHandler(nsIContent* aHandlerElement)
   : mHandlerElement(nsnull),
     mLineNumber(0),
-    mCachedHandler(nsnull),
     mNextHandler(nsnull),
     mPrototypeBinding(nsnull)
 {
@@ -161,19 +159,6 @@ nsXBLPrototypeHandler::~nsXBLPrototypeHandler()
   delete mNextHandler;
 }
 
-void
-nsXBLPrototypeHandler::Trace(TraceCallback aCallback, void *aClosure) const
-{
-  if (mCachedHandler)
-    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mCachedHandler, aClosure);
-}
-
-void
-nsXBLPrototypeHandler::UnlinkJSObjects()
-{
-  ForgetCachedHandler();
-}
-
 already_AddRefed<nsIContent>
 nsXBLPrototypeHandler::GetHandlerElement()
 {
@@ -196,11 +181,9 @@ nsXBLPrototypeHandler::AppendHandlerText(const nsAString& aText)
     mHandlerText = ToNewUnicode(nsDependentString(temp) + aText);
     nsMemory::Free(temp);
   }
-  else
+  else {
     mHandlerText = ToNewUnicode(aText);
-
-  // Remove our cached handler
-  ForgetCachedHandler();
+  }
 }
 
 /////////////////////////////////////////////////////////////////////////////
@@ -369,15 +352,12 @@ nsXBLPrototypeHandler::EnsureEventHandler(nsIScriptGlobalObject* aGlobal,
                                           nsScriptObjectHolder &aHandler)
 {
   // Check to see if we've already compiled this
-  if (mCachedHandler) {
-    nsCOMPtr<nsIScriptGlobalObject> cachedGlobal =
-      do_QueryReferent(mGlobalForCachedHandler);
-    if (cachedGlobal == aGlobal) {
-      aHandler.set(mCachedHandler);
-      if (!aHandler)
-        return NS_ERROR_FAILURE;
-  
-      return NS_OK;
+  nsCOMPtr<nsPIDOMWindow> pWindow = do_QueryInterface(aGlobal);
+  if (pWindow) {
+    void* cachedHandler = pWindow->GetCachedXBLPrototypeHandler(this);
+    if (cachedHandler) {
+      aHandler.set(cachedHandler);
+      return aHandler ? NS_OK : NS_ERROR_FAILURE;
     }
   }
 
@@ -398,8 +378,9 @@ nsXBLPrototypeHandler::EnsureEventHandler(nsIScriptGlobalObject* aGlobal,
                                                    mLineNumber, aHandler);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  mCachedHandler = aHandler;
-  mGlobalForCachedHandler = do_GetWeakReference(aGlobal);
+  if (pWindow) {
+    pWindow->CacheXBLPrototypeHandler(this, aHandler);
+  }
 
   return NS_OK;
 }
@@ -871,7 +852,6 @@ nsXBLPrototypeHandler::ConstructPrototype(nsIContent* aKeyElement,
   mMisc = 0;
   mKeyMask = 0;
   mPhase = NS_PHASE_BUBBLING;
-  ForgetCachedHandler();
 
   if (aAction)
     mHandlerText = ToNewUnicode(nsDependentString(aAction));

content/xbl/src/nsXBLPrototypeHandler.h

@@ -153,9 +153,6 @@ public:
     return (mType & NS_HANDLER_ALLOW_UNTRUSTED) != 0;
   }
 
-  void Trace(TraceCallback aCallback, void *aClosure) const;
-  void UnlinkJSObjects();
-	
 public:
   static PRUint32 gRefCnt;
   
@@ -180,11 +177,6 @@ protected:
   nsresult EnsureEventHandler(nsIScriptGlobalObject* aGlobal,
                               nsIScriptContext *aBoundContext, nsIAtom *aName,
                               nsScriptObjectHolder &aHandler);
-  void ForgetCachedHandler()
-  {
-    mCachedHandler = nsnull;
-    mGlobalForCachedHandler = nsnull;
-  }
   static PRInt32 KeyToMask(PRInt32 key);
   
   static PRInt32 kAccelKey;
@@ -230,10 +222,6 @@ protected:
   PRInt32 mDetail;           // For key events, contains a charcode or keycode. For
                              // mouse events, stores the button info.
 
-  // cache a handler to avoid compiling each time
-  void *mCachedHandler;
-  nsWeakPtr mGlobalForCachedHandler;
-
   // Prototype handlers are chained. We own the next handler in the chain.
   nsXBLPrototypeHandler* mNextHandler;
   nsCOMPtr<nsIAtom> mEventName; // The type of the event, e.g., "keypress"

dom/public/base/nsPIDOMWindow.h

@@ -70,6 +70,8 @@ class nsIDocument;
 class nsIScriptTimeoutHandler;
 class nsPresContext;
 struct nsTimeout;
+class nsScriptObjectHolder;
+class nsXBLPrototypeHandler;
 
 #define NS_PIDOMWINDOW_IID \
 { 0x909852b5, 0xb9e6, 0x4d94, \
@@ -379,6 +381,10 @@ public:
    */
   virtual void InitJavaProperties() = 0;
 
+  virtual void* GetCachedXBLPrototypeHandler(nsXBLPrototypeHandler* aKey) = 0;
+  virtual void CacheXBLPrototypeHandler(nsXBLPrototypeHandler* aKey,
+                                        nsScriptObjectHolder& aHandler) = 0;
+
 protected:
   // The nsPIDOMWindow constructor. The aOuterWindow argument should
   // be null if and only if the created window itself is an outer

dom/src/base/nsGlobalWindow.cpp

@@ -580,7 +580,6 @@ nsTimeout::~nsTimeout()
   MOZ_COUNT_DTOR(nsTimeout);
 }
 
-
   
 //*****************************************************************************
 //***    nsGlobalWindow: Object Management
@@ -753,6 +752,23 @@ nsGlobalWindow::ShutDown()
   NS_IF_RELEASE(sComputedDOMStyleFactory);
 }
 
+// static
+void
+nsGlobalWindow::CleanupCachedXBLHandlers(nsGlobalWindow* aWindow)
+{
+  if (aWindow->mCachedXBLPrototypeHandlers.IsInitialized() &&
+      aWindow->mCachedXBLPrototypeHandlers.Count() > 0) {
+    aWindow->mCachedXBLPrototypeHandlers.Clear();
+
+    nsCOMPtr<nsISupports> supports;
+    aWindow->QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
+                            getter_AddRefs(supports));
+    NS_ASSERTION(supports, "Failed to QI to nsCycleCollectionISupports?!");
+
+    nsContentUtils::DropJSObjects(supports);
+  }
+}
+
 void
 nsGlobalWindow::CleanUp()
 {
@@ -798,6 +814,8 @@ nsGlobalWindow::CleanUp()
   mArguments = nsnull;
   mArgumentsLast = nsnull;
 
+  CleanupCachedXBLHandlers(this);
+
 #ifdef DEBUG
   nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 #endif
@@ -882,6 +900,8 @@ nsGlobalWindow::FreeInnerObjects(PRBool aClearScope)
   }
 #endif
 
+  CleanupCachedXBLHandlers(this);
+
 #ifdef DEBUG
   nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 #endif
@@ -988,6 +1008,33 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGlobalWindow)
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
+struct TraceData
+{
+  TraceData(TraceCallback& aCallback, void* aClosure) :
+    callback(aCallback), closure(aClosure) {}
+
+  TraceCallback& callback;
+  void* closure;
+};
+
+PR_STATIC_CALLBACK(PLDHashOperator)
+TraceXBLHandlers(const void* aKey, void* aData, void* aClosure)
+{
+  TraceData* data = static_cast<TraceData*>(aClosure);
+  data->callback(nsIProgrammingLanguage::JAVASCRIPT, aData, data->closure);
+  return PL_DHASH_NEXT;
+}
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsGlobalWindow)
+  if (tmp->mCachedXBLPrototypeHandlers.IsInitialized()) {
+    TraceData data(aCallback, aClosure);
+    tmp->mCachedXBLPrototypeHandlers.EnumerateRead(TraceXBLHandlers, &data);
+  }
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsGlobalWindow)
+  nsGlobalWindow::CleanupCachedXBLHandlers(tmp);
+NS_IMPL_CYCLE_COLLECTION_ROOT_END
 
 //*****************************************************************************
 // nsGlobalWindow::nsIScriptGlobalObject
@@ -5536,6 +5583,49 @@ nsGlobalWindow::InitJavaProperties()
 #endif
 }
 
+void*
+nsGlobalWindow::GetCachedXBLPrototypeHandler(nsXBLPrototypeHandler* aKey)
+{
+  void* handler = nsnull;
+  if (mCachedXBLPrototypeHandlers.IsInitialized()) {
+    mCachedXBLPrototypeHandlers.Get(aKey, &handler);
+  }
+  return handler;
+}
+
+void
+nsGlobalWindow::CacheXBLPrototypeHandler(nsXBLPrototypeHandler* aKey,
+                                         nsScriptObjectHolder& aHandler)
+{
+  if (!mCachedXBLPrototypeHandlers.IsInitialized() &&
+      !mCachedXBLPrototypeHandlers.Init()) {
+    NS_ERROR("Failed to initiailize hashtable!");
+    return;
+  }
+
+  if (!mCachedXBLPrototypeHandlers.Count()) {
+    // Can't use macros to get the participant because nsGlobalChromeWindow also
+    // runs through this code. Use QueryInterface to get the correct objects.
+    nsXPCOMCycleCollectionParticipant* participant;
+    CallQueryInterface(this, &participant);
+    NS_ASSERTION(participant,
+                 "Failed to QI to nsXPCOMCycleCollectionParticipant!");
+
+    nsCOMPtr<nsISupports> thisSupports;
+    QueryInterface(NS_GET_IID(nsCycleCollectionISupports),
+                   getter_AddRefs(thisSupports));
+    NS_ASSERTION(thisSupports, "Failed to QI to nsCycleCollectionISupports!");
+
+    nsresult rv = nsContentUtils::HoldJSObjects(thisSupports, participant);
+    if (NS_FAILED(rv)) {
+      NS_ERROR("nsContentUtils::HoldJSObjects failed!");
+      return;
+    }
+  }
+
+  mCachedXBLPrototypeHandlers.Put(aKey, aHandler);
+}
+
 NS_IMETHODIMP
 nsGlobalWindow::GetFrameElement(nsIDOMElement** aFrameElement)
 {

dom/src/base/nsGlobalWindow.h

@@ -51,6 +51,7 @@
 #include "nsHashtable.h"
 #include "nsDataHashtable.h"
 #include "nsCycleCollectionParticipant.h"
+#include "nsDOMScriptObjectHolder.h"
 
 // Interfaces Needed
 #include "nsDOMWindowList.h"
@@ -410,6 +411,7 @@ public:
                    const PRUnichar* aData);
 
   static void ShutDown();
+  static void CleanupCachedXBLHandlers(nsGlobalWindow* aWindow);
   static PRBool IsCallerChrome();
   static void CloseBlockScriptTerminationFunc(nsISupports *aRef);
 
@@ -418,11 +420,19 @@ public:
 
   friend class WindowStateHolder;
 
-  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsGlobalWindow,
-                                           nsIScriptGlobalObject)
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsGlobalWindow,
+                                                         nsIScriptGlobalObject)
 
   void InitJavaProperties();
 
+  virtual NS_HIDDEN_(void*)
+    GetCachedXBLPrototypeHandler(nsXBLPrototypeHandler* aKey);
+
+  virtual NS_HIDDEN_(void)
+    CacheXBLPrototypeHandler(nsXBLPrototypeHandler* aKey,
+                             nsScriptObjectHolder& aHandler);
+
+
 protected:
   // Object Management
   virtual ~nsGlobalWindow();
@@ -722,6 +732,8 @@ protected:
 
   nsCOMPtr<nsIDOMOfflineResourceList> mApplicationCache;
 
+  nsDataHashtable<nsVoidPtrHashKey, void*> mCachedXBLPrototypeHandlers;
+
   friend class nsDOMScriptableHelper;
   friend class nsDOMWindowUtils;
   static nsIFactory *sComputedDOMStyleFactory;