From 9861ba22b344c33342cb77dd158ec895e447f816 Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu"
 <bzbarsky%mit.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 28 Jan 2008 23:34:28 +0000
Subject: [PATCH] Fix bug 406900 by doing a better job of unbinding XBL default
 content. r=smaug, sr=sicking

git-svn-id: svn://10.0.0.236/trunk@244263 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/content/xbl/src/nsBindingManager.cpp  |  5 +----
 mozilla/content/xbl/src/nsXBLBinding.cpp      | 10 ++-------
 .../content/xbl/src/nsXBLInsertionPoint.cpp   | 21 +++++++++++++++++++
 mozilla/content/xbl/src/nsXBLInsertionPoint.h |  4 ++++
 4 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/mozilla/content/xbl/src/nsBindingManager.cpp b/mozilla/content/xbl/src/nsBindingManager.cpp
index cadf843133e..aba4faf1ca4 100644
--- a/mozilla/content/xbl/src/nsBindingManager.cpp
+++ b/mozilla/content/xbl/src/nsBindingManager.cpp
@@ -448,10 +448,7 @@ RemoveInsertionParentForNodeList(nsIDOMNodeList* aList, nsIContent* aParent)
     PRInt32 count = list->GetInsertionPointCount();
     for (PRInt32 i = 0; i < count; ++i) {
       nsRefPtr<nsXBLInsertionPoint> currPoint = list->GetInsertionPointAt(i);
-      nsCOMPtr<nsIContent> defContent = currPoint->GetDefaultContent();
-      if (defContent) {
-        defContent->UnbindFromTree();
-      }
+      currPoint->UnbindDefaultContent();
 #ifdef DEBUG
       nsCOMPtr<nsIContent> parent = currPoint->GetInsertionParent();
       NS_ASSERTION(!parent || parent == aParent, "Wrong insertion parent!");
diff --git a/mozilla/content/xbl/src/nsXBLBinding.cpp b/mozilla/content/xbl/src/nsXBLBinding.cpp
index 6e6198aef1a..b1d982980c9 100644
--- a/mozilla/content/xbl/src/nsXBLBinding.cpp
+++ b/mozilla/content/xbl/src/nsXBLBinding.cpp
@@ -565,10 +565,7 @@ ChangeDocumentForDefaultContent(nsISupports* aKey,
 {
   PRInt32 count = aData->Length();
   for (PRInt32 i = 0; i < count; i++) {
-    nsXBLInsertionPoint* currPoint = aData->ElementAt(i);
-    nsCOMPtr<nsIContent> defContent = currPoint->GetDefaultContent();
-    if (defContent)
-      defContent->UnbindFromTree();
+    aData->ElementAt(i)->UnbindDefaultContent();
   }
 
   return PL_DHASH_NEXT;
@@ -1402,10 +1399,7 @@ nsXBLBinding::RemoveInsertionParent(nsIContent* aParent)
       PRInt32 count = list->Length();
       for (PRInt32 i = 0; i < count; ++i) {
         nsRefPtr<nsXBLInsertionPoint> currPoint = list->ElementAt(i);
-        nsCOMPtr<nsIContent> defContent = currPoint->GetDefaultContent();
-        if (defContent) {
-          defContent->UnbindFromTree();
-        }
+        currPoint->UnbindDefaultContent();
 #ifdef DEBUG
         nsCOMPtr<nsIContent> parent = currPoint->GetInsertionParent();
         NS_ASSERTION(!parent || parent == aParent, "Wrong insertion parent!");
diff --git a/mozilla/content/xbl/src/nsXBLInsertionPoint.cpp b/mozilla/content/xbl/src/nsXBLInsertionPoint.cpp
index 56d86fccaba..5d8077f286a 100644
--- a/mozilla/content/xbl/src/nsXBLInsertionPoint.cpp
+++ b/mozilla/content/xbl/src/nsXBLInsertionPoint.cpp
@@ -114,3 +114,24 @@ nsXBLInsertionPoint::Matches(nsIContent* aContent, PRUint32 aIndex)
 {
   return (aContent == mParentElement && mIndex != -1 && ((PRInt32)aIndex) == mIndex);
 }
+
+void
+nsXBLInsertionPoint::UnbindDefaultContent()
+{
+  if (!mDefaultContent) {
+    return;
+  }
+
+  // Hold a strong ref while doing this, just in case
+  nsCOMPtr<nsIContent> defContent = mDefaultContent;
+
+  // Unbind the _kids_ of the default content, not just the default content
+  // itself, since they are bound to some other parent.  Basically we want to
+  // undo the mess that InstallAnonymousContent created.
+  PRUint32 childCount = mDefaultContent->GetChildCount();
+  for (PRUint32 i = 0; i < childCount; i++) {
+    defContent->GetChildAt(i)->UnbindFromTree();
+  }
+
+  defContent->UnbindFromTree();
+}
diff --git a/mozilla/content/xbl/src/nsXBLInsertionPoint.h b/mozilla/content/xbl/src/nsXBLInsertionPoint.h
index f71c18cb831..901506850f5 100644
--- a/mozilla/content/xbl/src/nsXBLInsertionPoint.h
+++ b/mozilla/content/xbl/src/nsXBLInsertionPoint.h
@@ -83,6 +83,10 @@ public:
 
   PRBool Matches(nsIContent* aContent, PRUint32 aIndex);
 
+  // Unbind all the default content in this insertion point.  Used
+  // when the insertion parent is going away.
+  void UnbindDefaultContent();
+
 protected:
   nsAutoRefCnt mRefCnt;
   nsIContent* mParentElement;            // This ref is weak.  The parent of the <children> element.