From 37a15f9f78091a38f940f8cdb58c737cf251e972 Mon Sep 17 00:00:00 2001
From: Chris Jones <jones.chris.g@gmail.com>
Date: Sat, 15 May 2010 00:27:52 -0500
Subject: [PATCH] Bug 566057: Remove obsolete managee tracking code in
 ContentProcessChild that's leading to use-after-free errors. r=jduell

---
 dom/ipc/ContentProcessChild.cpp | 32 +++++---------------------------
 dom/ipc/ContentProcessChild.h   |  7 -------
 2 files changed, 5 insertions(+), 34 deletions(-)

diff --git a/dom/ipc/ContentProcessChild.cpp b/dom/ipc/ContentProcessChild.cpp
index 7a16784ce1f..4b899359822 100644
--- a/dom/ipc/ContentProcessChild.cpp
+++ b/dom/ipc/ContentProcessChild.cpp
@@ -61,7 +61,6 @@ namespace dom {
 ContentProcessChild* ContentProcessChild::sSingleton;
 
 ContentProcessChild::ContentProcessChild()
-    : mQuit(PR_FALSE)
 {
 }
 
@@ -86,37 +85,27 @@ PIFrameEmbeddingChild*
 ContentProcessChild::AllocPIFrameEmbedding()
 {
   nsRefPtr<TabChild> iframe = new TabChild();
-  NS_ENSURE_TRUE(iframe && NS_SUCCEEDED(iframe->Init()) &&
-                 mIFrames.AppendElement(iframe),
-                 nsnull);
-  return iframe.forget().get();
+  return NS_SUCCEEDED(iframe->Init()) ? iframe.forget().get() : NULL;
 }
 
 bool
 ContentProcessChild::DeallocPIFrameEmbedding(PIFrameEmbeddingChild* iframe)
 {
-    if (mIFrames.RemoveElement(iframe)) {
-      TabChild* child = static_cast<TabChild*>(iframe);
-      NS_RELEASE(child);
-    }
+    TabChild* child = static_cast<TabChild*>(iframe);
+    NS_RELEASE(child);
     return true;
 }
 
 PTestShellChild*
 ContentProcessChild::AllocPTestShell()
 {
-    PTestShellChild* testshell = new TestShellChild();
-    if (testshell && mTestShells.AppendElement(testshell)) {
-        return testshell;
-    }
-    delete testshell;
-    return nsnull;
+    return new TestShellChild();
 }
 
 bool
 ContentProcessChild::DeallocPTestShell(PTestShellChild* shell)
 {
-    mTestShells.RemoveElement(shell);
+    delete shell;
     return true;
 }
 
@@ -163,23 +152,12 @@ ContentProcessChild::RecvSetOffline(const PRBool& offline)
   return true;
 }
 
-void
-ContentProcessChild::Quit()
-{
-    NS_ASSERTION(mQuit, "Exiting uncleanly!");
-    mIFrames.Clear();
-    mTestShells.Clear();
-}
-
 void
 ContentProcessChild::ActorDestroy(ActorDestroyReason why)
 {
     if (AbnormalShutdown == why)
         NS_WARNING("shutting down because of crash!");
 
-    mQuit = PR_TRUE;
-    Quit();
-
     XRE_ShutdownChildProcess();
 }
 
diff --git a/dom/ipc/ContentProcessChild.h b/dom/ipc/ContentProcessChild.h
index 565f76468cd..09b987ce388 100644
--- a/dom/ipc/ContentProcessChild.h
+++ b/dom/ipc/ContentProcessChild.h
@@ -89,15 +89,8 @@ private:
     NS_OVERRIDE
     virtual void ActorDestroy(ActorDestroyReason why);
 
-    void Quit();
-
     static ContentProcessChild* sSingleton;
 
-    nsTArray<PIFrameEmbeddingChild* > mIFrames;
-    nsTArray<nsAutoPtr<PTestShellChild> > mTestShells;
-
-    PRBool mQuit;
-
     DISALLOW_EVIL_CONSTRUCTORS(ContentProcessChild);
 };