1128358 - nsCSSFrameConstructor::AddFCItemsForAnonymousContent leaks ContentInfo::mStyleContext

Status: RESOLVED INVALID

(Core :: Layout, defect)

Description

[Cameron McCormack (:heycam)]

Attachment: patch

nsCSSFrameConstructor::AddFCItemsForAnonymousContent calls forget on nsIAnonymousContentCreator::ContentInfo::mStyleContext and assigning that directly to an nsRefPtr.  This leaks the style context.

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 8557679 [details] [diff] [review]
patch

Review of attachment 8557679 [details] [diff] [review]:
-----------------------------------------------------------------

::: layout/base/nsCSSFrameConstructor.cpp
@@ +10259,5 @@
>      nsRefPtr<nsStyleContext> styleContext;
>      TreeMatchContext::AutoParentDisplayBasedStyleFixupSkipper
>        parentDisplayBasedStyleFixupSkipper(aState.mTreeMatchContext);
>      if (aAnonymousItems[i].mStyleContext) {
> +      styleContext = Move(aAnonymousItems[i].mStyleContext);

I feel stupid but I don't understand the problem here. forget() clears mStyleContext and returns an already_AddRefed<nsStyleContext>. We store that in styleContxt. So no refcounts are changed and the ref is moved. What's wrong with the current code?

Comment 2

[Cameron McCormack (:heycam)]

Ah, my mistake.  I looked up forget() on nsAutoPtr, not nsRefPtr, and saw that it returned a raw pointer.