Bug 433429, r+sr=bz

layout/xul/base/src/nsListBoxBodyFrame.cpp

@@ -269,26 +269,8 @@ nsListBoxBodyFrame::Destroy()
   }
 
   // Make sure we tell our listbox's box object we're being destroyed.
-  for (nsIFrame *a = mParent; a; a = a->GetParent()) {
-    nsIContent *content = a->GetContent();
-    nsIDocument *doc;
-
-    if (content &&
-        content->NodeInfo()->Equals(nsGkAtoms::listbox, kNameSpaceID_XUL) &&
-        (doc = content->GetDocument())) {
-      nsCOMPtr<nsIDOMElement> e(do_QueryInterface(content));
-      nsCOMPtr<nsIDOMNSDocument> nsdoc(do_QueryInterface(doc));
-
-      nsCOMPtr<nsIBoxObject> box;
-      nsdoc->GetBoxObjectFor(e, getter_AddRefs(box));
-
-      nsCOMPtr<nsPIBoxObject> piBox = do_QueryInterface(box);
-      if (piBox) {
-        piBox->ClearCachedValues();
-      }
-
-      break;
-    }
+  if (mBoxObject) {
+    mBoxObject->ClearCachedValues();
   }
 
   nsBoxFrame::Destroy();

layout/xul/base/src/nsListBoxBodyFrame.h

@@ -49,6 +49,7 @@
 #include "nsPresContext.h"
 #include "nsBoxLayoutState.h"
 #include "nsThreadUtils.h"
+#include "nsPIBoxObject.h"
 
 class nsListScrollSmoother;
 nsIFrame* NS_NewListBoxBodyFrame(nsIPresShell* aPresShell,
@@ -138,6 +139,12 @@ public:
 
   void PostReflowCallback();
 
+  PRBool SetBoxObject(nsPIBoxObject* aBoxObject)
+  {
+    NS_ENSURE_TRUE(!mBoxObject, PR_FALSE);
+    mBoxObject = aBoxObject;
+    return PR_TRUE;
+  }
 protected:
   class nsPositionChangedEvent;
   friend class nsPositionChangedEvent;
@@ -198,6 +205,8 @@ protected:
   nsTArray< nsRefPtr<nsPositionChangedEvent> > mPendingPositionChangeEvents;
 
   PRPackedBool mReflowCallbackPosted;
+
+  nsCOMPtr<nsPIBoxObject> mBoxObject;
 }; 
 
 #endif // nsListBoxBodyFrame_h

layout/xul/base/src/nsListBoxObject.cpp

@@ -47,6 +47,7 @@
 #include "nsIDOMNodeList.h"
 #include "nsGkAtoms.h"
 #include "nsIScrollableFrame.h"
+#include "nsListBoxBodyFrame.h"
 
 class nsListBoxObject : public nsPIListBoxObject, public nsBoxObject
 {
@@ -223,7 +224,12 @@ nsListBoxObject::GetListBoxBody(PRBool aFlush)
      return nsnull;
 
   // It's a frame. Refcounts are irrelevant.
-  CallQueryInterface(yeahBaby, &mListBoxBody);
+  nsIListBoxObject* listBoxBody = nsnull;
+  CallQueryInterface(yeahBaby, &listBoxBody);
+  NS_ENSURE_TRUE(listBoxBody &&
+                 static_cast<nsListBoxBodyFrame*>(listBoxBody)->SetBoxObject(this),
+                 nsnull);
+  mListBoxBody = listBoxBody;
   return mListBoxBody;
 }