bug 512260 - part 4 - call nsDocument::AddImage and RemoveImage on images stored in nsStyleContentData.r=dbaron,a=blocker

layout/style/nsRuleNode.cpp

@@ -5848,6 +5848,14 @@ nsRuleNode::ComputeContentData(void* aStartStruct,
              SETCOORD_CALC_LENGTH_ONLY,
            aContext, mPresContext, canStoreInRuleTree);
 
+  // If we ended up with an image, track it.
+  for (PRUint32 i = 0; i < content->ContentCount(); ++i) {
+    if ((content->ContentAt(i).mType == eStyleContentType_Image) &&
+        content->ContentAt(i).mContent.mImage) {
+      content->ContentAt(i).TrackImage(aContext->PresContext());
+    }
+  }
+
   COMPUTE_END_RESET(Content, content)
 }
 

layout/style/nsStyleStruct.cpp

@@ -2120,6 +2120,8 @@ nsChangeHint nsStyleVisibility::MaxDifference()
 
 nsStyleContentData::~nsStyleContentData()
 {
+  NS_ABORT_IF_FALSE(!mImageTracked,
+                    "nsStyleContentData being destroyed while still tracking image!");
   if (mType == eStyleContentType_Image) {
     NS_IF_RELEASE(mContent.mImage);
   } else if (mType == eStyleContentType_Counter ||
@@ -2175,6 +2177,49 @@ PRBool nsStyleContentData::operator==(const nsStyleContentData& aOther) const
   return nsCRT::strcmp(mContent.mString, aOther.mContent.mString) == 0;
 }
 
+void
+nsStyleContentData::TrackImage(nsPresContext* aContext)
+{
+  // Sanity
+  NS_ABORT_IF_FALSE(!mImageTracked, "Already tracking image!");
+  NS_ABORT_IF_FALSE(mType == eStyleContentType_Image,
+                    "Tryingto do image tracking on non-image!");
+  NS_ABORT_IF_FALSE(mContent.mImage,
+                    "Can't track image when there isn't one!");
+
+  // Register the image with the document
+  nsIDocument* doc = aContext->Document();
+  if (doc)
+    doc->AddImage(mContent.mImage);
+
+  // Mark state
+#ifdef DEBUG
+  mImageTracked = true;
+#endif
+}
+
+void
+nsStyleContentData::UntrackImage(nsPresContext* aContext)
+{
+  // Sanity
+  NS_ABORT_IF_FALSE(mImageTracked, "Image not tracked!");
+  NS_ABORT_IF_FALSE(mType == eStyleContentType_Image,
+                    "Trying to do image tracking on non-image!");
+  NS_ABORT_IF_FALSE(mContent.mImage,
+                    "Can't untrack image when there isn't one!");
+
+  // Unregister the image with the document
+  nsIDocument* doc = aContext->Document();
+  if (doc)
+    doc->RemoveImage(mContent.mImage);
+
+  // Mark state
+#ifdef DEBUG
+  mImageTracked = false;
+#endif
+}
+
+
 //-----------------------
 // nsStyleContent
 //
@@ -2200,6 +2245,21 @@ nsStyleContent::~nsStyleContent(void)
   DELETE_ARRAY_IF(mResets);
 }
 
+void 
+nsStyleContent::Destroy(nsPresContext* aContext)
+{
+  // Unregister any images we might have with the document.
+  for (PRUint32 i = 0; i < mContentCount; ++i) {
+    if ((mContents[i].mType == eStyleContentType_Image) &&
+        mContents[i].mContent.mImage) {
+      mContents[i].UntrackImage(aContext);
+    }
+  }
+
+  this->~nsStyleContent();
+  aContext->FreeToShell(sizeof(nsStyleContent), this);
+}
+
 nsStyleContent::nsStyleContent(const nsStyleContent& aSource)
    :mMarkerOffset(),
     mContents(nsnull),

layout/style/nsStyleStruct.h

@@ -1486,8 +1486,17 @@ struct nsStyleContentData {
     imgIRequest *mImage;
     nsCSSValue::Array* mCounters;
   } mContent;
+#ifdef DEBUG
+  bool mImageTracked;
+#endif
+
+  nsStyleContentData()
+    : mType(nsStyleContentType(0))
+#ifdef DEBUG
+    , mImageTracked(false)
+#endif
+  { mContent.mString = nsnull; }
 
-  nsStyleContentData() : mType(nsStyleContentType(0)) { mContent.mString = nsnull; }
   ~nsStyleContentData();
   nsStyleContentData& operator=(const nsStyleContentData& aOther);
   PRBool operator==(const nsStyleContentData& aOther) const;
@@ -1496,9 +1505,14 @@ struct nsStyleContentData {
     return !(*this == aOther);
   }
 
+  void TrackImage(nsPresContext* aContext);
+  void UntrackImage(nsPresContext* aContext);
+
   void SetImage(imgIRequest* aRequest)
   {
-    NS_ASSERTION(mType == eStyleContentType_Image, "Wrong type!");
+    NS_ABORT_IF_FALSE(!mImageTracked,
+                      "Setting a new image without untracking the old one!");
+    NS_ABORT_IF_FALSE(mType == eStyleContentType_Image, "Wrong type!");
     NS_IF_ADDREF(mContent.mImage = aRequest);
   }
 private:
@@ -1595,10 +1609,7 @@ struct nsStyleContent {
   void* operator new(size_t sz, nsPresContext* aContext) CPP_THROW_NEW {
     return aContext->AllocateFromShell(sz);
   }
-  void Destroy(nsPresContext* aContext) {
-    this->~nsStyleContent();
-    aContext->FreeToShell(sizeof(nsStyleContent), this);
-  }
+  void Destroy(nsPresContext* aContext);
 
   nsChangeHint CalcDifference(const nsStyleContent& aOther) const;
 #ifdef DEBUG