Fix bug 305662: fix leakage of nsWebShell and entrained data by breaking a ref cycle between the docShell and nsISecureBrowserUI in a place that works for both embedders and the suite. r=bryner, sr=bz

docshell/base/nsDocShell.cpp

@@ -3442,6 +3442,9 @@ nsDocShell::Destroy()
         mContentListener->SetParentContentListener(nsnull);
     }
 
+    // required to break ref cycle
+    mSecurityUI = nsnull;
+    
     return NS_OK;
 }
 

docshell/base/nsWebShell.cpp

@@ -166,7 +166,7 @@ nsWebShell::nsWebShell() : nsDocShell()
   ++gNumberOfWebShells;
 #endif
 #ifdef DEBUG
-    printf("++WEBSHELL == %ld\n", gNumberOfWebShells);
+    printf("++WEBSHELL %p == %ld\n", this, gNumberOfWebShells);
 #endif
 
   mThread = nsnull;
@@ -195,7 +195,7 @@ nsWebShell::~nsWebShell()
   --gNumberOfWebShells;
 #endif
 #ifdef DEBUG
-  printf("--WEBSHELL == %ld\n", gNumberOfWebShells);
+  printf("--WEBSHELL %p == %ld\n", this, gNumberOfWebShells);
 #endif
 }
 

embedding/browser/webBrowser/nsWebBrowser.cpp

@@ -1215,6 +1215,9 @@ NS_IMETHODIMP nsWebBrowser::Create()
    rv = GetContentDOMWindow(getter_AddRefs(domWindow));
    if (NS_SUCCEEDED(rv))
    {
+       // this works because the implementation of nsISecureBrowserUI
+       // (nsSecureBrowserUIImpl) gets a docShell from the domWindow,
+       // and calls docShell->SetSecurityUI(this);
        nsCOMPtr<nsISecureBrowserUI> securityUI =
            do_CreateInstance(NS_SECURE_BROWSER_UI_CONTRACTID, &rv);
        if (NS_SUCCEEDED(rv)) securityUI->Init(domWindow);

toolkit/content/widgets/browser.xml

@@ -603,7 +603,6 @@
 
           this.detachFormFill();
           
-          this.securityUI = null;
           this._fastFind = null;
           this._webBrowserFind = null;