Bug 640652 - When unsetting an attribute on a XUL element, don't let the script blocker to be removed when the document nested update count is 0, since that can trigger XBL bindings, which may run scripts to do things which would lead into crashes; r=sicking a=sayrer

--HG--
extra : rebase_source : e79c187d59225cbc432db5b4b1629d78075477b6

content/xul/content/src/nsXULElement.cpp

@@ -1341,7 +1341,8 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, PRBool aNotify)
         NS_ENSURE_SUCCESS(rv, rv);
     }
 
-    nsAutoRemovableScriptBlocker scriptBlocker;
+    nsIDocument* doc = GetCurrentDoc();
+    mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
 
     PRBool isId = PR_FALSE;
     if (aName == nsGkAtoms::id && aNameSpaceID == kNameSpaceID_None) {
@@ -1361,9 +1362,6 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, PRBool aNotify)
     nsAutoString oldValue;
     GetAttr(aNameSpaceID, aName, oldValue);
 
-    nsIDocument* doc = GetCurrentDoc();
-    mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
-
     // When notifying, make sure to keep track of states whose value
     // depends solely on the value of an attribute.
     nsEventStates stateMask;