Fix a memory leak when calling the one-arg form of ListValue::Remove().

BUG=none
TEST=none
Review URL: http://codereview.chromium.org/434108

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@33314 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 13 insertions, 2 deletions

diff --git a/base/values.cc b/base/values.cc
index 8404d3ef..1f21d93 100644
--- a/base/values.cc
+++ b/base/values.cc
@@ -671,6 +671,7 @@ int ListValue::Remove(const Value& value) {
   for (ValueVector::iterator i(list_.begin()); i != list_.end(); ++i) {
     if ((*i)->Equals(&value)) {
       size_t index = i - list_.begin();
+      delete *i;
       list_.erase(i);
       return index;
     }
diff --git a/base/values.h b/base/values.h
index 49ce287..82a29fd 100644
--- a/base/values.h
+++ b/base/values.h
@@ -361,8 +361,8 @@ class ListValue : public Value {
   // it will return false and the ListValue object will be unchanged.
   bool Remove(size_t index, Value** out_value);
 
-  // Removes the first instance of |value| found in the list, if any, returning
-  // the index that it was located at (-1 for not present).
+  // Removes the first instance of |value| found in the list, if any, and
+  // deletes it.  Returns the index that it was located at (-1 for not present).
   int Remove(const Value& value);
 
   // Appends a Value to the end of the list.
diff --git a/base/values_unittest.cc b/base/values_unittest.cc
index 0182d76..5835e2b 100644
--- a/base/values_unittest.cc
+++ b/base/values_unittest.cc
@@ -224,6 +224,16 @@ TEST(ValuesTest, ListRemoval) {
     EXPECT_TRUE(deletion_flag);
     EXPECT_EQ(0U, list.GetSize());
   }
+
+  {
+    ListValue list;
+    DeletionTestValue* value = new DeletionTestValue(&deletion_flag);
+    list.Append(value);
+    EXPECT_FALSE(deletion_flag);
+    EXPECT_EQ(0, list.Remove(*value));
+    EXPECT_TRUE(deletion_flag);
+    EXPECT_EQ(0U, list.GetSize());
+  }
 }
 
 TEST(ValuesTest, DictionaryDeletion) {