If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

nsCSSFrameConstructor::AddFCItemsForAnonymousContent leaks ContentInfo::mStyleContext

RESOLVED INVALID

Status

()

Core
Layout
RESOLVED INVALID
3 years ago
3 years ago

People

(Reporter: heycam, Unassigned)

Tracking

Trunk
x86_64
All
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

Created attachment 8557679 [details] [diff] [review]
patch

nsCSSFrameConstructor::AddFCItemsForAnonymousContent calls forget on nsIAnonymousContentCreator::ContentInfo::mStyleContext and assigning that directly to an nsRefPtr.  This leaks the style context.
Attachment #8557679 - Flags: review?(roc)
Comment on attachment 8557679 [details] [diff] [review]
patch

Review of attachment 8557679 [details] [diff] [review]:
-----------------------------------------------------------------

::: layout/base/nsCSSFrameConstructor.cpp
@@ +10259,5 @@
>      nsRefPtr<nsStyleContext> styleContext;
>      TreeMatchContext::AutoParentDisplayBasedStyleFixupSkipper
>        parentDisplayBasedStyleFixupSkipper(aState.mTreeMatchContext);
>      if (aAnonymousItems[i].mStyleContext) {
> +      styleContext = Move(aAnonymousItems[i].mStyleContext);

I feel stupid but I don't understand the problem here. forget() clears mStyleContext and returns an already_AddRefed<nsStyleContext>. We store that in styleContxt. So no refcounts are changed and the ref is moved. What's wrong with the current code?
Attachment #8557679 - Flags: review?(roc)
Ah, my mistake.  I looked up forget() on nsAutoPtr, not nsRefPtr, and saw that it returned a raw pointer.
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.