Bug 476097, ASSERTION: killing mutation events with <input type=file>, r+sr=bz

content/base/public/nsIContent.h

@@ -65,8 +65,8 @@ class nsISMILAttr;
 
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID       \
-{ 0x2813b1d9, 0x7fe1, 0x496f, \
- { 0x85, 0x52, 0xa2, 0xc1, 0xc5, 0x6b, 0x15, 0x40 } }
+{ 0x48cb2d6d, 0x9ccc, 0x4d0b, \
+  { 0x8c, 0x07, 0x29, 0x96, 0xb5, 0xf9, 0x68, 0x55 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -160,7 +160,7 @@ public:
    */
   void SetNativeAnonymous()
   {
-    SetFlags(NODE_IS_ANONYMOUS);
+    SetFlags(NODE_IS_ANONYMOUS | NODE_IS_IN_ANONYMOUS_SUBTREE);
   }
 
   /**

content/base/src/nsContentUtils.cpp

@@ -3262,6 +3262,7 @@ nsContentUtils::HasMutationListeners(nsINode* aNode,
   doc->MayDispatchMutationEvent(aTargetForSubtreeModified);
 
   // If we have a window, we can check it for mutation listeners now.
+  if (aNode->IsInDoc()) {
     nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(window));
     if (piTarget) {
       nsCOMPtr<nsIEventListenerManager> manager;
@@ -3274,6 +3275,7 @@ nsContentUtils::HasMutationListeners(nsINode* aNode,
         }
       }
     }
+  }
 
   // If we have a window, we know a mutation listener is registered, but it
   // might not be in our chain.  If we don't have a window, we might have a

layout/forms/nsFileControlFrame.cpp

@@ -162,6 +162,9 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   if (!mTextContent)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Mark the element to be native anonymous before setting any attributes.
+  mTextContent->SetNativeAnonymous();
+
   mTextContent->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         NS_LITERAL_STRING("text"), PR_FALSE);
 
@@ -199,6 +202,9 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   if (!mBrowse)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Mark the element to be native anonymous before setting any attributes.
+  mBrowse->SetNativeAnonymous();
+
   mBrowse->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                    NS_LITERAL_STRING("button"), PR_FALSE);
   nsCOMPtr<nsIDOMHTMLInputElement> fileContent = do_QueryInterface(mContent);