Fix binding teardown to clear out insertion parent entries for nodes that no

longer have insertion parents.  Bug 261818, r=bryner, sr=jst

content/xbl/src/nsXBLBinding.cpp

@@ -1010,6 +1010,16 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
         xuldoc->RemoveSubtreeFromDocument(anonymous);
 #endif
     }
+
+    // Make sure that henceforth we don't claim that mBoundElement's children
+    // have insertion parents in the old document.
+    nsIBindingManager* bindingManager = aOldDocument->GetBindingManager();
+    for (PRUint32 i = mBoundElement->GetChildCount(); i > 0; --i) {
+      NS_ASSERTION(mBoundElement->GetChildAt(i-1),
+                   "Must have child at i for 0 <= i < GetChildCount()!");
+      bindingManager->SetInsertionParent(mBoundElement->GetChildAt(i-1),
+                                         nsnull);
+    }
   }
 
   return NS_OK;

content/xbl/src/nsXBLService.cpp

@@ -659,7 +659,6 @@ nsXBLService::FlushStyleBindings(nsIContent* aContent)
 
     if (styleBinding) {
       // Clear out the script references.
-      nsCOMPtr<nsIDocument> document = aContent->GetDocument();
       styleBinding->UnhookEventHandlers();
       styleBinding->ChangeDocument(document, nsnull);
     }