Fix for bug #43384 -r hyatt

layout/xul/base/src/nsIMonument.h

@@ -68,6 +68,7 @@ public:
     virtual void MarkDirty(nsBoxLayoutState& aState)=0;
     virtual void AddRef()=0;
     virtual void Release(nsBoxLayoutState& aState)=0;
+    virtual void Destroy(nsBoxLayoutState& aState)=0;
     virtual PRBool IsSet()=0;
     virtual nsIBox* GetBox()=0;
     virtual PRInt32 GetRefCount()=0;

layout/xul/base/src/nsMonumentLayout.cpp

@@ -176,16 +176,27 @@ nsMonumentIterator::GetNextObelisk(nsObeliskLayout** aObelisk, PRBool aSearchChi
   return PR_FALSE;
 }
 
+//static long _nodes = 0;
+//static long _lists = 0;
+
 
 //------ nsInfoListNodeImpl ----
 
 nsBoxSizeListNodeImpl::~nsBoxSizeListNodeImpl()
 {
     MOZ_COUNT_DTOR(nsBoxSizeListNodeImpl);
+    //_nodes--;
+    //printf("Nodes %d\n",_nodes);
 }
 
 void
 nsBoxSizeListNodeImpl::Release(nsBoxLayoutState& aState)
+{
+  Destroy(aState);
+}
+
+void
+nsBoxSizeListNodeImpl::Destroy(nsBoxLayoutState& aState)
 {
   delete this;
 }
@@ -228,6 +239,8 @@ nsBoxSizeListNodeImpl::nsBoxSizeListNodeImpl(nsIBox* aBox):mNext(nsnull),
                                                            mIsSet(PR_FALSE)
 {
     MOZ_COUNT_CTOR(nsBoxSizeListNodeImpl);
+ // _nodes++;
+ // printf("Created. Nodes %d\n",_nodes);
 }
 
 nsBoxSizeList* 
@@ -272,34 +285,66 @@ nsBoxSizeListImpl::nsBoxSizeListImpl(nsIBox* aBox):nsBoxSizeListNodeImpl(aBox),
                                                    mListenerBox(nsnull)
 {
     MOZ_COUNT_CTOR(nsBoxSizeListImpl);
+ //   _lists++;
+ //   printf("Lists %d\n",_lists);
 }
 
+        
 nsBoxSizeListImpl::~nsBoxSizeListImpl()
 {
     MOZ_COUNT_DTOR(nsBoxSizeListImpl);
+ //   _lists--;
+ //   printf("Lists %d\n",_lists);
 }
 
+/* Ownership model nsMonumentLayout
+
+    nsTempleLayout owns 
+       mMonuments (nsBoxSizeListImpl)
+
+    nsBoxSizeListImpl owns 
+       mAdjacent (nsBoxSizeListImpl)
+       mFirst (nsBoxSizeList) Now mFirst is a list of
+       nsBoxSizeListImpl or nsBoxSizeListNodeImpl. 
+       It only owns nsBoxSizeNodeImpl not the
+       nsBoxSizeListImpl.
+*/
 void
-nsBoxSizeListImpl::Release(nsBoxLayoutState& aState)
+nsBoxSizeListImpl::Destroy(nsBoxLayoutState& aState)
 {
+  // notify the listener that we are going away
   if (mListener) {
     mListener->WillBeDestroyed(mListenerBox, aState, *this);
   }
 
+  // tell each of our children to release. If you ask
+  // a node to release it will delete itself. If you
+  // ask a list to release it will do nothing because
+  // Lists are not owned by other lists they are owned
+  // by Temples.
   nsBoxSizeList* list = mFirst;
   while(list)
   {
     nsBoxSizeList* toRelease = list;
     list = list->GetNext();
-    toRelease->SetParent(nsnull);
+    toRelease->Release(aState);
   }
 
+  // now tell each or our adacent children to be destroyed.
   if (mAdjacent)
-    mAdjacent->Release(aState);
+    mAdjacent->Destroy(aState);
 
   delete this;
 }
 
+void
+nsBoxSizeListImpl::Release(nsBoxLayoutState& aState)
+{
+  // do nothing. We can only be destroyed by our owner
+  // by calling Destroy.
+  mParent = nsnull;
+}
+
 void
 nsBoxSizeListImpl::Clear(nsBoxLayoutState& aState)
 {

layout/xul/base/src/nsMonumentLayout.h

@@ -63,6 +63,7 @@ public:
   virtual PRBool GetNextObelisk(nsObeliskLayout** aObelisk, PRBool aSearchChildren = PR_FALSE);
 };
 
+// nsBoxSizeListNodeImpl are OWNED by nsBoxSizeListImpl
 class nsBoxSizeListNodeImpl : public nsBoxSizeList
 {
 public:
@@ -84,6 +85,7 @@ public:
     virtual void MarkDirty(nsBoxLayoutState& aState);
     virtual void AddRef() { mRefCount++; }
     virtual void Release(nsBoxLayoutState& aState);
+    virtual void Destroy(nsBoxLayoutState& aState);
     virtual PRInt32 GetRefCount() { return mRefCount; }
     virtual PRBool IsSet() { return mIsSet; }
     virtual nsIBox* GetBox() { return mBox; }
@@ -95,13 +97,14 @@ public:
     virtual ~nsBoxSizeListNodeImpl();
 
     nsBoxSizeList* mNext;
-    nsBoxSizeList* mParent;
-    nsBoxSizeList* mAdjacent;
+    nsBoxSizeList* mParent; 
+    nsBoxSizeList* mAdjacent;  // OWN
     nsIBox* mBox;
     PRInt32 mRefCount;
     PRBool mIsSet;
 };
 
+// nsBoxSizeListImpl are OWNED by nsTempleLayout
 class nsBoxSizeListImpl : public nsBoxSizeListNodeImpl
 {
 public:
@@ -116,12 +119,13 @@ public:
     virtual PRBool SetListener(nsIBox* aBox, nsBoxSizeListener& aListener);
     virtual void RemoveListener();
     virtual void Release(nsBoxLayoutState& aState);
+    virtual void Destroy(nsBoxLayoutState& aState);
 
     nsBoxSizeListImpl(nsIBox* aBox);
     virtual ~nsBoxSizeListImpl();
 
-    nsBoxSizeList* mFirst;
-    nsBoxSizeList* mLast;
+    nsBoxSizeList* mFirst;  // OWN children who are nsBoxSizeListNodeImpl but not nsBoxSizeListImpl
+    nsBoxSizeList* mLast;   // OWN children who are nsBoxSizeListNodeImpl but not nsBoxSizeListImpl
     PRInt32 mCount;
     nsBoxSize mBoxSize;
     nsBoxSizeListener* mListener;

layout/xul/base/src/nsTempleLayout.cpp

@@ -31,6 +31,7 @@
 #include "nsIBox.h"
 #include "nsCOMPtr.h"
 #include "nsIScrollableFrame.h"
+#include "nsBoxLayoutState.h"
 
 nsresult
 NS_NewTempleLayout( nsIPresShell* aPresShell, nsCOMPtr<nsIBoxLayout>& aNewLayout)
@@ -47,7 +48,10 @@ nsTempleLayout::nsTempleLayout(nsIPresShell* aPresShell):nsMonumentLayout(aPresS
 
 nsTempleLayout::~nsTempleLayout()
 {
-  delete mMonuments;
+  if (mMonuments) {
+    nsBoxLayoutState state((nsIPresContext*)nsnull);
+    mMonuments->Destroy(state);
+  }
 }
 
 NS_IMETHODIMP
@@ -228,7 +232,7 @@ nsTempleLayout::DesecrateMonuments(nsIBox* aBox, nsBoxLayoutState& aState)
 
   if (mMonuments) {
     nsBoxSizeList* tmp = mMonuments;
-    mMonuments->Release(aState);
+    mMonuments->Destroy(aState);
     mMonuments = nsnull;
   }