283198 - nsBrowserContentListener never removed as parent content listener

Status: RESOLVED INVALID

(SeaMonkey :: Help Documentation, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Docshells hold a weak ref to the parent content listener.  So the parent content
listener needs to be explicitly nulled out before it goes away (so before the
JSObject is destroyed).  Not doing that is generally a good way to have
intermittent crashes.

And yes, I know that I sr'ed this code.  I suck, what can I say?  :(

Comment 1

[[e-mail]]

helpContentListener implements nsISupportsWeakReference so that the
nsDSURIContentListener's nsWeakPtr should get cleared automatically.

Comment 2

[Boris Zbarsky [:bzbarsky]]

> helpContentListener implements nsISupportsWeakReference 

I see no implementation of GetWeakReference() on it, so no, it does not.  The
back end code can't get an nsIWeakReference, so assumes that
nsISupportsWeakReference is not implemented (which it's not, in this case), and
falls back to holding the raw ptr.

Comment 3

[Boris Zbarsky [:bzbarsky]]

OK, nevermind... I'm told this interface is magicked by xpconnect...

Comment 4

[[e-mail]]

Yes, it's very magic; if the wrapper has a strong reference then the JS object
is rooted so that it doesn't get garbage collected, otherwise if the wrapper has
a weak ref then it's not deleted until the JS object is garbage collected.