Bug 177533, fix most XMLHttpRequest memory leaks and other minor issues, r=darin, sr=jst, a=asa.

content/base/src/nsXMLHttpRequest.cpp

@@ -132,8 +132,6 @@ nsXMLHttpRequest::nsXMLHttpRequest()
     mCrossSiteAccessEnabled(PR_FALSE),
     mLoopingForSyncLoad(PR_FALSE)
 {
-  mEventQService = do_GetService(kEventQueueServiceCID);
-
   // Keep this last so that everything is initialized by the time we call this
   ChangeState(XML_HTTP_REQUEST_UNINITIALIZED, PR_FALSE);
 }
@@ -243,6 +241,7 @@ nsXMLHttpRequest::GetOnreadystatechange(nsIOnReadystatechangeHandler * *aOnready
   NS_ENSURE_ARG_POINTER(aOnreadystatechange);
 
   *aOnreadystatechange = mOnReadystatechangeListener;
+  NS_IF_ADDREF(*aOnreadystatechange);
 
   return NS_OK;
 }
@@ -265,6 +264,7 @@ nsXMLHttpRequest::GetOnload(nsIDOMEventListener * *aOnLoad)
   NS_ENSURE_ARG_POINTER(aOnLoad);
 
   *aOnLoad = mOnLoadListener;
+  NS_IF_ADDREF(*aOnLoad);
 
   return NS_OK;
 }
@@ -286,6 +286,7 @@ nsXMLHttpRequest::GetOnerror(nsIDOMEventListener * *aOnerror)
   NS_ENSURE_ARG_POINTER(aOnerror);
 
   *aOnerror = mOnErrorListener;
+  NS_IF_ADDREF(*aOnerror);
 
   return NS_OK;
 }
@@ -941,6 +942,7 @@ nsXMLHttpRequest::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult
   mXMLParserStreamListener = nsnull;
   mReadRequest = nsnull;
   mContext = nsnull;
+  mChannel->SetNotificationCallbacks(nsnull);
 
   if (NS_FAILED(status)) {
     // This can happen if the user leaves the page while the request was still
@@ -1011,6 +1013,7 @@ nsXMLHttpRequest::RequestCompleted()
     return NS_ERROR_FAILURE;
   }
   privevent->SetTarget(this);
+  privevent->SetCurrentTarget(this);
 
   // We might have been sent non-XML data. If that was the case,
   // we should null out the document member. The idea in this
@@ -1187,7 +1190,7 @@ nsXMLHttpRequest::Send(nsIVariant *aBody)
   }
 
   // Create an empty document from it (resets current document as well)
-  nsAutoString emptyStr;
+  nsString emptyStr;
   rv = implementation->CreateDocument(emptyStr, 
                                       emptyStr, 
                                       nsnull, 
@@ -1222,7 +1225,8 @@ nsXMLHttpRequest::Send(nsIVariant *aBody)
 
   if (!mAsync) {
     if(!mEventQService) {
-      return NS_ERROR_FAILURE;
+      mEventQService = do_GetService(kEventQueueServiceCID, &rv);
+      NS_ENSURE_SUCCESS(rv, NS_ERROR_FAILURE);
     }
 
     mLoopingForSyncLoad = PR_TRUE;