From 9bb0321b470038472e87c4048b29dc883552aa6d Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Thu, 7 May 2015 22:44:18 -0400
Subject: [PATCH] Bug 1162765 - Part 1: Convert nsGenericHTMLFormElement::mForm
 to a strong reference; r=mccr8

---
 dom/html/nsGenericHTMLElement.cpp | 26 ++++++++++++++++++++------
 dom/html/nsGenericHTMLElement.h   |  5 ++++-
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/dom/html/nsGenericHTMLElement.cpp b/dom/html/nsGenericHTMLElement.cpp
index 932b80f08f6a..66fbca071370 100644
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@@ -1883,9 +1883,26 @@ nsGenericHTMLElement::TouchEventsEnabled(JSContext* /* unused */, JSObject* /* u
 
 //----------------------------------------------------------------------
 
+NS_IMPL_ADDREF_INHERITED(nsGenericHTMLFormElement, nsGenericHTMLElement)
+NS_IMPL_RELEASE_INHERITED(nsGenericHTMLFormElement, nsGenericHTMLElement)
+
+NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsGenericHTMLFormElement)
+  NS_INTERFACE_TABLE_INHERITED(nsGenericHTMLFormElement,
+                               nsIFormControl)
+NS_INTERFACE_TABLE_TAIL_INHERITING(nsGenericHTMLElement)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericHTMLFormElement)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsGenericHTMLFormElement,
+                                                  nsGenericHTMLElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mForm)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGenericHTMLFormElement,
+                                                nsGenericHTMLElement)
+  tmp->ClearForm(true);
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
 nsGenericHTMLFormElement::nsGenericHTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
   : nsGenericHTMLElement(aNodeInfo)
-  , mForm(nullptr)
   , mFieldSet(nullptr)
 {
   // We should add the NS_EVENT_STATE_ENABLED bit here as needed, but
@@ -1903,10 +1920,6 @@ nsGenericHTMLFormElement::~nsGenericHTMLFormElement()
   NS_ASSERTION(!mForm, "mForm should be null at this point!");
 }
 
-NS_IMPL_ISUPPORTS_INHERITED(nsGenericHTMLFormElement,
-                            nsGenericHTMLElement,
-                            nsIFormControl)
-
 nsINode*
 nsGenericHTMLFormElement::GetScopeChainParent() const
 {
@@ -1986,7 +1999,8 @@ nsresult
 nsGenericHTMLFormElement::GetForm(nsIDOMHTMLFormElement** aForm)
 {
   NS_ENSURE_ARG_POINTER(aForm);
-  NS_IF_ADDREF(*aForm = mForm);
+  nsRefPtr<HTMLFormElement> copy(mForm);
+  copy.forget(aForm);
   return NS_OK;
 }
 
diff --git a/dom/html/nsGenericHTMLElement.h b/dom/html/nsGenericHTMLElement.h
index 1dc8fdea8f61..4ed09a05811e 100644
--- a/dom/html/nsGenericHTMLElement.h
+++ b/dom/html/nsGenericHTMLElement.h
@@ -1266,6 +1266,9 @@ class nsGenericHTMLFormElement : public nsGenericHTMLElement,
 public:
   explicit nsGenericHTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsGenericHTMLFormElement,
+                                           nsGenericHTMLElement)
+
   NS_DECL_ISUPPORTS_INHERITED
 
   nsINode* GetScopeChainParent() const override;
@@ -1413,7 +1416,7 @@ protected:
   FocusTristate FocusState();
 
   /** The form that contains this control */
-  mozilla::dom::HTMLFormElement* mForm;
+  nsRefPtr<mozilla::dom::HTMLFormElement> mForm;
 
   /* This is a pointer to our closest fieldset parent if any */
   mozilla::dom::HTMLFieldSetElement* mFieldSet;