notify parent form when a form element is removed. bugs 23493, 24452, and probably a lot of undiagnosed instabilities. r:vidur,pollman,waterson and a cast of thousands

content/html/content/src/nsHTMLButtonElement.cpp

@@ -520,22 +520,28 @@ nsHTMLButtonElement::GetType(PRInt32* aType)
 NS_IMETHODIMP
 nsHTMLButtonElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
   NS_IF_RELEASE(mForm);
-  if (nsnull == aForm) {
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+  else {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

content/html/content/src/nsHTMLFieldSetElement.cpp

@@ -204,22 +204,28 @@ nsHTMLFieldSetElement::GetForm(nsIDOMHTMLFormElement** aForm)
 NS_IMETHODIMP
 nsHTMLFieldSetElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-	if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

content/html/content/src/nsHTMLFormElement.cpp

@@ -197,18 +197,19 @@ nsHTMLFormElement::nsHTMLFormElement(nsIAtom* aTag)
 
 nsHTMLFormElement::~nsHTMLFormElement()
 {
-
   // set the controls to have no form
   PRUint32 numControls;
   GetElementCount(&numControls);
-  for (PRUint32 i = 0; i < numControls; i++) {
+  do {
+    if (numControls-- == 0)
+      break;
     // avoid addref to child
-    nsIFormControl* control = (nsIFormControl*)mControls->mElements.ElementAt(i); 
+    nsIFormControl* control = (nsIFormControl*)mControls->mElements.ElementAt(numControls); 
     if (control) {
       // it is assummed that passing in nsnull will not release formControl's previous form
       control->SetForm(nsnull); 
     }
-  }
+  } while(1);
 
   mControls->SetForm(nsnull);
   NS_RELEASE(mControls);

content/html/content/src/nsHTMLInputElement.cpp

@@ -1031,22 +1031,28 @@ nsHTMLInputElement::GetAttributeMappingFunctions(nsMapAttributesFunc& aFontMapFu
 NS_IMETHODIMP
 nsHTMLInputElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-	if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

content/html/content/src/nsHTMLLabelElement.cpp

@@ -212,22 +212,28 @@ nsHTMLLabelElement::GetForm(nsIDOMHTMLFormElement** aForm)
 NS_IMETHODIMP
 nsHTMLLabelElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-	if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

content/html/content/src/nsHTMLSelectElement.cpp

@@ -859,22 +859,28 @@ nsHTMLSelectElement::GetType(PRInt32* aType)
 NS_IMETHODIMP
 nsHTMLSelectElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-  if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

content/html/content/src/nsHTMLTextAreaElement.cpp

@@ -517,22 +517,28 @@ nsHTMLTextAreaElement::GetType(PRInt32* aType)
 NS_IMETHODIMP
 nsHTMLTextAreaElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-  if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

layout/html/content/src/nsHTMLButtonElement.cpp

@@ -520,22 +520,28 @@ nsHTMLButtonElement::GetType(PRInt32* aType)
 NS_IMETHODIMP
 nsHTMLButtonElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
   NS_IF_RELEASE(mForm);
-  if (nsnull == aForm) {
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+  else {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

layout/html/content/src/nsHTMLFieldSetElement.cpp

@@ -204,22 +204,28 @@ nsHTMLFieldSetElement::GetForm(nsIDOMHTMLFormElement** aForm)
 NS_IMETHODIMP
 nsHTMLFieldSetElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-	if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

layout/html/content/src/nsHTMLFormElement.cpp

@@ -197,18 +197,19 @@ nsHTMLFormElement::nsHTMLFormElement(nsIAtom* aTag)
 
 nsHTMLFormElement::~nsHTMLFormElement()
 {
-
   // set the controls to have no form
   PRUint32 numControls;
   GetElementCount(&numControls);
-  for (PRUint32 i = 0; i < numControls; i++) {
+  do {
+    if (numControls-- == 0)
+      break;
     // avoid addref to child
-    nsIFormControl* control = (nsIFormControl*)mControls->mElements.ElementAt(i); 
+    nsIFormControl* control = (nsIFormControl*)mControls->mElements.ElementAt(numControls); 
     if (control) {
       // it is assummed that passing in nsnull will not release formControl's previous form
       control->SetForm(nsnull); 
     }
-  }
+  } while(1);
 
   mControls->SetForm(nsnull);
   NS_RELEASE(mControls);

layout/html/content/src/nsHTMLInputElement.cpp

@@ -1031,22 +1031,28 @@ nsHTMLInputElement::GetAttributeMappingFunctions(nsMapAttributesFunc& aFontMapFu
 NS_IMETHODIMP
 nsHTMLInputElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-	if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

layout/html/content/src/nsHTMLLabelElement.cpp

@@ -212,22 +212,28 @@ nsHTMLLabelElement::GetForm(nsIDOMHTMLFormElement** aForm)
 NS_IMETHODIMP
 nsHTMLLabelElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-	if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

layout/html/content/src/nsHTMLSelectElement.cpp

@@ -859,22 +859,28 @@ nsHTMLSelectElement::GetType(PRInt32* aType)
 NS_IMETHODIMP
 nsHTMLSelectElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-  if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }
 

layout/html/content/src/nsHTMLTextAreaElement.cpp

@@ -517,22 +517,28 @@ nsHTMLTextAreaElement::GetType(PRInt32* aType)
 NS_IMETHODIMP
 nsHTMLTextAreaElement::SetForm(nsIDOMHTMLFormElement* aForm)
 {
-  nsresult result = NS_OK;
-  if (nsnull == aForm) {
+  nsresult result;
+  nsIFormControl *formControl;
+
+  result = QueryInterface(kIFormControlIID, (void**)&formControl);
+  if (NS_FAILED(result))
+    formControl = nsnull;
+
+  if (mForm && formControl)
+    mForm->RemoveElement(formControl, PR_TRUE);
+
+  if (nsnull == aForm)
     mForm = nsnull;
-    return NS_OK;
-  } else {
+  else {
     NS_IF_RELEASE(mForm);
-    nsIFormControl* formControl = nsnull;
-    result = QueryInterface(kIFormControlIID, (void**)&formControl);
-    if ((NS_OK == result) && formControl) {
+    if (formControl) {
       result = aForm->QueryInterface(kIFormIID, (void**)&mForm); // keep the ref
       if ((NS_OK == result) && mForm) {
         mForm->AddElement(formControl);
       }
-      NS_RELEASE(formControl);
     }
   }
+  NS_IF_RELEASE(formControl);
   return result;
 }