407074 - Leak PropItem and nsStringBuffer with execCommand("inserthtml", ...)

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect)

Description

[Jesse Ruderman]

Attachment: testcase

According to trace-refcnt shutdown information, this testcase makes Firefox leak two nsStringBuffer objects.

Comment 1

[Jesse Ruderman]

The leak happens because nsHTMLEditRules::CreateStyleForInsertText bails while it owned the PropItem |item| through a raw pointer.  In particular,

4378         res = mEditor->DeleteNode(leftNode);
4379         if (NS_FAILED(res)) return res;

gets an NS_ERROR_FAILURE and exits silently.  My patch fixes the leak by using nsAutoPtr<PropItem> for the owning pointer |item|, so we don't have to worry about doing "delete item;" on every exit path.

My patch also makes several debug-only changes: instrument PropItem and StyleCache so we see when they leak, and use NS_ENSURE_SUCCESS in CreateStyleForInsertText so that early bails aren't silent in debug builds.

Comment 2

[Jesse Ruderman]

Attachment: patch

Comment 3

[Peter Van der Beken [:peterv]]

Comment on attachment 292190 [details] [diff] [review]
patch

>+  StyleCache() : PropItem(nsnull, EmptyString(), EmptyString()), mPresent(PR_FALSE) {

Seems like that could just use PropItem().

Comment 4

[Damon Sicore (:damons)]

Comment on attachment 292190 [details] [diff] [review]
patch

a=endgame drivers

Comment 5

[Jesse Ruderman]

Fix checked in.

Comment 6

[Jesse Ruderman]

Crashtest checked in.