Bug 515703. In some cases we can end up checking whether an element is the default submit before we've updated our default submit; in that situation wehave to do it the slow way. r=jst

content/html/content/public/nsIForm.h

@@ -53,8 +53,8 @@ template<class T> class nsTArray;
 
 // IID for the nsIForm interface
 #define NS_IFORM_IID    \
-{ 0xbe97c0a6, 0xb590, 0x4154, \
-  {0xb4, 0xc3, 0xb0, 0x1c, 0x8f, 0x4a, 0x93, 0x98} }
+{ 0x6e8456c2, 0xcf49, 0x4b6d, \
+ { 0xb5, 0xfe, 0x80, 0x0d, 0x03, 0x4f, 0x55, 0x33 } }
 
 /**
  * This interface provides a complete set of methods dealing with
@@ -194,6 +194,15 @@ public:
    */
    NS_IMETHOD_(nsIFormControl*) GetDefaultSubmitElement() const = 0;
 
+  /**
+   * Check whether a given nsIFormControl is the default submit
+   * element.  This is different from just comparing to
+   * GetDefaultSubmitElement() in certain situations inside an update
+   * when GetDefaultSubmitElement() might not be up to date.  aControl
+   * is expected to not be null.
+   */
+  NS_IMETHOD_(PRBool) IsDefaultSubmitElement(const nsIFormControl* aControl) const = 0;
+
    /**
     * Return whether there is one and only one input text control.
     *

content/html/content/src/nsGenericHTMLElement.cpp

@@ -2266,7 +2266,7 @@ nsGenericHTMLFormElement::nsGenericHTMLFormElement(nsINodeInfo *aNodeInfo)
 
 nsGenericHTMLFormElement::~nsGenericHTMLFormElement()
 {
-  // Check that this element is still not the default content
+  // Check that this element is not still the default content
   // of its parent form.
   NS_ASSERTION(!mForm || mForm->GetDefaultSubmitElement() != this,
                "Content being destroyed is the default content");
@@ -2656,10 +2656,7 @@ nsGenericHTMLFormElement::IntrinsicState() const
     }
   }
   
-  if (mForm &&
-      // XXXbz Need the cast to make VC++6 happy.
-      static_cast<const nsIFormControl*>
-                 (mForm->GetDefaultSubmitElement()) == this) {
+  if (mForm && mForm->IsDefaultSubmitElement(this)) {
       NS_ASSERTION(IsSubmitControl(),
                    "Default submit element that isn't a submit control.");
       // We are the default submit element (:default)

content/html/content/src/nsHTMLFormElement.cpp

@@ -184,6 +184,7 @@ public:
   NS_IMETHOD GetActionURL(nsIURI** aActionURL);
   NS_IMETHOD GetSortedControls(nsTArray<nsIFormControl*>& aControls) const;
   NS_IMETHOD_(nsIFormControl*) GetDefaultSubmitElement() const;
+  NS_IMETHOD_(PRBool) IsDefaultSubmitElement(const nsIFormControl* aControl) const;
   NS_IMETHOD_(PRBool) HasSingleTextControl() const;
 
   // nsIRadioGroupContainer
@@ -1287,7 +1288,7 @@ nsHTMLFormElement::GetElementAt(PRInt32 aIndex,
  */
 static PRInt32 CompareFormControlPosition(nsIFormControl *aControl1,
                                           nsIFormControl *aControl2,
-                                          nsIContent* aForm)
+                                          const nsIContent* aForm)
 {
   NS_ASSERTION(aControl1 != aControl2, "Comparing a form control to itself");
 
@@ -1749,6 +1750,41 @@ nsHTMLFormElement::GetDefaultSubmitElement() const
   return mDefaultSubmitElement;
 }
 
+NS_IMETHODIMP_(PRBool)
+nsHTMLFormElement::IsDefaultSubmitElement(const nsIFormControl* aControl) const
+{
+  NS_PRECONDITION(aControl, "Unexpected call");
+
+  if (aControl == mDefaultSubmitElement) {
+    // Yes, it is
+    return PR_TRUE;
+  }
+
+  if (mDefaultSubmitElement ||
+      (aControl != mFirstSubmitInElements &&
+       aControl != mFirstSubmitNotInElements)) {
+    // It isn't
+    return PR_FALSE;
+  }
+
+  // mDefaultSubmitElement is null, but we have a non-null submit around
+  // (aControl, in fact).  figure out whether it's in fact the default submit
+  // and just hasn't been set that way yet.  Note that we can't just call
+  // HandleDefaultSubmitRemoval because we might need to notify to handle that
+  // correctly and we don't know whether that's safe right here.
+  if (!mFirstSubmitInElements || !mFirstSubmitNotInElements) {
+    // We only have one first submit; aControl has to be it
+    return PR_TRUE;
+  }
+
+  // We have both kinds of submits.  Check which comes first.
+  nsIFormControl* defaultSubmit =
+    CompareFormControlPosition(mFirstSubmitInElements,
+                               mFirstSubmitNotInElements, this) < 0 ?
+      mFirstSubmitInElements : mFirstSubmitNotInElements;
+  return aControl == defaultSubmit;
+}
+
 NS_IMETHODIMP_(PRBool)
 nsHTMLFormElement::HasSingleTextControl() const
 {

layout/base/nsLayoutUtils.cpp

@@ -350,7 +350,7 @@ nsLayoutUtils::DoCompareTreePosition(nsIContent* aContent1,
                                      nsIContent* aContent2,
                                      PRInt32 aIf1Ancestor,
                                      PRInt32 aIf2Ancestor,
-                                     nsIContent* aCommonAncestor)
+                                     const nsIContent* aCommonAncestor)
 {
   NS_PRECONDITION(aContent1, "aContent1 must not be null");
   NS_PRECONDITION(aContent2, "aContent2 must not be null");

layout/base/nsLayoutUtils.h

@@ -154,7 +154,7 @@ public:
    */
   static PRInt32 CompareTreePosition(nsIContent* aContent1,
                                      nsIContent* aContent2,
-                                     nsIContent* aCommonAncestor = nsnull)
+                                     const nsIContent* aCommonAncestor = nsnull)
   {
     return DoCompareTreePosition(aContent1, aContent2, -1, 1, aCommonAncestor);
   }
@@ -169,7 +169,7 @@ public:
                                        nsIContent* aContent2,
                                        PRInt32 aIf1Ancestor,
                                        PRInt32 aIf2Ancestor,
-                                       nsIContent* aCommonAncestor = nsnull);
+                                       const nsIContent* aCommonAncestor = nsnull);
 
   /**
    * CompareTreePosition determines whether aFrame1 comes before or