Do not leak nodes.

CCBUG: 151453

khtml/dom/dom_node.cpp

@@ -205,7 +205,7 @@ Node Node::parentNode() const
 NodeList Node::childNodes() const
 {
     if (!impl) return 0;
-    return impl->childNodes();
+    return impl->childNodes().get();
 }
 
 Node Node::firstChild() const

khtml/ecma/kjs_dom.cpp

@@ -275,7 +275,7 @@ JSValue* DOMNode::getValueProperty(ExecState *exec, int token) const
   case ParentElement: // IE only apparently
     return getDOMNode(exec,node.parentNode());
   case ChildNodes:
-    return getDOMNodeList(exec,node.childNodes());
+    return getDOMNodeList(exec,node.childNodes().get());
   case FirstChild:
     return getDOMNode(exec,node.firstChild());
   case LastChild:

khtml/ecma/kjs_html.cpp

@@ -2564,18 +2564,19 @@ void KJS::HTMLElement::putValueProperty(ExecState *exec, int token, JSValue *val
       // read-only: form
       // read-only: text  <--- According to the DOM, but JavaScript and JScript both allow changes.
       // So, we'll do it here and not add it to our DOM headers.
-      case OptionText:            { SharedPtr<DOM::NodeListImpl> nl(option.childNodes());
-                                    for (unsigned int i = 0; i < nl->length(); i++) {
+      case OptionText:            { RefPtr<DOM::NodeListImpl> nl(option.childNodes());
+                                    const unsigned int length = nl->length();
+                                    for (unsigned int i = 0; i < length; ++i) {
                                         if (nl->item(i)->nodeType() == DOM::Node::TEXT_NODE) {
                                             static_cast<DOM::TextImpl*>(nl->item(i))->setData(str, exception);
                                             return;
                                         }
-                                  }
-                                  // No child text node found, creating one
-                                  DOM::TextImpl* t = option.document()->createTextNode(str.implementation());
-                                  int dummyexception;
-                                  option.appendChild(t, dummyexception); // #### exec->setException ?
-                                  return;
+                                    }
+                                    // No child text node found, creating one
+                                    DOM::TextImpl* t = option.document()->createTextNode(str.implementation());
+                                    int dummyexception;
+                                    option.appendChild(t, dummyexception); // #### exec->setException ?
+                                    return;
       }
       // read-only: index
       case OptionSelected:        { option.setSelected(value->toBoolean(exec)); return; }

khtml/editing/htmlediting_impl.cpp

@@ -2334,8 +2334,8 @@ RemoveNodeCommandImpl::RemoveNodeCommandImpl(DocumentImpl *document, NodeImpl *r
     assert(m_parent);
     m_parent->ref();
 
-    NodeListImpl *children = m_parent->childNodes();
-    for (int i = children->length(); i >= 0; i--) {
+    RefPtr<DOM::NodeListImpl> children = m_parent->childNodes();
+    for (int i = children->length(); i >= 0; --i) {
         NodeImpl *node = children->item(i);
         if (node == m_removeChild)
             break;
@@ -2431,9 +2431,9 @@ RemoveNodePreservingChildrenCommandImpl::~RemoveNodePreservingChildrenCommandImp
 
 void RemoveNodePreservingChildrenCommandImpl::doApply()
 {
-    NodeListImpl *children = node()->childNodes();
-    int length = children->length();
-    for (int i = 0; i < length; i++) {
+    RefPtr<DOM::NodeListImpl> children = node()->childNodes();
+    const unsigned int length = children->length();
+    for (unsigned int i = 0; i < length; ++i) {
         NodeImpl *child = children->item(0);
         removeNode(child);
         insertNodeBefore(child, node());

khtml/html/html_headimpl.cpp

@@ -795,17 +795,15 @@ void HTMLTitleElementImpl::setText( const DOMString& str )
 {
     int exceptioncode = 0;
     // Look for an existing text child node
-    DOM::NodeListImpl* nl(childNodes());
-    if (nl)
-    {
-        for (unsigned int i = 0; i < nl->length(); i++) {
-            if (nl->item(i)->nodeType() == DOM::Node::TEXT_NODE) {
-                static_cast<DOM::TextImpl *>(nl->item(i))->setData(str, exceptioncode);
-                return;
+    RefPtr<DOM::NodeListImpl> nl = childNodes();
+    const unsigned int length = nl->length();
+    for (unsigned int i = 0; i < length; ++i) {
+        if (nl->item(i)->nodeType() == DOM::Node::TEXT_NODE) {
+            static_cast<DOM::TextImpl *>(nl->item(i))->setData(str, exceptioncode);
+            return;
             }
-        }
-        delete nl;
     }
+
     // No child text node found, creating one
     DOM::TextImpl* t = document()->createTextNode(str.implementation());
     appendChild(t, exceptioncode);

khtml/xml/dom_nodeimpl.cpp

@@ -123,7 +123,7 @@ unsigned short NodeImpl::nodeType() const
   return 0;
 }
 
-NodeListImpl *NodeImpl::childNodes()
+WTF::PassRefPtr<DOM::NodeListImpl> NodeImpl::childNodes()
 {
   return new ChildNodeListImpl(this);
 }

khtml/xml/dom_nodeimpl.h

@@ -82,7 +82,7 @@ public:
     NodeImpl *parentNode() const { return static_cast<NodeImpl*>(m_parent); }
     NodeImpl *previousSibling() const { return m_previous; }
     NodeImpl *nextSibling() const { return m_next; }
-    virtual NodeListImpl *childNodes();
+    virtual WTF::PassRefPtr<NodeListImpl> childNodes();
     virtual NodeImpl *firstChild() const;
     virtual NodeImpl *lastChild() const;