From a6107b00fbfe26c4edfebdf4982095def4b0883a Mon Sep 17 00:00:00 2001
From: Bjarne <bjarne@runitsoft.com>
Date: Sun, 2 May 2010 10:27:20 +0200
Subject: [PATCH] Bug 552651 - nsXMLHttpRequest leaks if aborted in state 3
 ("in progress"). r=sicking

---
 content/base/crashtests/552651.html     | 27 +++++++++++++++++++++++++
 content/base/crashtests/552651.xml      |  2 ++
 content/base/crashtests/crashtests.list |  1 +
 content/base/src/nsXMLHttpRequest.cpp   |  8 ++++++--
 4 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 content/base/crashtests/552651.html
 create mode 100644 content/base/crashtests/552651.xml
diff --git a/content/base/crashtests/552651.html b/content/base/crashtests/552651.html
new file mode 100644
index 00000000000..fc89e009804
--- /dev/null
+++ b/content/base/crashtests/552651.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+  <title>Testcase for bug 552651</title>
+  <script class="testbody" type="text/javascript">
+
+function testCancel() {
+  var xhr = new XMLHttpRequest();
+  xhr.addEventListener("readystatechange", function(e) {
+    if (xhr.readyState == 3) // NOTE : only leaks for state == 3
+      xhr.abort();
+  }, false);
+
+  xhr.open("GET", "552651.xml", true);
+  xhr.send();
+
+  setTimeout(function f() {
+      document.documentElement.className = "";
+  }, 1000);
+}
+</script>
+</head>
+<body onload="testCancel()">
+This test should not leak...
+</body>
+</html>
+
diff --git a/content/base/crashtests/552651.xml b/content/base/crashtests/552651.xml
new file mode 100644
index 00000000000..b04b966cfa6
--- /dev/null
+++ b/content/base/crashtests/552651.xml
@@ -0,0 +1,2 @@
+<foo>test</foo>
+
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 936f1ae0293..470c7b2274c 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -61,4 +61,5 @@ load 490760-1.xhtml
 load 494810-1.html
 load 529670.html
 load 554230-1.xhtml
+load 552651.html
 load 558973.html
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index ca270f60910..29526923c75 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -2100,9 +2100,13 @@ nsXMLHttpRequest::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult
     mRequestObserver->OnStopRequest(request, ctxt, status);
   }
 
-  // Don't do anything if we have been aborted
-  if (mState & XML_HTTP_REQUEST_UNINITIALIZED)
+  // make sure to notify the listener if we were aborted
+  // XXX in fact, why don't we do the cleanup below in this case??
+  if (mState & XML_HTTP_REQUEST_UNINITIALIZED) {
+    if (mXMLParserStreamListener)
+      (void) mXMLParserStreamListener->OnStopRequest(request, ctxt, status);
     return NS_OK;
+  }
 
   nsCOMPtr<nsIParser> parser;
 
