diff --git a/content/xbl/crashtests/415301-1.xul b/content/xbl/crashtests/415301-1.xul
new file mode 100644
index 000000000000..cee274fcd3af
--- /dev/null
+++ b/content/xbl/crashtests/415301-1.xul
@@ -0,0 +1,34 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/content/xbl/crashtests/495354-1.xhtml b/content/xbl/crashtests/495354-1.xhtml
new file mode 100644
index 000000000000..2e76fb8462a7
--- /dev/null
+++ b/content/xbl/crashtests/495354-1.xhtml
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
diff --git a/content/xbl/crashtests/crashtests.list b/content/xbl/crashtests/crashtests.list
index 7a55fc26ca58..69894e24d02e 100644
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@@ -18,6 +18,7 @@ load 404125-1.xhtml
load 406900-1.xul
load 406904-1.xhtml
load 406904-2.xhtml
+load 415301-1.xul
load 418133-1.xhtml
load 415192-1.xul
load 420233-1.xhtml
@@ -27,3 +28,4 @@ load 460665-1.xhtml
load 464863-1.xhtml
load 472260-1.xhtml
load 492978-1.xul
+load 495354-1.xhtml
diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index 619075f75c19..acf93a0011eb 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -1536,6 +1536,11 @@ RemoveChildFromInsertionPoint(nsAnonymousContentList* aInsertionPointList,
// when we've hit it, but just trying to remove from all the pseudo or
// non-pseudo insertion points, depending on the value of
// aRemoveFromPseudoPoints, should work.
+
+ // XXXbz nsXBLInsertionPoint::RemoveChild could return whether it
+ // removed something. Wouldn't that let us short-circuit the walk?
+ // Or can a child be in multiple insertion points? I wouldn't think
+ // so...
PRInt32 count = aInsertionPointList->GetInsertionPointCount();
for (PRInt32 i = 0; i < count; i++) {
nsXBLInsertionPoint* point =
@@ -1571,6 +1576,21 @@ nsBindingManager::ContentRemoved(nsIDocument* aDocument,
PR_FALSE);
SetInsertionParent(aChild, nsnull);
}
+
+ // Also remove from the list in mContentListTable, if any.
+ if (mContentListTable.ops) {
+ nsCOMPtr otherNodeList =
+ static_cast
+ (LookupObject(mContentListTable, point));
+ if (otherNodeList && otherNodeList != nodeList) {
+ // otherNodeList is always anonymous
+ RemoveChildFromInsertionPoint(static_cast
+ (static_cast
+ (otherNodeList)),
+ aChild,
+ PR_FALSE);
+ }
+ }
}
// Whether the child has a nested insertion point or not, aContainer might
diff --git a/layout/reftests/bugs/495354-1-ref.xhtml b/layout/reftests/bugs/495354-1-ref.xhtml
new file mode 100644
index 000000000000..08db245a838a
--- /dev/null
+++ b/layout/reftests/bugs/495354-1-ref.xhtml
@@ -0,0 +1,5 @@
+
+
+9
+
+
diff --git a/layout/reftests/bugs/495354-1a.xhtml b/layout/reftests/bugs/495354-1a.xhtml
new file mode 100644
index 000000000000..085754d06f1e
--- /dev/null
+++ b/layout/reftests/bugs/495354-1a.xhtml
@@ -0,0 +1,8 @@
+
+
+
+
+
+123
+
+
diff --git a/layout/reftests/bugs/495354-1b.xhtml b/layout/reftests/bugs/495354-1b.xhtml
new file mode 100644
index 000000000000..f0ff0c929e80
--- /dev/null
+++ b/layout/reftests/bugs/495354-1b.xhtml
@@ -0,0 +1,8 @@
+
+
+
+
+
+123
+
+