crash at nsXULDocument::OverlayForwardReference::Merge due to broken implementation of removeelement attribute for overlay merging... we always want to notify of node removals, so don't pass the notify flag along to the Remove function, always send PR_TRUE so that state is updated correctly. r=bz, sr=bryner, a=brendan

content/xul/document/src/nsXULDocument.cpp

@@ -3904,7 +3904,7 @@ nsXULDocument::OverlayForwardReference::Merge(nsIContent* aTargetNode,
         if (attr == nsXULAtoms::removeelement &&
             value.EqualsLiteral("true")) {
 
-            rv = RemoveElement(aTargetNode->GetParent(), aTargetNode, aNotify);
+            rv = RemoveElement(aTargetNode->GetParent(), aTargetNode);
             if (NS_FAILED(rv)) return rv;
 
             return NS_OK;
@@ -4324,11 +4324,11 @@ nsXULDocument::InsertElement(nsIContent* aParent, nsIContent* aChild, PRBool aNo
 }
 
 nsresult
-nsXULDocument::RemoveElement(nsIContent* aParent, nsIContent* aChild, PRBool aNotify)
+nsXULDocument::RemoveElement(nsIContent* aParent, nsIContent* aChild)
 {
     PRInt32 nodeOffset = aParent->IndexOf(aChild);
 
-    return aParent->RemoveChildAt(nodeOffset, aNotify);
+    return aParent->RemoveChildAt(nodeOffset, PR_TRUE);
 }
 
 //----------------------------------------------------------------------

content/xul/document/src/nsXULDocument.h

@@ -494,7 +494,7 @@ protected:
 
     static 
     nsresult
-    RemoveElement(nsIContent* aParent, nsIContent* aChild, PRBool aNotify);
+    RemoveElement(nsIContent* aParent, nsIContent* aChild);
 
     /**
      * The current prototype that we are walking to construct the