Bug 610796: In SVG-as-an-image helper-documents, clear rendering observer lists at xpcom shutdown time. r=roc a=blocking-final+

layout/svg/base/src/nsSVGEffects.cpp

@@ -192,6 +192,13 @@ nsSVGRenderingObserver::InvalidateViaReferencedElement()
   DoUpdate();
 }
 
+void
+nsSVGRenderingObserver::NotifyEvictedFromRenderingObserverList()
+{
+  mInObserverList = PR_FALSE; // We've been removed from rendering-obs. list.
+  StopListening();            // Remove ourselves from mutation-obs. list.
+}
+
 void
 nsSVGRenderingObserver::AttributeChanged(nsIDocument* aDocument,
                                          dom::Element* aElement,
@@ -542,6 +549,21 @@ nsSVGRenderingObserverList::InvalidateAll()
   }
 }
 
+void
+nsSVGRenderingObserverList::RemoveAll()
+{
+  nsAutoTArray<nsSVGRenderingObserver*,10> observers;
+
+  // The PL_DHASH_REMOVE in GatherEnumerator drops all our observers here:
+  mObservers.EnumerateEntries(GatherEnumerator, &observers);
+
+  // Our list is now cleared.  We need to notify the observers we've removed,
+  // so they can update their state & remove themselves as mutation-observers.
+  for (PRUint32 i = 0; i < observers.Length(); ++i) {
+    observers[i]->NotifyEvictedFromRenderingObserverList();
+  }
+}
+
 static void
 DestroyObservers(void *aObject, nsIAtom *aPropertyName,
                  void *aPropertyValue, void *aData)
@@ -577,6 +599,16 @@ nsSVGEffects::RemoveRenderingObserver(Element *aElement, nsSVGRenderingObserver
   }
 }
 
+void
+nsSVGEffects::RemoveAllRenderingObservers(Element *aElement)
+{
+  nsSVGRenderingObserverList *observerList = GetObserverList(aElement);
+  if (observerList) {
+    observerList->RemoveAll();
+    aElement->SetHasRenderingObservers(false);
+  }
+}
+
 void
 nsSVGEffects::InvalidateRenderingObservers(nsIFrame *aFrame)
 {

layout/svg/base/src/nsSVGEffects.h

@@ -80,6 +80,12 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
   void InvalidateViaReferencedElement();
+
+  // When a nsSVGRenderingObserver list gets forcibly cleared, it uses this
+  // callback to notify every observer that's cleared from it, so they can
+  // react.
+  void NotifyEvictedFromRenderingObserverList();
+
   nsIFrame* GetReferencedFrame();
   PRBool IsInObserverList() const { return mInObserverList; }
 
@@ -256,6 +262,12 @@ public:
    */
   void InvalidateAll();
 
+  /**
+   * Drop all our observers, and notify them that we have dropped our reference
+   * to them.
+   */
+  void RemoveAll();
+
 private:
   nsTHashtable<nsVoidPtrHashKey> mObservers;
 };
@@ -350,6 +362,12 @@ public:
    * @param aFrame must be a first-continuation.
    */
   static void RemoveRenderingObserver(Element *aElement, nsSVGRenderingObserver *aObserver);
+
+  /**
+   * Removes all rendering observers from aElement.
+   */
+  static void RemoveAllRenderingObservers(Element *aElement);
+
   /**
    * This can be called on any frame. We invalidate the observers of aFrame's
    * element, if any, or else walk up to the nearest observable SVG parent

modules/libpr0n/src/SVGDocumentWrapper.cpp

@@ -60,6 +60,7 @@
 #include "gfxRect.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGLength2.h"
+#include "nsSVGEffects.h"
 
 using namespace mozilla::dom;
 
@@ -298,6 +299,12 @@ SVGDocumentWrapper::Observe(nsISupports* aSubject,
                             const PRUnichar *aData)
 {
   if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
+    // Sever ties from rendering observers to helper-doc's root SVG node
+    nsSVGSVGElement* svgElem = GetRootSVGElem();
+    if (svgElem) {
+      nsSVGEffects::RemoveAllRenderingObservers(svgElem);
+    }
+
     // Clean up at XPCOM shutdown time.
     DestroyViewer();
     if (mListener)