Fix GeneratedImage to respect Image's refcounting


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@35996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/WebCore/css/CSSGradientValue.cpp b/WebCore/css/CSSGradientValue.cpp
index fd0ca5b..3f45e47 100644
--- a/WebCore/css/CSSGradientValue.cpp
+++ b/WebCore/css/CSSGradientValue.cpp
@@ -107,18 +107,19 @@
 Image* CSSGradientValue::image(RenderObject* renderer, const IntSize& size)
 {
     ASSERT(m_clients.contains(renderer));
-    
+
     // Need to look up our size.  Create a string of width*height to use as a hash key.
     Image* result = getImage(renderer, size);
     if (result)
         return result;
-    
+
     if (size.isEmpty())
         return 0;
-    
+
     // We need to create an image.
-    result = new GeneratedImage(createGradient(renderer, size), size);
-    putImage(size, result);
+    RefPtr<Image> newImage = GeneratedImage::create(createGradient(renderer, size), size);
+    result = newImage.get();
+    putImage(size, newImage.release());
 
     return result;
 }
diff --git a/WebCore/css/CSSImageGeneratorValue.cpp b/WebCore/css/CSSImageGeneratorValue.cpp
index 9a1fd92..6e23d95 100644
--- a/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/WebCore/css/CSSImageGeneratorValue.cpp
@@ -42,7 +42,6 @@
 
 CSSImageGeneratorValue::~CSSImageGeneratorValue()
 {
-    deleteAllValues(m_images);
 }
 
 void CSSImageGeneratorValue::addClient(RenderObject* renderer, const IntSize& size)
@@ -59,7 +58,7 @@
     if (!size.isEmpty()) {
         m_sizes.remove(size);
         if (!m_sizes.contains(size))
-            delete m_images.take(size);
+            m_images.remove(size);
     }
     m_clients.remove(renderer);
     deref();
@@ -78,10 +77,10 @@
         return 0;
     
     // Look up the image in our cache.
-    return m_images.get(size);
+    return m_images.get(size).get();
 }
 
-void CSSImageGeneratorValue::putImage(const IntSize& size, Image* image)
+void CSSImageGeneratorValue::putImage(const IntSize& size, PassRefPtr<Image> image)
 {
     m_images.add(size, image);
 }
diff --git a/WebCore/css/CSSImageGeneratorValue.h b/WebCore/css/CSSImageGeneratorValue.h
index b2f9ce1..661fd37 100644
--- a/WebCore/css/CSSImageGeneratorValue.h
+++ b/WebCore/css/CSSImageGeneratorValue.h
@@ -55,11 +55,11 @@
     CSSImageGeneratorValue();
     
     Image* getImage(RenderObject*, const IntSize&);
-    void putImage(const IntSize&, Image*);
+    void putImage(const IntSize&, PassRefPtr<Image>);
 
     HashCountedSet<IntSize> m_sizes; // A count of how many times a given image size is in use.
     HashMap<RenderObject*, IntSize> m_clients; // A map from RenderObjects to image sizes.
-    HashMap<IntSize, Image*> m_images; // A map from sizes to generated images.
+    HashMap<IntSize, RefPtr<Image> > m_images; // A cache of Image objects by image size.
     
     RefPtr<StyleGeneratedImage> m_image;
     bool m_accessedImage;
diff --git a/WebCore/platform/graphics/GeneratedImage.h b/WebCore/platform/graphics/GeneratedImage.h
index 5e78989..833d8c4 100644
--- a/WebCore/platform/graphics/GeneratedImage.h
+++ b/WebCore/platform/graphics/GeneratedImage.h
@@ -36,10 +36,9 @@
 
 class GeneratedImage : public Image {
 public:
-    GeneratedImage(PassRefPtr<Generator> generator, const IntSize& size)
-        : m_generator(generator)
-        , m_size(size)
+    static PassRefPtr<GeneratedImage> create(PassRefPtr<Generator> generator, const IntSize& size)
     {
+        return adoptRef(new GeneratedImage(generator, size));
     }
     virtual ~GeneratedImage() {}
 
@@ -63,6 +62,12 @@
                              const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
     
 protected:
+    GeneratedImage(PassRefPtr<Generator> generator, const IntSize& size)
+        : m_generator(generator)
+        , m_size(size)
+    {
+    }
+
     RefPtr<Generator> m_generator;
     IntSize m_size;
 };
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index f24832c..862b763 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -1560,7 +1560,7 @@
         rareNonInheritedData->m_content->clear();
 }
 
-void RenderStyle::setContent(StyleImage* image, bool add)
+void RenderStyle::setContent(PassRefPtr<StyleImage> image, bool add)
 {
     if (!image)
         return; // The object is null. Nothing to do. Just bail.
@@ -1583,9 +1583,8 @@
     else
         content.set(newContentData);
 
-    newContentData->m_content.m_image = image;
+    newContentData->m_content.m_image = image.releaseRef();
     newContentData->m_type = CONTENT_OBJECT;
-    image->ref();
 }
 
 void RenderStyle::setContent(StringImpl* s, bool add)
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index f51f48a..18995d6 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -2279,7 +2279,7 @@
     bool contentDataEquivalent(const RenderStyle* otherStyle) const;
     void clearContent();
     void setContent(StringImpl*, bool add = false);
-    void setContent(StyleImage*, bool add = false);
+    void setContent(PassRefPtr<StyleImage>, bool add = false);
     void setContent(CounterContent*, bool add = false);
 
     const CounterDirectiveMap* counterDirectives() const;