From 4dd0535874ef1c4161774cb89aa04b2d3b8c6bea Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Tue, 16 Dec 2008 12:35:56 +0200
Subject: [PATCH]  Bug 469672 -  Destroy event target chain using a loop, not
 recursion, r+sr=jst

---
 content/events/src/nsEventDispatcher.cpp | 33 +++++++++---------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
index 30f2b943131..4308010ce10 100644
--- a/content/events/src/nsEventDispatcher.cpp
+++ b/content/events/src/nsEventDispatcher.cpp
@@ -57,8 +57,6 @@ private:
   nsEventTargetChainItem(nsPIDOMEventTarget* aTarget,
                          nsEventTargetChainItem* aChild = nsnull);
 
-  void Destroy(nsFixedSizeAllocator* aAllocator);
-
 public:
   static nsEventTargetChainItem* Create(nsFixedSizeAllocator* aAllocator, 
                                         nsPIDOMEventTarget* aTarget,
@@ -73,9 +71,18 @@ public:
   static void Destroy(nsFixedSizeAllocator* aAllocator,
                       nsEventTargetChainItem* aItem)
   {
-    aItem->Destroy(aAllocator);
-    aItem->~nsEventTargetChainItem();
-    aAllocator->Free(aItem, sizeof(nsEventTargetChainItem));
+    // ::Destroy deletes ancestor chain.
+    nsEventTargetChainItem* item = aItem;
+    if (item->mChild) {
+      item->mChild->mParent = nsnull;
+      item->mChild = nsnull;
+    }
+    while (item) {
+      nsEventTargetChainItem* parent = item->mParent;
+      item->~nsEventTargetChainItem();
+      aAllocator->Free(item, sizeof(nsEventTargetChainItem));
+      item = parent;
+    }
   }
 
   PRBool IsValid()
@@ -181,22 +188,6 @@ nsEventTargetChainItem::nsEventTargetChainItem(nsPIDOMEventTarget* aTarget,
   }
 }
 
-void
-nsEventTargetChainItem::Destroy(nsFixedSizeAllocator* aAllocator)
-{
-  if (mChild) {
-    mChild->mParent = nsnull;
-    mChild = nsnull;
-  }
-
-  if (mParent) {
-    Destroy(aAllocator, mParent);
-    mParent = nsnull;
-  }
-
-  mTarget = nsnull;
-}
-
 nsresult
 nsEventTargetChainItem::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
 {