Don't run XBL constructors during frame construction, ever. Bug 398006,

r=sicking, sr=roc

dom/src/base/nsDOMClassInfo.cpp

@@ -7009,7 +7009,12 @@ nsElementSH::PostCreate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   }
   
   if (binding) {
-    binding->ExecuteAttachedHandler();
+    // Make sure the presshell is in a state where it's safe to execute script
+    PRBool safeToRunScript = PR_FALSE;
+    pctx->PresShell()->IsSafeToFlush(safeToRunScript);
+    if (safeToRunScript) {
+      binding->ExecuteAttachedHandler();
+    }
   }
 
   return NS_OK;

layout/base/nsPresShell.cpp

@@ -3332,7 +3332,11 @@ PresShell::RecreateFramesFor(nsIContent* aContent)
   nsStyleChangeList changeList;
   changeList.AppendChange(nsnull, aContent, nsChangeHint_ReconstructFrame);
 
+  // Mark ourselves as not safe to flush while we're doing frame construction.
+  ++mChangeNestCount;
   nsresult rv = mFrameConstructor->ProcessRestyledFrames(changeList);
+  --mChangeNestCount;
+  
   mViewManager->EndUpdateViewBatch(NS_VMREFRESH_NO_SYNC);
 #ifdef ACCESSIBILITY
   InvalidateAccessibleSubtree(aContent);
@@ -6031,6 +6035,10 @@ PresShell::DidCauseReflow()
   if (--mChangeNestCount == 0) {
     // We may have had more reflow commands appended to the queue during
     // our reflow.  Make sure these get processed at some point.
+
+    // XXXbz why is this really needed?  ProcessReflowCommands handles posting
+    // reflow events if there are reflow roots remaining, and FrameNeedsReflow
+    // posts events as needed as well.  I think we should remove this.
     PostReflowEvent();
   }
 
@@ -6375,7 +6383,11 @@ PresShell::Observe(nsISupports* aSubject,
       nsStyleChangeList changeList;
       WalkFramesThroughPlaceholders(mPresContext, rootFrame,
                                     ReframeImageBoxes, &changeList);
+      // Mark ourselves as not safe to flush while we're doing frame
+      // construction.
+      ++mChangeNestCount;
       mFrameConstructor->ProcessRestyledFrames(changeList);
+      --mChangeNestCount;
 
       mViewManager->EndUpdateViewBatch(NS_VMREFRESH_NO_SYNC);
 #ifdef ACCESSIBILITY