Bug 476097, ASSERTION: killing mutation events with <input type=file>, r+sr=bz

content/base/public/nsIContent.h

@@ -65,8 +65,8 @@ class nsISMILAttr;
 
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID       \
-{ 0x2813b1d9, 0x7fe1, 0x496f, \
- { 0x85, 0x52, 0xa2, 0xc1, 0xc5, 0x6b, 0x15, 0x40 } }
+{ 0x48cb2d6d, 0x9ccc, 0x4d0b, \
+  { 0x8c, 0x07, 0x29, 0x96, 0xb5, 0xf9, 0x68, 0x55 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -160,7 +160,7 @@ public:
    */
   void SetNativeAnonymous()
   {
-    SetFlags(NODE_IS_ANONYMOUS);
+    SetFlags(NODE_IS_ANONYMOUS | NODE_IS_IN_ANONYMOUS_SUBTREE);
   }
 
   /**

content/base/src/nsContentUtils.cpp

@@ -3262,15 +3262,17 @@ nsContentUtils::HasMutationListeners(nsINode* aNode,
   doc->MayDispatchMutationEvent(aTargetForSubtreeModified);
 
   // If we have a window, we can check it for mutation listeners now.
-  nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(window));
-  if (piTarget) {
-    nsCOMPtr<nsIEventListenerManager> manager;
-    piTarget->GetListenerManager(PR_FALSE, getter_AddRefs(manager));
-    if (manager) {
-      PRBool hasListeners = PR_FALSE;
-      manager->HasMutationListeners(&hasListeners);
-      if (hasListeners) {
-        return PR_TRUE;
+  if (aNode->IsInDoc()) {
+    nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(window));
+    if (piTarget) {
+      nsCOMPtr<nsIEventListenerManager> manager;
+      piTarget->GetListenerManager(PR_FALSE, getter_AddRefs(manager));
+      if (manager) {
+        PRBool hasListeners = PR_FALSE;
+        manager->HasMutationListeners(&hasListeners);
+        if (hasListeners) {
+          return PR_TRUE;
+        }
       }
     }
   }

layout/forms/nsFileControlFrame.cpp

@@ -162,6 +162,9 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   if (!mTextContent)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Mark the element to be native anonymous before setting any attributes.
+  mTextContent->SetNativeAnonymous();
+
   mTextContent->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         NS_LITERAL_STRING("text"), PR_FALSE);
 
@@ -199,6 +202,9 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   if (!mBrowse)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Mark the element to be native anonymous before setting any attributes.
+  mBrowse->SetNativeAnonymous();
+
   mBrowse->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                    NS_LITERAL_STRING("button"), PR_FALSE);
   nsCOMPtr<nsIDOMHTMLInputElement> fileContent = do_QueryInterface(mContent);