[XForms] Bug 339104, event listener crashes inside a repeat, r=allan+doron

extensions/xforms/nsXFormsControlStub.cpp

@@ -581,8 +581,6 @@ nsXFormsControlStubBase::Create(nsIXTFElementWrapper *aWrapper)
   mElement = node;
   NS_ASSERTION(mElement, "Wrapper is not an nsIDOMElement, we'll crash soon");
 
-  ResetHelpAndHint(PR_TRUE);
-
 #ifdef DEBUG_smaug
   sControlList->AppendElement(this);
 #endif
@@ -593,7 +591,6 @@ nsXFormsControlStubBase::Create(nsIXTFElementWrapper *aWrapper)
 nsresult
 nsXFormsControlStubBase::OnDestroyed()
 {
-  ResetHelpAndHint(PR_FALSE);
   RemoveIndexListeners();
   mDependencies.Clear();
 
@@ -629,20 +626,30 @@ nsXFormsControlStubBase::ForceModelDetach(PRBool aRebind)
   return rv == NS_OK_XFORMS_DEFERRED ? NS_OK : Refresh();
 }
 
+nsresult
+nsXFormsControlStubBase::WillChangeDocument(nsIDOMDocument *aNewDocument)
+{
+  ResetHelpAndHint(PR_FALSE);
+  return NS_OK;
+}
 
 nsresult
 nsXFormsControlStubBase::DocumentChanged(nsIDOMDocument *aNewDocument)
 {
+  if (aNewDocument) {
+    ResetHelpAndHint(PR_TRUE);
+
     // If we are inserted into a document and we have no model, we are probably
     // being initialized, so we should set our intrinsic state to the default
     // value
-  if (aNewDocument && !mModel && mElement) {
+    if (!mModel && mElement) {
       nsCOMPtr<nsIXTFElementWrapper> xtfWrap(do_QueryInterface(mElement));
       NS_ENSURE_STATE(xtfWrap);
       PRInt32 iState;
       GetDefaultIntrinsicState(&iState);
       xtfWrap->SetIntrinsicState(iState);
     }
+  }
 
   return ForceModelDetach(mHasParent && aNewDocument);
 }

extensions/xforms/nsXFormsControlStub.h

@@ -100,6 +100,7 @@ public:
   nsresult HandleDefault(nsIDOMEvent *aEvent,
                          PRBool      *aHandled);
   nsresult OnDestroyed();
+  nsresult WillChangeDocument(nsIDOMDocument *aNewDocument);
   nsresult DocumentChanged(nsIDOMDocument *aNewDocument);
   nsresult ParentChanged(nsIDOMElement *aNewParent);
   nsresult WillSetAttribute(nsIAtom *aName, const nsAString &aValue);
@@ -139,6 +140,7 @@ public:
                               nsIXTFElement::NOTIFY_ATTRIBUTE_SET |
                               nsIXTFElement::NOTIFY_WILL_REMOVE_ATTRIBUTE | 
                               nsIXTFElement::NOTIFY_ATTRIBUTE_REMOVED | 
+                              nsIXTFElement::NOTIFY_WILL_CHANGE_DOCUMENT |
                               nsIXTFElement::NOTIFY_DOCUMENT_CHANGED |
                               nsIXTFElement::NOTIFY_PARENT_CHANGED |
                               nsIXTFElement::NOTIFY_HANDLE_DEFAULT),
@@ -308,6 +310,11 @@ public:
     return nsXFormsControlStubBase::OnDestroyed();
   }
 
+  NS_IMETHOD WillChangeDocument(nsIDOMDocument *aNewDocument)
+  {
+    return nsXFormsControlStubBase::WillChangeDocument(aNewDocument);
+  }
+
   NS_IMETHOD DocumentChanged(nsIDOMDocument *aNewDocument)
   {
     return nsXFormsControlStubBase::DocumentChanged(aNewDocument);

extensions/xforms/nsXFormsDelegateStub.cpp

@@ -81,7 +81,6 @@ nsXFormsDelegateStub::OnCreated(nsIXTFBindableElementWrapper *aWrapper)
   nsresult rv = nsXFormsBindableControlStub::OnCreated(aWrapper);
   NS_ENSURE_SUCCESS(rv, rv);
   aWrapper->SetNotificationMask(kStandardNotificationMask |
-                                nsIXTFElement::NOTIFY_WILL_CHANGE_DOCUMENT |
                                 nsIXTFElement::NOTIFY_WILL_CHANGE_PARENT);
   return rv;
 }

extensions/xforms/nsXFormsModelElement.cpp

@@ -667,8 +667,6 @@ NS_IMPL_RELEASE_INHERITED(nsXFormsModelElement, nsXFormsStubElement)
 NS_IMETHODIMP
 nsXFormsModelElement::OnDestroyed()
 {
-  RemoveModelFromDocument();
-
   mElement = nsnull;
   mSchemas = nsnull;