Fixes for bugs 17460 and 21656. r=travis

content/html/content/src/nsGenericHTMLElement.cpp

@@ -57,6 +57,10 @@
 #include "nsINameSpaceManager.h"
 #include "nsDOMError.h"
 
+#include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
+#include "nsILayoutHistoryState.h"
+
 #include "nsIHTMLContentContainer.h"
 #include "nsHTMLParts.h"
 #include "nsString.h"
@@ -1605,6 +1609,31 @@ nsGenericHTMLElement::GetPrimaryFrame(nsIHTMLContent* aContent,
   return res;
 }         
 
+nsresult 
+nsGenericHTMLElement::GetPrimaryPresState(nsIHTMLContent* aContent,
+                                          nsIStatefulFrame::StateType aStateType,
+                                          nsIPresState** aPresState)
+{
+   // Get the document
+  nsCOMPtr<nsIDocument> doc;
+  aContent->GetDocument(*getter_AddRefs(doc));
+  if (doc) {
+     // Get presentation shell 0
+    nsCOMPtr<nsIPresShell> presShell = getter_AddRefs(doc->GetShellAt(0));
+    if (presShell) {
+      nsCOMPtr<nsILayoutHistoryState> history;
+      presShell->GetHistoryState(getter_AddRefs(history));
+      if (history) {
+        PRUint32 ID;
+        aContent->GetContentID(&ID);
+        history->GetState(ID, aPresState, aStateType);
+      }
+    }
+  }
+ 
+  return NS_OK;
+}         
+
 // XXX This creates a dependency between content and frames
 nsresult 
 nsGenericHTMLElement::GetPresContext(nsIHTMLContent* aContent,

content/html/content/src/nsGenericHTMLElement.h

@@ -31,6 +31,8 @@
 #include "nsIJSScriptObject.h"
 #include "nsINameSpaceManager.h"  // for kNameSpaceID_HTML
 
+#include "nsIStatefulFrame.h"
+
 extern const nsIID kIDOMHTMLElementIID;
 extern const nsIID kIHTMLContentIID;
 
@@ -53,6 +55,7 @@ class nsIURI;
 class nsIFormControlFrame;
 class nsIFormControl;
 class nsIForm;
+class nsIPresState;
 
 class nsGenericHTMLElement : public nsGenericElement {
 public:
@@ -281,9 +284,12 @@ public:
   static PRBool GetBackgroundAttributesImpact(const nsIAtom* aAttribute,
                                               PRInt32& aHint);
 
-  //XXX These two creates a dependency between content and frames 
+  //XXX These three create a dependency between content and frames 
   static nsresult GetPrimaryFrame(nsIHTMLContent* aContent,
                                   nsIFormControlFrame *&aFormControlFrame);
+  static nsresult GetPrimaryPresState(nsIHTMLContent* aContent,
+                                          nsIStatefulFrame::StateType aStateType,
+                                          nsIPresState** aPresState);
   static nsresult GetPresContext(nsIHTMLContent* aContent, nsIPresContext** aPresContext);
 
   static nsresult GetBaseURL(const nsHTMLValue& aBaseHref,

content/html/content/src/nsHTMLInputElement.cpp

@@ -49,6 +49,8 @@
 #include "nsIEventStateManager.h"
 #include "nsISizeOfHandler.h"
 
+#include "nsIPresState.h"
+
 // XXX align=left, hspace, vspace, border? other nav4 attrs
 
 static NS_DEFINE_IID(kIDOMHTMLInputElementIID, NS_IDOMHTMLINPUTELEMENT_IID);
@@ -400,8 +402,20 @@ nsHTMLInputElement::GetValue(nsString& aValue)
       if (nsnull != formControlFrame) {
         formControlFrame->GetProperty(nsHTMLAtoms::value, aValue);
       }
-      return NS_OK;
     }
+    else {
+      // Retrieve the presentation state instead.
+      nsCOMPtr<nsIPresState> presState;
+      nsGenericHTMLElement::GetPrimaryPresState(this, nsIStatefulFrame::eTextType, getter_AddRefs(presState));
+
+      // Obtain the value property from the presentation state.
+      if (presState) {
+        nsAutoString value;
+        presState->GetStateProperty("value", aValue);
+      }
+    }
+      
+    return NS_OK;
   }
   // Treat value == defaultValue for other input elements
   return mInner.GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::value, aValue); 
@@ -422,9 +436,20 @@ nsHTMLInputElement::SetValue(const nsString& aValue)
         formControlFrame->SetProperty(presContext, nsHTMLAtoms::value, aValue);
         NS_IF_RELEASE(presContext);
       }
-      return NS_OK;
     }
+    else {
+      // Retrieve the presentation state instead.
+      nsCOMPtr<nsIPresState> presState;
+      nsGenericHTMLElement::GetPrimaryPresState(this, nsIStatefulFrame::eTextType, getter_AddRefs(presState));
+
+      // Obtain the value property from the presentation state.
+      if (presState) {
+        presState->SetStateProperty("value", aValue);
+      }
+    }
+    return NS_OK;
   }
+
   // Treat value == defaultValue for other input elements.
   return mInner.SetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::value, aValue, PR_TRUE);
 }

layout/base/nsCSSFrameConstructor.cpp

@@ -527,7 +527,6 @@ nsCSSFrameConstructor::nsCSSFrameConstructor(void)
     mGfxScrollFrame(nsnull)
 {
   NS_INIT_REFCNT();
-  NS_NewLayoutHistoryState(getter_AddRefs(mTempFrameTreeState));
 }
 
 nsCSSFrameConstructor::~nsCSSFrameConstructor(void)
@@ -2199,6 +2198,9 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
           
 */    
 
+  if (!mTempFrameTreeState)
+    aPresShell->GetHistoryState(getter_AddRefs(mTempFrameTreeState));
+
   // ----- reattach gfx scrollbars ------
   // Gfx scrollframes were created in the root frame but the primary frame map may have been destroyed if a 
   // new style sheet was loaded so lets reattach the frames to their content.
@@ -6745,7 +6747,7 @@ nsCSSFrameConstructor::RemoveMappingsForFrameSubtree(nsIPresContext* aPresContex
   presShell->GetFrameManager(getter_AddRefs(frameManager));
   
   // Save the frame tree's state before deleting it
-  CaptureStateFor(aPresContext, aRemovedFrame, aFrameState);
+  CaptureStateFor(aPresContext, aRemovedFrame, mTempFrameTreeState);
 
   return DeletingFrameSubtree(aPresContext, presShell, frameManager, aRemovedFrame);
 }
@@ -9649,7 +9651,7 @@ nsCSSFrameConstructor::CreateTreeWidgetContent(nsIPresContext* aPresContext,
     nsFrameConstructorState state(aPresContext, mFixedContainingBlock,
                                   GetAbsoluteContainingBlock(aPresContext, aParentFrame),
                                   GetFloaterContainingBlock(aPresContext, aParentFrame), 
-                                  aFrameState);
+                                  mTempFrameTreeState);
 
     // Get the element's tag
     nsCOMPtr<nsIAtom>  tag;

layout/base/nsCSSFrameConstructor.h

@@ -901,13 +901,7 @@ protected:
   nsIFrame*           mDocElementContainingBlock;
   nsIFrame*           mGfxScrollFrame;
 
-  // XXX This is an interface into a hashtable that holds frame state objects
-  // for saving/restoring state as frame trees are deleted and created in 
-  // RecreateFramesForContent() and ReconstructDocElementHierarchy().  
-  // These state objects should be stored in the hashtable maintained by the 
-  // session history, but since the session history API is undergoing a re-write, 
-  // we'll start using session history once that re-write is done.
-  nsCOMPtr<nsILayoutHistoryState>  mTempFrameTreeState;
+  nsCOMPtr<nsILayoutHistoryState> mTempFrameTreeState;
 };
 
 #endif /* nsCSSFrameConstructor_h___ */

layout/base/nsFrameManager.cpp

@@ -40,6 +40,7 @@
 #endif
 #include "nsILayoutHistoryState.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 #include "nsIContent.h"
 #include "nsINameSpaceManager.h"
 
@@ -1385,7 +1386,7 @@ CaptureFrameStateFor(nsIPresContext* aPresContext, nsIFrame* aFrame, nsILayoutHi
         nsIStatefulFrame::StateType type = nsIStatefulFrame::eNoType;
         rv = statefulFrame->GetStateType(aPresContext, &type);
         if (NS_SUCCEEDED(rv)) {
-          nsCOMPtr<nsISupports> frameState;
+          nsCOMPtr<nsIPresState> frameState;
           rv = statefulFrame->SaveState(aPresContext, getter_AddRefs(frameState));
           if (NS_SUCCEEDED(rv)) {
             rv = aState->AddState(ID, frameState, type);            
@@ -1446,10 +1447,14 @@ RestoreFrameStateFor(nsIPresContext* aPresContext, nsIFrame* aFrame, nsILayoutHi
         nsIStatefulFrame::StateType type = nsIStatefulFrame::eNoType;
         rv = statefulFrame->GetStateType(aPresContext, &type);
         if (NS_SUCCEEDED(rv)) {
-          nsISupports* frameState = nsnull;
-          rv = aState->GetState(ID, &frameState, type);          
-          if (NS_SUCCEEDED(rv) && nsnull != frameState) {
-            rv = statefulFrame->RestoreState(aPresContext, frameState);  
+          nsCOMPtr<nsIPresState> frameState;
+          rv = aState->GetState(ID, getter_AddRefs(frameState), type);          
+          if (NS_SUCCEEDED(rv) && frameState) {
+            // First restore the state.
+            rv = statefulFrame->RestoreState(aPresContext, frameState);
+            
+            // Now remove the state from the state table.
+            aState->RemoveState(ID, type);
           }
         }
       }

layout/base/nsILayoutHistoryState.h

@@ -3,6 +3,7 @@
 
 #include "nsISupports.h"
 #include "nsIStatefulFrame.h" // Get StateType enum
+#include "nsIPresState.h"
 
 #define NS_ILAYOUTHISTORYSTATE_IID_STR "306c8ca0-5f0c-11d3-a9fb-000064657374"
 
@@ -14,8 +15,9 @@ class nsILayoutHistoryState : public nsISupports {
  public: 
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_ILAYOUTHISTORYSTATE_IID)
 
-  NS_IMETHOD AddState(PRUint32 aContentID, nsISupports* aState, nsIStatefulFrame::StateType aStateType) = 0;
-  NS_IMETHOD GetState(PRUint32 aContentID, nsISupports** aState,  nsIStatefulFrame::StateType aStateType) = 0;
+  NS_IMETHOD AddState(PRUint32 aContentID, nsIPresState* aState, nsIStatefulFrame::StateType aStateType) = 0;
+  NS_IMETHOD GetState(PRUint32 aContentID, nsIPresState** aState,  nsIStatefulFrame::StateType aStateType) = 0;
+  NS_IMETHOD RemoveState(PRUint32 aContentID, nsIStatefulFrame::StateType aStateType) = 0;
 };
 
 nsresult

layout/base/nsIPresState.h

@@ -12,8 +12,14 @@ class nsIPresState : public nsISupports {
 public: 
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_IPRESSTATE_IID)
 
-  NS_IMETHOD GetStateProperty(nsString& aProperty) = 0;
-  NS_IMETHOD SetStateProperty(const nsString& aProperty) = 0;
+  NS_IMETHOD GetStatePropertyAsSupports(const nsString& aName, nsISupports** aResult) = 0;
+  NS_IMETHOD SetStatePropertyAsSupports(const nsString& aName, nsISupports* aValue) = 0;
+
+  NS_IMETHOD GetStateProperty(const nsString& aName, nsString& aResult) = 0;
+  NS_IMETHOD SetStateProperty(const nsString& aProperty, const nsString& aValue) = 0;
 };
 
+extern nsresult
+NS_NewPresState(nsIPresState** aResult);
+
 #endif /* _nsIPresState_h */

layout/base/nsLayoutHistoryState.cpp

@@ -67,11 +67,14 @@ public:
 
   // nsILayoutHistoryState
   NS_IMETHOD AddState(PRUint32 aContentID,
-    nsISupports* aState,
+    nsIPresState* aState,
     nsIStatefulFrame::StateType aStateType = nsIStatefulFrame::eNoType);
   NS_IMETHOD GetState(PRUint32 aContentID,
-    nsISupports** aState,
+    nsIPresState** aState,
     nsIStatefulFrame::StateType aStateType = nsIStatefulFrame::eNoType);
+  NS_IMETHOD RemoveState(PRUint32 aContentID,
+    nsIStatefulFrame::StateType aStateType = nsIStatefulFrame::eNoType);
+
 
 private:
   nsSupportsHashtable mStates;
@@ -108,7 +111,7 @@ NS_IMPL_ISUPPORTS(nsLayoutHistoryState,
 
 NS_IMETHODIMP
 nsLayoutHistoryState::AddState(PRUint32 aContentID,                                
-                               nsISupports* aState, 
+                               nsIPresState* aState, 
                                nsIStatefulFrame::StateType aStateType)
 {
   nsresult rv = NS_OK;
@@ -130,7 +133,7 @@ nsLayoutHistoryState::AddState(PRUint32 aContentID,
 
 NS_IMETHODIMP
 nsLayoutHistoryState::GetState(PRUint32 aContentID,                                
-                               nsISupports** aState,
+                               nsIPresState** aState,
                                nsIStatefulFrame::StateType aStateType)
 {
   nsresult rv = NS_OK;
@@ -138,7 +141,7 @@ nsLayoutHistoryState::GetState(PRUint32 aContentID,
   void * state = nsnull;
   state = mStates.Get(&key);
   if (state) {
-    *aState = (nsISupports *)state;
+    *aState = (nsIPresState *)state;
   }
   else {
     printf("nsLayoutHistoryState::GetState, ERROR getting History state for the key\n");
@@ -147,3 +150,14 @@ nsLayoutHistoryState::GetState(PRUint32 aContentID,
   }
   return rv;
 }
+
+NS_IMETHODIMP
+nsLayoutHistoryState::RemoveState(PRUint32 aContentID,                                
+                                  nsIStatefulFrame::StateType aStateType)
+{
+  nsresult rv = NS_OK;
+  HistoryKey key(aContentID, aStateType);
+  void * state = nsnull;
+  state = mStates.Remove(&key);
+  return rv;
+}

layout/base/nsPresShell.cpp

@@ -2299,21 +2299,29 @@ PresShell::GetHistoryState(nsILayoutHistoryState** aState)
 
   NS_PRECONDITION(nsnull != aState, "null state pointer");
 
-  // Create the document state object
-  rv = NS_NewLayoutHistoryState(aState);
+  if (!mHistoryState) {
+    // Create the document state object
+    rv = NS_NewLayoutHistoryState(aState); // This addrefs
   
-  if (NS_FAILED(rv)) { 
-    *aState = nsnull;
-    return rv;
+    if (NS_FAILED(rv)) { 
+      *aState = nsnull;
+      return rv;
+    }
+
+    // Capture frame state for the entire frame hierarchy
+    nsIFrame* rootFrame = nsnull;
+    rv = GetRootFrame(&rootFrame);
+    if (NS_FAILED(rv) || nsnull == rootFrame) return rv;
+
+    rv = mFrameManager->CaptureFrameState(mPresContext, rootFrame, *aState);
+
+    mHistoryState = *aState;
+    return NS_OK;
   }
-
-  // Capture frame state for the entire frame hierarchy
-  nsIFrame* rootFrame = nsnull;
-  rv = GetRootFrame(&rootFrame);
-  if (NS_FAILED(rv) || nsnull == rootFrame) return rv;
-
-  rv = mFrameManager->CaptureFrameState(mPresContext, rootFrame, *aState);
-
+  
+  *aState = mHistoryState;
+  NS_IF_ADDREF(mHistoryState);
+ 
   return rv;
 }
 

layout/base/nsPresState.cpp

@@ -0,0 +1,130 @@
+#include "nsCOMPtr.h"
+#include "nsIPresState.h"
+#include "nsHashtable.h"
+#include "nsISupportsPrimitives.h"
+#include "nsIComponentManager.h"
+
+// Static IIDs/CIDs. Try to minimize these.
+// None
+
+
+class nsPresState: public nsIPresState
+{
+  NS_DECL_ISUPPORTS
+
+  NS_IMETHOD GetStatePropertyAsSupports(const nsString& aName, nsISupports** aResult);
+  NS_IMETHOD SetStatePropertyAsSupports(const nsString& aName, nsISupports* aValue);
+
+  NS_IMETHOD GetStateProperty(const nsString& aProperty, nsString& aResult);
+  NS_IMETHOD SetStateProperty(const nsString& aProperty, const nsString& aValue);
+
+public:
+  nsPresState();
+  virtual ~nsPresState();
+
+// Static members
+
+// Internal member functions
+protected:
+  
+// MEMBER VARIABLES
+protected:
+  // A string table that holds property/value pairs.
+  nsSupportsHashtable* mPropertyTable; 
+};
+
+// Static initialization
+
+
+// Implementation /////////////////////////////////////////////////////////////////
+
+// Implement our nsISupports methods
+NS_IMPL_ISUPPORTS1(nsPresState, nsIPresState)
+
+// Constructors/Destructors
+nsPresState::nsPresState(void)
+:mPropertyTable(nsnull)
+{
+  NS_INIT_REFCNT();
+}
+
+nsPresState::~nsPresState(void)
+{
+  delete mPropertyTable;
+}
+
+// nsIPresState Interface ////////////////////////////////////////////////////////////////
+
+NS_IMETHODIMP
+nsPresState::GetStateProperty(const nsString& aName, nsString& aResult)
+{
+  // Retrieve from hashtable.
+  nsCOMPtr<nsISupportsString> str;
+  nsStringKey key(aName);
+  str = dont_AddRef(NS_STATIC_CAST(nsISupportsString*, mPropertyTable->Get(&key)));
+  aResult = "";
+  if (str) {
+    char* data;
+    str->GetData(&data);
+    aResult = data;
+    nsAllocator::Free(data);
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPresState::SetStateProperty(const nsString& aName, const nsString& aValue)
+{
+  if (!mPropertyTable)
+    mPropertyTable = new nsSupportsHashtable(8);
+
+  // Add to hashtable
+  nsStringKey key(aName);
+
+  nsCOMPtr<nsISupportsString> supportsStr;
+  nsresult rv = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
+                                                    NS_GET_IID(nsISupportsString), getter_AddRefs(supportsStr));
+
+  char* val = aValue.ToNewCString();
+  supportsStr->SetData(val);
+  nsAllocator::Free(val);
+  mPropertyTable->Put(&key, supportsStr);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPresState::GetStatePropertyAsSupports(const nsString& aName, nsISupports** aResult)
+{
+  // Retrieve from hashtable.
+  nsCOMPtr<nsISupports> supp;
+  nsStringKey key(aName);
+  supp = dont_AddRef(NS_STATIC_CAST(nsISupports*, mPropertyTable->Get(&key)));
+  *aResult = supp;
+  NS_IF_ADDREF(*aResult);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPresState::SetStatePropertyAsSupports(const nsString& aName, nsISupports* aValue)
+{
+  if (!mPropertyTable)
+    mPropertyTable = new nsSupportsHashtable(8);
+
+  // Add to hashtable
+  nsStringKey key(aName);
+  mPropertyTable->Put(&key, aValue);
+  return NS_OK;
+}
+
+// Creation Routine ///////////////////////////////////////////////////////////////////////
+
+nsresult
+NS_NewPresState(nsIPresState** aResult)
+{
+  *aResult = new nsPresState;
+  if (!*aResult)
+    return NS_ERROR_OUT_OF_MEMORY;
+  NS_ADDREF(*aResult);
+  return NS_OK;
+}
+

layout/base/public/nsILayoutHistoryState.h

@@ -3,6 +3,7 @@
 
 #include "nsISupports.h"
 #include "nsIStatefulFrame.h" // Get StateType enum
+#include "nsIPresState.h"
 
 #define NS_ILAYOUTHISTORYSTATE_IID_STR "306c8ca0-5f0c-11d3-a9fb-000064657374"
 
@@ -14,8 +15,9 @@ class nsILayoutHistoryState : public nsISupports {
  public: 
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_ILAYOUTHISTORYSTATE_IID)
 
-  NS_IMETHOD AddState(PRUint32 aContentID, nsISupports* aState, nsIStatefulFrame::StateType aStateType) = 0;
-  NS_IMETHOD GetState(PRUint32 aContentID, nsISupports** aState,  nsIStatefulFrame::StateType aStateType) = 0;
+  NS_IMETHOD AddState(PRUint32 aContentID, nsIPresState* aState, nsIStatefulFrame::StateType aStateType) = 0;
+  NS_IMETHOD GetState(PRUint32 aContentID, nsIPresState** aState,  nsIStatefulFrame::StateType aStateType) = 0;
+  NS_IMETHOD RemoveState(PRUint32 aContentID, nsIStatefulFrame::StateType aStateType) = 0;
 };
 
 nsresult

layout/base/public/nsIPresState.h

@@ -12,8 +12,14 @@ class nsIPresState : public nsISupports {
 public: 
   NS_DEFINE_STATIC_IID_ACCESSOR(NS_IPRESSTATE_IID)
 
-  NS_IMETHOD GetStateProperty(nsString& aProperty) = 0;
-  NS_IMETHOD SetStateProperty(const nsString& aProperty) = 0;
+  NS_IMETHOD GetStatePropertyAsSupports(const nsString& aName, nsISupports** aResult) = 0;
+  NS_IMETHOD SetStatePropertyAsSupports(const nsString& aName, nsISupports* aValue) = 0;
+
+  NS_IMETHOD GetStateProperty(const nsString& aName, nsString& aResult) = 0;
+  NS_IMETHOD SetStateProperty(const nsString& aProperty, const nsString& aValue) = 0;
 };
 
+extern nsresult
+NS_NewPresState(nsIPresState** aResult);
+
 #endif /* _nsIPresState_h */

layout/base/public/nsIStatefulFrame.h

@@ -4,6 +4,7 @@
 #include "nsISupports.h"
 
 class nsIPresContext;
+class nsIPresState;
 
 #define NS_ISTATEFULFRAME_IID_STR "306c8ca0-5f0c-11d3-a9fb-000064657374"
 
@@ -21,9 +22,8 @@ class nsIStatefulFrame : public nsISupports {
                 eTextType, eNumStateTypes};
 
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType) = 0;
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState) = 0;
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState) = 0;
-
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState) = 0;
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState) = 0;
 };
 
 #endif /* _nsIStatefulFrame_h */

layout/base/src/Makefile.in

@@ -54,6 +54,7 @@ CPPSRCS		= \
 		nsNameSpaceManager.cpp \
 		nsPluginViewer.cpp \
 		nsPresContext.cpp \
+		nsPresState.cpp \
 		nsPrintContext.cpp \
 		nsPrintPreviewContext.cpp \
 		nsRange.cpp \

layout/base/src/makefile.win

@@ -48,6 +48,7 @@ CPPSRCS =				\
 	nsNameSpaceManager.cpp		\
 	nsPluginViewer.cpp		\
 	nsPresContext.cpp		\
+	nsPresState.cpp         \
 	nsPrintContext.cpp		\
 	nsPrintPreviewContext.cpp	\
 	nsSpaceManager.cpp		\
@@ -93,6 +94,7 @@ CPP_OBJS=					\
 	.\$(OBJDIR)\nsNameSpaceManager.obj	\
 	.\$(OBJDIR)\nsPluginViewer.obj		\
 	.\$(OBJDIR)\nsPresContext.obj		\
+	.\$(OBJDIR)\nsPresState.obj         \
 	.\$(OBJDIR)\nsPrintContext.obj		\
 	.\$(OBJDIR)\nsPrintPreviewContext.obj	\
 	.\$(OBJDIR)\nsSpaceManager.obj		\

layout/base/src/nsLayoutHistoryState.cpp

@@ -67,11 +67,14 @@ public:
 
   // nsILayoutHistoryState
   NS_IMETHOD AddState(PRUint32 aContentID,
-    nsISupports* aState,
+    nsIPresState* aState,
     nsIStatefulFrame::StateType aStateType = nsIStatefulFrame::eNoType);
   NS_IMETHOD GetState(PRUint32 aContentID,
-    nsISupports** aState,
+    nsIPresState** aState,
     nsIStatefulFrame::StateType aStateType = nsIStatefulFrame::eNoType);
+  NS_IMETHOD RemoveState(PRUint32 aContentID,
+    nsIStatefulFrame::StateType aStateType = nsIStatefulFrame::eNoType);
+
 
 private:
   nsSupportsHashtable mStates;
@@ -108,7 +111,7 @@ NS_IMPL_ISUPPORTS(nsLayoutHistoryState,
 
 NS_IMETHODIMP
 nsLayoutHistoryState::AddState(PRUint32 aContentID,                                
-                               nsISupports* aState, 
+                               nsIPresState* aState, 
                                nsIStatefulFrame::StateType aStateType)
 {
   nsresult rv = NS_OK;
@@ -130,7 +133,7 @@ nsLayoutHistoryState::AddState(PRUint32 aContentID,
 
 NS_IMETHODIMP
 nsLayoutHistoryState::GetState(PRUint32 aContentID,                                
-                               nsISupports** aState,
+                               nsIPresState** aState,
                                nsIStatefulFrame::StateType aStateType)
 {
   nsresult rv = NS_OK;
@@ -138,7 +141,7 @@ nsLayoutHistoryState::GetState(PRUint32 aContentID,
   void * state = nsnull;
   state = mStates.Get(&key);
   if (state) {
-    *aState = (nsISupports *)state;
+    *aState = (nsIPresState *)state;
   }
   else {
     printf("nsLayoutHistoryState::GetState, ERROR getting History state for the key\n");
@@ -147,3 +150,14 @@ nsLayoutHistoryState::GetState(PRUint32 aContentID,
   }
   return rv;
 }
+
+NS_IMETHODIMP
+nsLayoutHistoryState::RemoveState(PRUint32 aContentID,                                
+                                  nsIStatefulFrame::StateType aStateType)
+{
+  nsresult rv = NS_OK;
+  HistoryKey key(aContentID, aStateType);
+  void * state = nsnull;
+  state = mStates.Remove(&key);
+  return rv;
+}

layout/base/src/nsPresState.cpp

@@ -0,0 +1,130 @@
+#include "nsCOMPtr.h"
+#include "nsIPresState.h"
+#include "nsHashtable.h"
+#include "nsISupportsPrimitives.h"
+#include "nsIComponentManager.h"
+
+// Static IIDs/CIDs. Try to minimize these.
+// None
+
+
+class nsPresState: public nsIPresState
+{
+  NS_DECL_ISUPPORTS
+
+  NS_IMETHOD GetStatePropertyAsSupports(const nsString& aName, nsISupports** aResult);
+  NS_IMETHOD SetStatePropertyAsSupports(const nsString& aName, nsISupports* aValue);
+
+  NS_IMETHOD GetStateProperty(const nsString& aProperty, nsString& aResult);
+  NS_IMETHOD SetStateProperty(const nsString& aProperty, const nsString& aValue);
+
+public:
+  nsPresState();
+  virtual ~nsPresState();
+
+// Static members
+
+// Internal member functions
+protected:
+  
+// MEMBER VARIABLES
+protected:
+  // A string table that holds property/value pairs.
+  nsSupportsHashtable* mPropertyTable; 
+};
+
+// Static initialization
+
+
+// Implementation /////////////////////////////////////////////////////////////////
+
+// Implement our nsISupports methods
+NS_IMPL_ISUPPORTS1(nsPresState, nsIPresState)
+
+// Constructors/Destructors
+nsPresState::nsPresState(void)
+:mPropertyTable(nsnull)
+{
+  NS_INIT_REFCNT();
+}
+
+nsPresState::~nsPresState(void)
+{
+  delete mPropertyTable;
+}
+
+// nsIPresState Interface ////////////////////////////////////////////////////////////////
+
+NS_IMETHODIMP
+nsPresState::GetStateProperty(const nsString& aName, nsString& aResult)
+{
+  // Retrieve from hashtable.
+  nsCOMPtr<nsISupportsString> str;
+  nsStringKey key(aName);
+  str = dont_AddRef(NS_STATIC_CAST(nsISupportsString*, mPropertyTable->Get(&key)));
+  aResult = "";
+  if (str) {
+    char* data;
+    str->GetData(&data);
+    aResult = data;
+    nsAllocator::Free(data);
+  }
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPresState::SetStateProperty(const nsString& aName, const nsString& aValue)
+{
+  if (!mPropertyTable)
+    mPropertyTable = new nsSupportsHashtable(8);
+
+  // Add to hashtable
+  nsStringKey key(aName);
+
+  nsCOMPtr<nsISupportsString> supportsStr;
+  nsresult rv = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
+                                                    NS_GET_IID(nsISupportsString), getter_AddRefs(supportsStr));
+
+  char* val = aValue.ToNewCString();
+  supportsStr->SetData(val);
+  nsAllocator::Free(val);
+  mPropertyTable->Put(&key, supportsStr);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPresState::GetStatePropertyAsSupports(const nsString& aName, nsISupports** aResult)
+{
+  // Retrieve from hashtable.
+  nsCOMPtr<nsISupports> supp;
+  nsStringKey key(aName);
+  supp = dont_AddRef(NS_STATIC_CAST(nsISupports*, mPropertyTable->Get(&key)));
+  *aResult = supp;
+  NS_IF_ADDREF(*aResult);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsPresState::SetStatePropertyAsSupports(const nsString& aName, nsISupports* aValue)
+{
+  if (!mPropertyTable)
+    mPropertyTable = new nsSupportsHashtable(8);
+
+  // Add to hashtable
+  nsStringKey key(aName);
+  mPropertyTable->Put(&key, aValue);
+  return NS_OK;
+}
+
+// Creation Routine ///////////////////////////////////////////////////////////////////////
+
+nsresult
+NS_NewPresState(nsIPresState** aResult)
+{
+  *aResult = new nsPresState;
+  if (!*aResult)
+    return NS_ERROR_OUT_OF_MEMORY;
+  NS_ADDREF(*aResult);
+  return NS_OK;
+}
+

layout/forms/nsComboboxControlFrame.cpp

@@ -37,6 +37,7 @@
 #include "nsIDOMHTMLSelectElement.h" 
 #include "nsIDOMHTMLOptionElement.h" 
 #include "nsIPresShell.h"
+#include "nsIPresState.h"
 #include "nsISupportsArray.h"
 #include "nsIDeviceContext.h"
 #include "nsIView.h"
@@ -1485,7 +1486,7 @@ nsComboboxControlFrame::GetStateType(nsIPresContext* aPresContext,
 }
 
 NS_IMETHODIMP
-nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
   if (!mListControlFrame) return NS_ERROR_UNEXPECTED;
   nsIStatefulFrame* sFrame = nsnull;
@@ -1499,7 +1500,7 @@ nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aS
 }
 
 NS_IMETHODIMP
-nsComboboxControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsComboboxControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
   if (!mListControlFrame) return NS_ERROR_UNEXPECTED;
   nsIStatefulFrame* sFrame = nsnull;

layout/forms/nsComboboxControlFrame.h

@@ -41,6 +41,7 @@ class nsIView;
 class nsStyleContext;
 class nsIHTMLContent;
 class nsIListControlFrame;
+class nsIPresState;
 
 /**
  * Child list name indices
@@ -154,8 +155,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
   //nsIRollupListener
   NS_IMETHOD Rollup();

layout/forms/nsFileControlFrame.cpp

@@ -32,6 +32,7 @@
 #include "nsIHTMLContent.h"
 #include "nsHTMLIIDs.h"
 #include "nsHTMLAtoms.h"
+#include "nsIPresState.h"
 #include "nsIFileWidget.h"
 #include "nsWidgetsCID.h"
 #include "nsIComponentManager.h"
@@ -547,37 +548,25 @@ nsFileControlFrame::GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame:
 }
 
 NS_IMETHODIMP
-nsFileControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsFileControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
-  nsISupportsString* value = nsnull;
-  nsAutoString string;
-  nsresult res = GetProperty(nsHTMLAtoms::value, string);
-  if (NS_SUCCEEDED(res)) {
-    char* chars = string.ToNewCString();
-    if (chars) {
-      res = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
-                                           NS_GET_IID(nsISupportsString), (void**)&value);
-      if (NS_SUCCEEDED(res) && value) {
-        value->SetData(chars);
-      }
-      nsCRT::free(chars);
-    } else {
-      res = NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-  *aState = (nsISupports*)value;
-  return res;
+  // Construct a pres state.
+  NS_NewPresState(aState); // The addref happens here.
+  
+  // This string will hold a single item, whether or not we're checked.
+  nsAutoString stateString;
+  GetProperty(nsHTMLAtoms::value, stateString);
+  (*aState)->SetStateProperty("checked", stateString);
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
-nsFileControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsFileControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
-  char* chars = nsnull;
-  nsresult res = ((nsISupportsString*)aState)->GetData(&chars);
-  if (NS_SUCCEEDED(res) && chars) {
-    nsAutoString value(chars);
-    SetProperty(aPresContext, nsHTMLAtoms::value, value);
-    nsCRT::free(chars);
-  }
-  return res;
+  nsAutoString string;
+  aState->GetStateProperty("checked", string);
+  SetProperty(aPresContext, nsHTMLAtoms::value, string);
+  return NS_OK;
+
 }

layout/forms/nsFileControlFrame.h

@@ -29,6 +29,7 @@
 #include "nsIAnonymousContentCreator.h"
 #include "nsIStatefulFrame.h"
 
+class nsIPresState;
 class nsButtonControlFrame;
 class nsTextControlFrame;
 class nsFormFrame;
@@ -166,8 +167,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
 protected:
   nsIWidget* GetWindowTemp(nsIView *aView); // XXX temporary

layout/forms/nsListControlFrame.cpp

@@ -2832,10 +2832,10 @@ nsListControlFrame::GetStateType(nsIPresContext* aPresContext,
 
 NS_IMETHODIMP
 nsListControlFrame::SaveState(nsIPresContext* aPresContext,
-                              nsISupports** aState)
+                              nsIPresState** aState)
 {
-  nsISupportsArray* value = nsnull;
-  nsresult res = NS_NewISupportsArray(&value);
+  nsCOMPtr<nsISupportsArray> value;
+  nsresult res = NS_NewISupportsArray(getter_AddRefs(value));
   if (NS_SUCCEEDED(res) && value) {
     PRInt32 j=0;
     PRInt32 length = 0;
@@ -2845,55 +2845,61 @@ nsListControlFrame::SaveState(nsIPresContext* aPresContext,
       PRBool selected = PR_FALSE;
       res = GetOptionSelected(i, &selected);
       if (NS_SUCCEEDED(res) && selected) {
-        nsISupportsPRInt32* thisVal = nsnull;
+        nsCOMPtr<nsISupportsPRInt32> thisVal;
         res = nsComponentManager::CreateInstance(NS_SUPPORTS_PRINT32_PROGID,
-	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)&thisVal);
+	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)getter_AddRefs(thisVal));
         if (NS_SUCCEEDED(res) && thisVal) {
           res = thisVal->SetData(i);
-	  if (NS_SUCCEEDED(res)) {
+	        if (NS_SUCCEEDED(res)) {
             PRBool okay = value->InsertElementAt((nsISupports *)thisVal, j++);
-	    if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
-	  }
-	  if (!NS_SUCCEEDED(res)) NS_RELEASE(thisVal);
-	}
+	          if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
+          }
+	      }
       }
       if (!NS_SUCCEEDED(res)) break;
     }
-    if (i<length)
-      NS_RELEASE(value);
   }
-  *aState = (nsISupports*)value;  // Set to null if not successful
+  
+  NS_NewPresState(aState);
+  (*aState)->SetStatePropertyAsSupports("selecteditems", value);
   return res;
 }
 
 NS_IMETHODIMP
 nsListControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                 nsISupports* aState)
+                                 nsIPresState* aState)
 {
-  nsISupportsArray* value = (nsISupportsArray *)aState;
+  nsCOMPtr<nsISupports> supp;
+  aState->GetStatePropertyAsSupports("selecteditems", getter_AddRefs(supp));
+
   nsresult res = NS_ERROR_NULL_POINTER;
-  if (value) {
-    res = Deselect();
-    if (NS_SUCCEEDED(res)) {
-      PRUint32 count = 0;
-      res = value->Count(&count);
+  if (!supp)
+    return res;
+
+  nsCOMPtr<nsISupportsArray> value = do_QueryInterface(supp);
+  if (!value)
+    return res;
+
+  Deselect();
+  
+  PRUint32 count = 0;
+  value->Count(&count);
+  
+  nsCOMPtr<nsISupportsPRInt32> thisVal;
+  PRInt32 j=0;
+  for (PRUint32 i=0; i<count; i++) {
+    nsCOMPtr<nsISupports> suppval = getter_AddRefs(value->ElementAt(i));
+    thisVal = do_QueryInterface(suppval);
+    if (thisVal) {
+      res = thisVal->GetData(&j);
       if (NS_SUCCEEDED(res)) {
-        nsISupportsPRInt32* thisVal = nsnull;
-        PRInt32 j=0;
-        for (PRUint32 i=0; i<count; i++) {
-          thisVal = (nsISupportsPRInt32*) value->ElementAt(i);
-          if (thisVal) {
-            res = thisVal->GetData(&j);
-            if (NS_SUCCEEDED(res)) {
-              res = SetOptionSelected(j, PR_TRUE);
-            }
-          } else {
-            res = NS_ERROR_UNEXPECTED;
-          }
-          if (!NS_SUCCEEDED(res)) break;
-        }
+        res = SetOptionSelected(j, PR_TRUE);
       }
+    } else {
+      res = NS_ERROR_UNEXPECTED;
     }
+    if (!NS_SUCCEEDED(res)) break;
   }
+    
   return res;
 }

layout/forms/nsListControlFrame.h

@@ -30,6 +30,7 @@
 #include "nsIDOMMouseMotionListener.h"
 #include "nsIDOMKeyListener.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 
 class nsIDOMHTMLSelectElement;
 class nsIDOMHTMLCollection;
@@ -133,8 +134,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
   //nsIDOMEventListener
   virtual nsresult MouseDown(nsIDOMEvent* aMouseEvent);

layout/forms/nsTextControlFrame.cpp

@@ -362,9 +362,11 @@ nsTextControlFrame::GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame:
 }
 
 NS_IMETHODIMP
-nsTextControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsTextControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
-  nsISupportsString* theValue = nsnull;
+  // Construct a pres state.
+  NS_NewPresState(aState); // The addref happens here.
+  
   nsAutoString theString;
   nsresult res = GetProperty(nsHTMLAtoms::value, theString);
   if (NS_SUCCEEDED(res)) {
@@ -379,29 +381,24 @@ nsTextControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState
         nsCRT::free(chars);
         chars = newChars;
       }
-      res = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
-                                           NS_GET_IID(nsISupportsString), (void**)&theValue);
-      if (NS_SUCCEEDED(res) && theValue) {
-        theValue->SetData(chars);
-      }
+      
+      (*aState)->SetStateProperty("value", nsAutoString(chars));
+
       nsCRT::free(chars);
     } else {
       res = NS_ERROR_OUT_OF_MEMORY;
     }
   }
-  *aState = (nsISupports*)theValue;
+
+  (*aState)->SetStateProperty("value", theString);
   return res;
 }
 
 NS_IMETHODIMP
-nsTextControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsTextControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
-  char* chars = nsnull;
-  nsresult res = ((nsISupportsString*)aState)->GetData(&chars);
-  if (NS_SUCCEEDED(res) && chars) {
-    nsAutoString theString(chars);
-    res = SetProperty(aPresContext, nsHTMLAtoms::value, theString);
-    nsCRT::free(chars);
-  }
+  nsAutoString stateString;
+  aState->GetStateProperty("value", stateString);
+  nsresult res = SetProperty(aPresContext, nsHTMLAtoms::value, stateString);
   return res;
 }

layout/forms/nsTextControlFrame.h

@@ -25,6 +25,7 @@
 
 #include "nsNativeFormControlFrame.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 
 class nsIContent;
 class nsIFrame;
@@ -63,8 +64,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
 protected:
 

layout/generic/nsIStatefulFrame.h

@@ -4,6 +4,7 @@
 #include "nsISupports.h"
 
 class nsIPresContext;
+class nsIPresState;
 
 #define NS_ISTATEFULFRAME_IID_STR "306c8ca0-5f0c-11d3-a9fb-000064657374"
 
@@ -21,9 +22,8 @@ class nsIStatefulFrame : public nsISupports {
                 eTextType, eNumStateTypes};
 
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType) = 0;
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState) = 0;
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState) = 0;
-
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState) = 0;
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState) = 0;
 };
 
 #endif /* _nsIStatefulFrame_h */

layout/html/base/src/nsFrameManager.cpp

@@ -40,6 +40,7 @@
 #endif
 #include "nsILayoutHistoryState.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 #include "nsIContent.h"
 #include "nsINameSpaceManager.h"
 
@@ -1385,7 +1386,7 @@ CaptureFrameStateFor(nsIPresContext* aPresContext, nsIFrame* aFrame, nsILayoutHi
         nsIStatefulFrame::StateType type = nsIStatefulFrame::eNoType;
         rv = statefulFrame->GetStateType(aPresContext, &type);
         if (NS_SUCCEEDED(rv)) {
-          nsCOMPtr<nsISupports> frameState;
+          nsCOMPtr<nsIPresState> frameState;
           rv = statefulFrame->SaveState(aPresContext, getter_AddRefs(frameState));
           if (NS_SUCCEEDED(rv)) {
             rv = aState->AddState(ID, frameState, type);            
@@ -1446,10 +1447,14 @@ RestoreFrameStateFor(nsIPresContext* aPresContext, nsIFrame* aFrame, nsILayoutHi
         nsIStatefulFrame::StateType type = nsIStatefulFrame::eNoType;
         rv = statefulFrame->GetStateType(aPresContext, &type);
         if (NS_SUCCEEDED(rv)) {
-          nsISupports* frameState = nsnull;
-          rv = aState->GetState(ID, &frameState, type);          
-          if (NS_SUCCEEDED(rv) && nsnull != frameState) {
-            rv = statefulFrame->RestoreState(aPresContext, frameState);  
+          nsCOMPtr<nsIPresState> frameState;
+          rv = aState->GetState(ID, getter_AddRefs(frameState), type);          
+          if (NS_SUCCEEDED(rv) && frameState) {
+            // First restore the state.
+            rv = statefulFrame->RestoreState(aPresContext, frameState);
+            
+            // Now remove the state from the state table.
+            aState->RemoveState(ID, type);
           }
         }
       }

layout/html/base/src/nsPresShell.cpp

@@ -2299,21 +2299,29 @@ PresShell::GetHistoryState(nsILayoutHistoryState** aState)
 
   NS_PRECONDITION(nsnull != aState, "null state pointer");
 
-  // Create the document state object
-  rv = NS_NewLayoutHistoryState(aState);
+  if (!mHistoryState) {
+    // Create the document state object
+    rv = NS_NewLayoutHistoryState(aState); // This addrefs
   
-  if (NS_FAILED(rv)) { 
-    *aState = nsnull;
-    return rv;
+    if (NS_FAILED(rv)) { 
+      *aState = nsnull;
+      return rv;
+    }
+
+    // Capture frame state for the entire frame hierarchy
+    nsIFrame* rootFrame = nsnull;
+    rv = GetRootFrame(&rootFrame);
+    if (NS_FAILED(rv) || nsnull == rootFrame) return rv;
+
+    rv = mFrameManager->CaptureFrameState(mPresContext, rootFrame, *aState);
+
+    mHistoryState = *aState;
+    return NS_OK;
   }
-
-  // Capture frame state for the entire frame hierarchy
-  nsIFrame* rootFrame = nsnull;
-  rv = GetRootFrame(&rootFrame);
-  if (NS_FAILED(rv) || nsnull == rootFrame) return rv;
-
-  rv = mFrameManager->CaptureFrameState(mPresContext, rootFrame, *aState);
-
+  
+  *aState = mHistoryState;
+  NS_IF_ADDREF(mHistoryState);
+ 
   return rv;
 }
 

layout/html/content/src/nsGenericHTMLElement.cpp

@@ -57,6 +57,10 @@
 #include "nsINameSpaceManager.h"
 #include "nsDOMError.h"
 
+#include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
+#include "nsILayoutHistoryState.h"
+
 #include "nsIHTMLContentContainer.h"
 #include "nsHTMLParts.h"
 #include "nsString.h"
@@ -1605,6 +1609,31 @@ nsGenericHTMLElement::GetPrimaryFrame(nsIHTMLContent* aContent,
   return res;
 }         
 
+nsresult 
+nsGenericHTMLElement::GetPrimaryPresState(nsIHTMLContent* aContent,
+                                          nsIStatefulFrame::StateType aStateType,
+                                          nsIPresState** aPresState)
+{
+   // Get the document
+  nsCOMPtr<nsIDocument> doc;
+  aContent->GetDocument(*getter_AddRefs(doc));
+  if (doc) {
+     // Get presentation shell 0
+    nsCOMPtr<nsIPresShell> presShell = getter_AddRefs(doc->GetShellAt(0));
+    if (presShell) {
+      nsCOMPtr<nsILayoutHistoryState> history;
+      presShell->GetHistoryState(getter_AddRefs(history));
+      if (history) {
+        PRUint32 ID;
+        aContent->GetContentID(&ID);
+        history->GetState(ID, aPresState, aStateType);
+      }
+    }
+  }
+ 
+  return NS_OK;
+}         
+
 // XXX This creates a dependency between content and frames
 nsresult 
 nsGenericHTMLElement::GetPresContext(nsIHTMLContent* aContent,

layout/html/content/src/nsGenericHTMLElement.h

@@ -31,6 +31,8 @@
 #include "nsIJSScriptObject.h"
 #include "nsINameSpaceManager.h"  // for kNameSpaceID_HTML
 
+#include "nsIStatefulFrame.h"
+
 extern const nsIID kIDOMHTMLElementIID;
 extern const nsIID kIHTMLContentIID;
 
@@ -53,6 +55,7 @@ class nsIURI;
 class nsIFormControlFrame;
 class nsIFormControl;
 class nsIForm;
+class nsIPresState;
 
 class nsGenericHTMLElement : public nsGenericElement {
 public:
@@ -281,9 +284,12 @@ public:
   static PRBool GetBackgroundAttributesImpact(const nsIAtom* aAttribute,
                                               PRInt32& aHint);
 
-  //XXX These two creates a dependency between content and frames 
+  //XXX These three create a dependency between content and frames 
   static nsresult GetPrimaryFrame(nsIHTMLContent* aContent,
                                   nsIFormControlFrame *&aFormControlFrame);
+  static nsresult GetPrimaryPresState(nsIHTMLContent* aContent,
+                                          nsIStatefulFrame::StateType aStateType,
+                                          nsIPresState** aPresState);
   static nsresult GetPresContext(nsIHTMLContent* aContent, nsIPresContext** aPresContext);
 
   static nsresult GetBaseURL(const nsHTMLValue& aBaseHref,

layout/html/content/src/nsHTMLInputElement.cpp

@@ -49,6 +49,8 @@
 #include "nsIEventStateManager.h"
 #include "nsISizeOfHandler.h"
 
+#include "nsIPresState.h"
+
 // XXX align=left, hspace, vspace, border? other nav4 attrs
 
 static NS_DEFINE_IID(kIDOMHTMLInputElementIID, NS_IDOMHTMLINPUTELEMENT_IID);
@@ -400,8 +402,20 @@ nsHTMLInputElement::GetValue(nsString& aValue)
       if (nsnull != formControlFrame) {
         formControlFrame->GetProperty(nsHTMLAtoms::value, aValue);
       }
-      return NS_OK;
     }
+    else {
+      // Retrieve the presentation state instead.
+      nsCOMPtr<nsIPresState> presState;
+      nsGenericHTMLElement::GetPrimaryPresState(this, nsIStatefulFrame::eTextType, getter_AddRefs(presState));
+
+      // Obtain the value property from the presentation state.
+      if (presState) {
+        nsAutoString value;
+        presState->GetStateProperty("value", aValue);
+      }
+    }
+      
+    return NS_OK;
   }
   // Treat value == defaultValue for other input elements
   return mInner.GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::value, aValue); 
@@ -422,9 +436,20 @@ nsHTMLInputElement::SetValue(const nsString& aValue)
         formControlFrame->SetProperty(presContext, nsHTMLAtoms::value, aValue);
         NS_IF_RELEASE(presContext);
       }
-      return NS_OK;
     }
+    else {
+      // Retrieve the presentation state instead.
+      nsCOMPtr<nsIPresState> presState;
+      nsGenericHTMLElement::GetPrimaryPresState(this, nsIStatefulFrame::eTextType, getter_AddRefs(presState));
+
+      // Obtain the value property from the presentation state.
+      if (presState) {
+        presState->SetStateProperty("value", aValue);
+      }
+    }
+    return NS_OK;
   }
+
   // Treat value == defaultValue for other input elements.
   return mInner.SetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::value, aValue, PR_TRUE);
 }

layout/html/forms/src/nsCheckboxControlFrame.cpp

@@ -30,6 +30,7 @@
 #include "nsINameSpaceManager.h"
 #include "nsFormFrame.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIComponentManager.h"
 
@@ -421,36 +422,24 @@ NS_IMETHODIMP nsCheckboxControlFrame::GetStateType(nsIPresContext* aPresContext,
 }
 
 NS_IMETHODIMP nsCheckboxControlFrame::SaveState(nsIPresContext* aPresContext,
-                                                nsISupports** aState)
+                                                nsIPresState** aState)
 {
-  nsISupportsString* value = nsnull;
-  nsresult res = NS_OK;
-  nsAutoString string;
-  GetCheckboxControlFrameState(string);
-  char* chars = string.ToNewCString();
-  if (chars) {
-    res = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
-                                         NS_GET_IID(nsISupportsString), (void**)&value);
-    if (NS_SUCCEEDED(res) && value) {
-      value->SetData(chars);
-    }
-    nsCRT::free(chars);
-  } else {
-    res = NS_ERROR_OUT_OF_MEMORY;
-  }
-  *aState = (nsISupports*)value;
-  return res;
+  // Construct a pres state.
+  NS_NewPresState(aState); // The addref happens here.
+  
+  // This string will hold a single item, whether or not we're checked.
+  nsAutoString stateString;
+  GetCheckboxControlFrameState(stateString);
+  (*aState)->SetStateProperty("checked", stateString);
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP nsCheckboxControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                                   nsISupports* aState)
+                                                   nsIPresState* aState)
 {
-  char* chars = nsnull;
-  nsresult res = ((nsISupportsString*)aState)->GetData(&chars);
-  if (NS_SUCCEEDED(res) && chars) {
-    nsAutoString string(chars);
-    SetCheckboxControlFrameState(aPresContext, string);
-    nsCRT::free(chars);
-  }
-  return res;
+  nsAutoString string;
+  aState->GetStateProperty("checked", string);
+  SetCheckboxControlFrameState(aPresContext, string);
+  return NS_OK;
 }

layout/html/forms/src/nsCheckboxControlFrame.h

@@ -25,6 +25,8 @@
 #include "nsNativeFormControlFrame.h"
 #include "nsIStatefulFrame.h"
 
+class nsIPresState;
+
 //
 // nsCheckboxControlFrame
 //
@@ -96,8 +98,8 @@ public:
 
    // nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
 
 protected:

layout/html/forms/src/nsComboboxControlFrame.cpp

@@ -37,6 +37,7 @@
 #include "nsIDOMHTMLSelectElement.h" 
 #include "nsIDOMHTMLOptionElement.h" 
 #include "nsIPresShell.h"
+#include "nsIPresState.h"
 #include "nsISupportsArray.h"
 #include "nsIDeviceContext.h"
 #include "nsIView.h"
@@ -1485,7 +1486,7 @@ nsComboboxControlFrame::GetStateType(nsIPresContext* aPresContext,
 }
 
 NS_IMETHODIMP
-nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
   if (!mListControlFrame) return NS_ERROR_UNEXPECTED;
   nsIStatefulFrame* sFrame = nsnull;
@@ -1499,7 +1500,7 @@ nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aS
 }
 
 NS_IMETHODIMP
-nsComboboxControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsComboboxControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
   if (!mListControlFrame) return NS_ERROR_UNEXPECTED;
   nsIStatefulFrame* sFrame = nsnull;

layout/html/forms/src/nsComboboxControlFrame.h

@@ -41,6 +41,7 @@ class nsIView;
 class nsStyleContext;
 class nsIHTMLContent;
 class nsIListControlFrame;
+class nsIPresState;
 
 /**
  * Child list name indices
@@ -154,8 +155,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
   //nsIRollupListener
   NS_IMETHOD Rollup();

layout/html/forms/src/nsFileControlFrame.cpp

@@ -32,6 +32,7 @@
 #include "nsIHTMLContent.h"
 #include "nsHTMLIIDs.h"
 #include "nsHTMLAtoms.h"
+#include "nsIPresState.h"
 #include "nsIFileWidget.h"
 #include "nsWidgetsCID.h"
 #include "nsIComponentManager.h"
@@ -547,37 +548,25 @@ nsFileControlFrame::GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame:
 }
 
 NS_IMETHODIMP
-nsFileControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsFileControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
-  nsISupportsString* value = nsnull;
-  nsAutoString string;
-  nsresult res = GetProperty(nsHTMLAtoms::value, string);
-  if (NS_SUCCEEDED(res)) {
-    char* chars = string.ToNewCString();
-    if (chars) {
-      res = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
-                                           NS_GET_IID(nsISupportsString), (void**)&value);
-      if (NS_SUCCEEDED(res) && value) {
-        value->SetData(chars);
-      }
-      nsCRT::free(chars);
-    } else {
-      res = NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-  *aState = (nsISupports*)value;
-  return res;
+  // Construct a pres state.
+  NS_NewPresState(aState); // The addref happens here.
+  
+  // This string will hold a single item, whether or not we're checked.
+  nsAutoString stateString;
+  GetProperty(nsHTMLAtoms::value, stateString);
+  (*aState)->SetStateProperty("checked", stateString);
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
-nsFileControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsFileControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
-  char* chars = nsnull;
-  nsresult res = ((nsISupportsString*)aState)->GetData(&chars);
-  if (NS_SUCCEEDED(res) && chars) {
-    nsAutoString value(chars);
-    SetProperty(aPresContext, nsHTMLAtoms::value, value);
-    nsCRT::free(chars);
-  }
-  return res;
+  nsAutoString string;
+  aState->GetStateProperty("checked", string);
+  SetProperty(aPresContext, nsHTMLAtoms::value, string);
+  return NS_OK;
+
 }

layout/html/forms/src/nsFileControlFrame.h

@@ -29,6 +29,7 @@
 #include "nsIAnonymousContentCreator.h"
 #include "nsIStatefulFrame.h"
 
+class nsIPresState;
 class nsButtonControlFrame;
 class nsTextControlFrame;
 class nsFormFrame;
@@ -166,8 +167,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
 protected:
   nsIWidget* GetWindowTemp(nsIView *aView); // XXX temporary

layout/html/forms/src/nsGfxListControlFrame.cpp

@@ -55,6 +55,8 @@
 #include "nsIDocument.h"
 #include "nsIFontMetrics.h"
 
+#include "nsIPresState.h"
+
 #include "nsISelectElement.h"
 
 static NS_DEFINE_IID(kIDOMMouseListenerIID,       NS_IDOMMOUSELISTENER_IID);
@@ -2860,10 +2862,10 @@ nsGfxListControlFrame::GetStateType(nsIPresContext* aPresContext,
 
 NS_IMETHODIMP
 nsGfxListControlFrame::SaveState(nsIPresContext* aPresContext,
-                              nsISupports** aState)
+                              nsIPresState** aState)
 {
-  nsISupportsArray* value = nsnull;
-  nsresult res = NS_NewISupportsArray(&value);
+  nsCOMPtr<nsISupportsArray> value;
+  nsresult res = NS_NewISupportsArray(getter_AddRefs(value));
   if (NS_SUCCEEDED(res) && value) {
     PRInt32 j=0;
     PRInt32 length = 0;
@@ -2873,55 +2875,61 @@ nsGfxListControlFrame::SaveState(nsIPresContext* aPresContext,
       PRBool selected = PR_FALSE;
       res = GetOptionSelected(i, &selected);
       if (NS_SUCCEEDED(res) && selected) {
-        nsISupportsPRInt32* thisVal = nsnull;
+        nsCOMPtr<nsISupportsPRInt32> thisVal;
         res = nsComponentManager::CreateInstance(NS_SUPPORTS_PRINT32_PROGID,
-	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)&thisVal);
+	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)getter_AddRefs(thisVal));
         if (NS_SUCCEEDED(res) && thisVal) {
           res = thisVal->SetData(i);
-	  if (NS_SUCCEEDED(res)) {
+	        if (NS_SUCCEEDED(res)) {
             PRBool okay = value->InsertElementAt((nsISupports *)thisVal, j++);
-	    if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
-	  }
-	  if (!NS_SUCCEEDED(res)) NS_RELEASE(thisVal);
-	}
+	          if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
+          }
+	      }
       }
       if (!NS_SUCCEEDED(res)) break;
     }
-    if (i<length)
-      NS_RELEASE(value);
   }
-  *aState = (nsISupports*)value;  // Set to null if not successful
+  
+  NS_NewPresState(aState);
+  (*aState)->SetStatePropertyAsSupports("selecteditems", value);
   return res;
 }
 
 NS_IMETHODIMP
 nsGfxListControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                 nsISupports* aState)
+                                 nsIPresState* aState)
 {
-  nsISupportsArray* value = (nsISupportsArray *)aState;
+  nsCOMPtr<nsISupports> supp;
+  aState->GetStatePropertyAsSupports("selecteditems", getter_AddRefs(supp));
+
   nsresult res = NS_ERROR_NULL_POINTER;
-  if (value) {
-    res = Deselect();
-    if (NS_SUCCEEDED(res)) {
-      PRUint32 count = 0;
-      res = value->Count(&count);
+  if (!supp)
+    return res;
+
+  nsCOMPtr<nsISupportsArray> value = do_QueryInterface(supp);
+  if (!value)
+    return res;
+
+  Deselect();
+  
+  PRUint32 count = 0;
+  value->Count(&count);
+  
+  nsCOMPtr<nsISupportsPRInt32> thisVal;
+  PRInt32 j=0;
+  for (PRUint32 i=0; i<count; i++) {
+    nsCOMPtr<nsISupports> suppval = getter_AddRefs(value->ElementAt(i));
+    thisVal = do_QueryInterface(suppval);
+    if (thisVal) {
+      res = thisVal->GetData(&j);
       if (NS_SUCCEEDED(res)) {
-        nsISupportsPRInt32* thisVal = nsnull;
-        PRInt32 j=0;
-        for (PRUint32 i=0; i<count; i++) {
-          thisVal = (nsISupportsPRInt32*) value->ElementAt(i);
-          if (thisVal) {
-            res = thisVal->GetData(&j);
-            if (NS_SUCCEEDED(res)) {
-              res = SetOptionSelected(j, PR_TRUE);
-            }
-          } else {
-            res = NS_ERROR_UNEXPECTED;
-          }
-          if (!NS_SUCCEEDED(res)) break;
-        }
+        res = SetOptionSelected(j, PR_TRUE);
       }
+    } else {
+      res = NS_ERROR_UNEXPECTED;
     }
+    if (!NS_SUCCEEDED(res)) break;
   }
+    
   return res;
 }

layout/html/forms/src/nsGfxListControlFrame.h

@@ -38,6 +38,7 @@ class nsIDOMHTMLOptionElement;
 class nsIComboboxControlFrame;
 class nsIViewManager;
 class nsIPresContext;
+class nsIPresState;
 
 /**
  * Frame-based listbox.
@@ -134,8 +135,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
   //nsIDOMEventListener
   virtual nsresult MouseDown(nsIDOMEvent* aMouseEvent);

layout/html/forms/src/nsListControlFrame.cpp

@@ -2832,10 +2832,10 @@ nsListControlFrame::GetStateType(nsIPresContext* aPresContext,
 
 NS_IMETHODIMP
 nsListControlFrame::SaveState(nsIPresContext* aPresContext,
-                              nsISupports** aState)
+                              nsIPresState** aState)
 {
-  nsISupportsArray* value = nsnull;
-  nsresult res = NS_NewISupportsArray(&value);
+  nsCOMPtr<nsISupportsArray> value;
+  nsresult res = NS_NewISupportsArray(getter_AddRefs(value));
   if (NS_SUCCEEDED(res) && value) {
     PRInt32 j=0;
     PRInt32 length = 0;
@@ -2845,55 +2845,61 @@ nsListControlFrame::SaveState(nsIPresContext* aPresContext,
       PRBool selected = PR_FALSE;
       res = GetOptionSelected(i, &selected);
       if (NS_SUCCEEDED(res) && selected) {
-        nsISupportsPRInt32* thisVal = nsnull;
+        nsCOMPtr<nsISupportsPRInt32> thisVal;
         res = nsComponentManager::CreateInstance(NS_SUPPORTS_PRINT32_PROGID,
-	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)&thisVal);
+	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)getter_AddRefs(thisVal));
         if (NS_SUCCEEDED(res) && thisVal) {
           res = thisVal->SetData(i);
-	  if (NS_SUCCEEDED(res)) {
+	        if (NS_SUCCEEDED(res)) {
             PRBool okay = value->InsertElementAt((nsISupports *)thisVal, j++);
-	    if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
-	  }
-	  if (!NS_SUCCEEDED(res)) NS_RELEASE(thisVal);
-	}
+	          if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
+          }
+	      }
       }
       if (!NS_SUCCEEDED(res)) break;
     }
-    if (i<length)
-      NS_RELEASE(value);
   }
-  *aState = (nsISupports*)value;  // Set to null if not successful
+  
+  NS_NewPresState(aState);
+  (*aState)->SetStatePropertyAsSupports("selecteditems", value);
   return res;
 }
 
 NS_IMETHODIMP
 nsListControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                 nsISupports* aState)
+                                 nsIPresState* aState)
 {
-  nsISupportsArray* value = (nsISupportsArray *)aState;
+  nsCOMPtr<nsISupports> supp;
+  aState->GetStatePropertyAsSupports("selecteditems", getter_AddRefs(supp));
+
   nsresult res = NS_ERROR_NULL_POINTER;
-  if (value) {
-    res = Deselect();
-    if (NS_SUCCEEDED(res)) {
-      PRUint32 count = 0;
-      res = value->Count(&count);
+  if (!supp)
+    return res;
+
+  nsCOMPtr<nsISupportsArray> value = do_QueryInterface(supp);
+  if (!value)
+    return res;
+
+  Deselect();
+  
+  PRUint32 count = 0;
+  value->Count(&count);
+  
+  nsCOMPtr<nsISupportsPRInt32> thisVal;
+  PRInt32 j=0;
+  for (PRUint32 i=0; i<count; i++) {
+    nsCOMPtr<nsISupports> suppval = getter_AddRefs(value->ElementAt(i));
+    thisVal = do_QueryInterface(suppval);
+    if (thisVal) {
+      res = thisVal->GetData(&j);
       if (NS_SUCCEEDED(res)) {
-        nsISupportsPRInt32* thisVal = nsnull;
-        PRInt32 j=0;
-        for (PRUint32 i=0; i<count; i++) {
-          thisVal = (nsISupportsPRInt32*) value->ElementAt(i);
-          if (thisVal) {
-            res = thisVal->GetData(&j);
-            if (NS_SUCCEEDED(res)) {
-              res = SetOptionSelected(j, PR_TRUE);
-            }
-          } else {
-            res = NS_ERROR_UNEXPECTED;
-          }
-          if (!NS_SUCCEEDED(res)) break;
-        }
+        res = SetOptionSelected(j, PR_TRUE);
       }
+    } else {
+      res = NS_ERROR_UNEXPECTED;
     }
+    if (!NS_SUCCEEDED(res)) break;
   }
+    
   return res;
 }

layout/html/forms/src/nsListControlFrame.h

@@ -30,6 +30,7 @@
 #include "nsIDOMMouseMotionListener.h"
 #include "nsIDOMKeyListener.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 
 class nsIDOMHTMLSelectElement;
 class nsIDOMHTMLCollection;
@@ -133,8 +134,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
   //nsIDOMEventListener
   virtual nsresult MouseDown(nsIDOMEvent* aMouseEvent);

layout/html/forms/src/nsNativeSelectControlFrame.cpp

@@ -58,6 +58,7 @@
 #include "nsISupportsArray.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIComponentManager.h"
+#include "nsIPresState.h"
 
 static NS_DEFINE_IID(kIDOMHTMLSelectElementIID, NS_IDOMHTMLSELECTELEMENT_IID);
 static NS_DEFINE_IID(kIDOMHTMLOptionElementIID, NS_IDOMHTMLOPTIONELEMENT_IID);
@@ -161,8 +162,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
 protected:
   PRInt32 mNumRows;
@@ -1559,65 +1560,14 @@ nsNativeSelectControlFrame::GetStateType(nsIPresContext* aPresContext,
 }
 
 NS_IMETHODIMP
-nsNativeSelectControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsNativeSelectControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
-  nsISupportsArray* value = nsnull;
-  nsresult res = NS_NewISupportsArray(&value);
-  if (NS_SUCCEEDED(res) && value) {
-    PRInt32 j=0;
-    PRInt32 i;
-    for (i=0; i<mNumOptions; i++) {
-      PRBool selected = PR_FALSE;
-      res = GetOptionSelected(i, &selected);
-      if (NS_SUCCEEDED(res) && selected) {
-        nsISupportsPRInt32* thisVal = nsnull;
-        res = nsComponentManager::CreateInstance(NS_SUPPORTS_PRINT32_PROGID,
-	                       nsnull, NS_GET_IID(nsISupportsPRInt32), (void**)&thisVal);
-        if (NS_SUCCEEDED(res) && thisVal) {
-          res = thisVal->SetData(i);
-	  if (NS_SUCCEEDED(res)) {
-            PRBool okay = value->InsertElementAt((nsISupports *)thisVal, j++);
-	    if (!okay) res = NS_ERROR_OUT_OF_MEMORY; // Most likely cause;
-	  }
-          if (!NS_SUCCEEDED(res)) NS_RELEASE(thisVal);
-	}
-      }
-      if (!NS_SUCCEEDED(res)) break;
-    }
-    if (i<mNumOptions)
-      NS_RELEASE(value);
-  }
-  *aState = (nsISupports*)value;  // Set to null if not successful
-  return res;
+  return NS_OK;
 }
 
 NS_IMETHODIMP
-nsNativeSelectControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsNativeSelectControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
-  nsISupportsArray* value = (nsISupportsArray *)aState;
-  nsresult res = NS_ERROR_NULL_POINTER;
-  if (value) {
-    res = Deselect();
-    if (NS_SUCCEEDED(res)) {
-      PRUint32 count = 0;
-      res = value->Count(&count);
-      if (NS_SUCCEEDED(res)) {
-        nsISupportsPRInt32* thisVal = nsnull;
-        PRInt32 j=0;
-        for (PRUint32 k=0; k<count; k++) {
-          thisVal = (nsISupportsPRInt32*) value->ElementAt(k);
-          if (thisVal) {
-            res = thisVal->GetData(&j);
-	    if (NS_SUCCEEDED(res)) {
-              res = SetOptionSelected(j, PR_TRUE);
-	    }
-	  } else {
-	    res = NS_ERROR_UNEXPECTED;
-	  }
-	  if (!NS_SUCCEEDED(res)) break;
-	}
-      }
-    }
-  }
-  return res;
+  // Doesn't matter.
+  return NS_OK;
 }

layout/html/forms/src/nsRadioControlFrame.cpp

@@ -282,36 +282,24 @@ nsRadioControlFrame::GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame
 }
 
 NS_IMETHODIMP
-nsRadioControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsRadioControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
-  nsISupportsString* value = nsnull;
-  nsresult res = NS_OK;
-  nsAutoString string;
-  GetRadioControlFrameState(string);
-  char* chars = string.ToNewCString();
-  if (chars) {
-    res = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
-                                         NS_GET_IID(nsISupportsString), (void**)&value);
-    if (NS_SUCCEEDED(res) && value) {
-      value->SetData(chars);
-    }
-    nsCRT::free(chars);
-  } else {
-    res = NS_ERROR_OUT_OF_MEMORY;
-  }
-  *aState = (nsISupports*)value;
+  // Construct a pres state.
+  NS_NewPresState(aState); // The addref happens here.
+  
+  // This string will hold a single item, whether or not we're checked.
+  nsAutoString stateString;
+  GetRadioControlFrameState(stateString);
+  (*aState)->SetStateProperty("checked", stateString);
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsRadioControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsRadioControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
-  char* chars = nsnull;
-  nsresult res = ((nsISupportsString*)aState)->GetData(&chars);
-  if (NS_SUCCEEDED(res) && chars) {
-    nsAutoString string(chars);
-    SetRadioControlFrameState(aPresContext, string);
-    nsCRT::free(chars);
-  }
-  return res;
+  nsAutoString string;
+  aState->GetStateProperty("checked", string);
+  SetRadioControlFrameState(aPresContext, string);
+  return NS_OK;
 }

layout/html/forms/src/nsRadioControlFrame.h

@@ -28,6 +28,7 @@
 #include "nsVoidArray.h"
 #include "nsString.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 class nsIAtom;
 
 // nsRadioControlFrame
@@ -85,8 +86,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
 protected:
 

layout/html/forms/src/nsTextControlFrame.cpp

@@ -362,9 +362,11 @@ nsTextControlFrame::GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame:
 }
 
 NS_IMETHODIMP
-nsTextControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState)
+nsTextControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
 {
-  nsISupportsString* theValue = nsnull;
+  // Construct a pres state.
+  NS_NewPresState(aState); // The addref happens here.
+  
   nsAutoString theString;
   nsresult res = GetProperty(nsHTMLAtoms::value, theString);
   if (NS_SUCCEEDED(res)) {
@@ -379,29 +381,24 @@ nsTextControlFrame::SaveState(nsIPresContext* aPresContext, nsISupports** aState
         nsCRT::free(chars);
         chars = newChars;
       }
-      res = nsComponentManager::CreateInstance(NS_SUPPORTS_STRING_PROGID, nsnull, 
-                                           NS_GET_IID(nsISupportsString), (void**)&theValue);
-      if (NS_SUCCEEDED(res) && theValue) {
-        theValue->SetData(chars);
-      }
+      
+      (*aState)->SetStateProperty("value", nsAutoString(chars));
+
       nsCRT::free(chars);
     } else {
       res = NS_ERROR_OUT_OF_MEMORY;
     }
   }
-  *aState = (nsISupports*)theValue;
+
+  (*aState)->SetStateProperty("value", theString);
   return res;
 }
 
 NS_IMETHODIMP
-nsTextControlFrame::RestoreState(nsIPresContext* aPresContext, nsISupports* aState)
+nsTextControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
 {
-  char* chars = nsnull;
-  nsresult res = ((nsISupportsString*)aState)->GetData(&chars);
-  if (NS_SUCCEEDED(res) && chars) {
-    nsAutoString theString(chars);
-    res = SetProperty(aPresContext, nsHTMLAtoms::value, theString);
-    nsCRT::free(chars);
-  }
+  nsAutoString stateString;
+  aState->GetStateProperty("value", stateString);
+  nsresult res = SetProperty(aPresContext, nsHTMLAtoms::value, stateString);
   return res;
 }

layout/html/forms/src/nsTextControlFrame.h

@@ -25,6 +25,7 @@
 
 #include "nsNativeFormControlFrame.h"
 #include "nsIStatefulFrame.h"
+#include "nsIPresState.h"
 
 class nsIContent;
 class nsIFrame;
@@ -63,8 +64,8 @@ public:
 
   //nsIStatefulFrame
   NS_IMETHOD GetStateType(nsIPresContext* aPresContext, nsIStatefulFrame::StateType* aStateType);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsISupports** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsISupports* aState);
+  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
+  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
 
 protected:
 

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -527,7 +527,6 @@ nsCSSFrameConstructor::nsCSSFrameConstructor(void)
     mGfxScrollFrame(nsnull)
 {
   NS_INIT_REFCNT();
-  NS_NewLayoutHistoryState(getter_AddRefs(mTempFrameTreeState));
 }
 
 nsCSSFrameConstructor::~nsCSSFrameConstructor(void)
@@ -2199,6 +2198,9 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
           
 */    
 
+  if (!mTempFrameTreeState)
+    aPresShell->GetHistoryState(getter_AddRefs(mTempFrameTreeState));
+
   // ----- reattach gfx scrollbars ------
   // Gfx scrollframes were created in the root frame but the primary frame map may have been destroyed if a 
   // new style sheet was loaded so lets reattach the frames to their content.
@@ -6745,7 +6747,7 @@ nsCSSFrameConstructor::RemoveMappingsForFrameSubtree(nsIPresContext* aPresContex
   presShell->GetFrameManager(getter_AddRefs(frameManager));
   
   // Save the frame tree's state before deleting it
-  CaptureStateFor(aPresContext, aRemovedFrame, aFrameState);
+  CaptureStateFor(aPresContext, aRemovedFrame, mTempFrameTreeState);
 
   return DeletingFrameSubtree(aPresContext, presShell, frameManager, aRemovedFrame);
 }
@@ -9649,7 +9651,7 @@ nsCSSFrameConstructor::CreateTreeWidgetContent(nsIPresContext* aPresContext,
     nsFrameConstructorState state(aPresContext, mFixedContainingBlock,
                                   GetAbsoluteContainingBlock(aPresContext, aParentFrame),
                                   GetFloaterContainingBlock(aPresContext, aParentFrame), 
-                                  aFrameState);
+                                  mTempFrameTreeState);
 
     // Get the element's tag
     nsCOMPtr<nsIAtom>  tag;

layout/html/style/src/nsCSSFrameConstructor.h

@@ -901,13 +901,7 @@ protected:
   nsIFrame*           mDocElementContainingBlock;
   nsIFrame*           mGfxScrollFrame;
 
-  // XXX This is an interface into a hashtable that holds frame state objects
-  // for saving/restoring state as frame trees are deleted and created in 
-  // RecreateFramesForContent() and ReconstructDocElementHierarchy().  
-  // These state objects should be stored in the hashtable maintained by the 
-  // session history, but since the session history API is undergoing a re-write, 
-  // we'll start using session history once that re-write is done.
-  nsCOMPtr<nsILayoutHistoryState>  mTempFrameTreeState;
+  nsCOMPtr<nsILayoutHistoryState> mTempFrameTreeState;
 };
 
 #endif /* nsCSSFrameConstructor_h___ */

layout/xul/base/src/nsTreeFrame.cpp

@@ -550,8 +550,6 @@ nsTreeFrame::Init(nsIPresContext*  aPresContext,
   nsCOMPtr<nsIDOMEventReceiver> target = do_QueryInterface(mContent);
   
   target->AddEventListener("mousedown", mTwistyListener, PR_TRUE); 
-	
-  NS_NewLayoutHistoryState(getter_AddRefs(mTempFrameTreeState));
 
   return rv;
 }
@@ -619,13 +617,6 @@ nsTreeFrame::ScrollByLines(nsIPresContext* aPresContext, PRInt32 lines)
   return NS_OK;
 }
 
-nsresult
-nsTreeFrame::GetFrameStateStorageObject(nsILayoutHistoryState** aState)
-{
-  *aState = mTempFrameTreeState;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsTreeFrame::EnsureRowIsVisible(PRInt32 aRowIndex)
 {

layout/xul/base/src/nsTreeFrame.h

@@ -98,9 +98,6 @@ public:
   // nsITreeFrame.h
   NS_IMETHOD EnsureRowIsVisible(PRInt32 aRowIndex);
 
-  // Getter for the frame state storage object
-  nsresult GetFrameStateStorageObject(nsILayoutHistoryState** aState);
-
 protected:
   nsTreeFrame();
   virtual ~nsTreeFrame();
@@ -111,7 +108,4 @@ protected: // Data Members
   PRInt32 mGeneration;
   PRBool mUseGeneration;
   PRBool mSuppressReflow;
-  // An interface into a hash table for storing frame state of child frame trees 
-  // that get deleted and re-created as users scroll the contents of the tree.
-  nsCOMPtr<nsILayoutHistoryState> mTempFrameTreeState;
 }; // class nsTreeFrame

layout/xul/base/src/nsTreeRowGroupFrame.cpp

@@ -69,11 +69,6 @@ void GetRowStartAndCount(nsIFrame* aFrame,
   NS_IF_RELEASE(fType);
 }
 
-static nsILayoutHistoryState*
-GetStateStorageObject(nsTreeRowGroupFrame* aTreeRowGroupFrame, 
-                      nsTableFrame* aTableFrame);
-
-
 // define this to get some help
 #undef DEBUG_tree
 
@@ -239,7 +234,7 @@ void nsTreeRowGroupFrame::DestroyRows(nsTableFrame* aTableFrame, nsIPresContext*
     
     nsIFrame* nextFrame;
     GetNextFrame(childFrame, &nextFrame);
-    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, childFrame, GetStateStorageObject(this, aTableFrame));
+    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, childFrame, nsnull);
     mFrames.DestroyFrame(aPresContext, childFrame);
     // remove the row from the table after it is removed from the sibling chain
     if (rowIndex >= 0) {
@@ -279,7 +274,7 @@ void nsTreeRowGroupFrame::ReverseDestroyRows(nsTableFrame* aTableFrame, nsIPresC
     
     nsIFrame* prevFrame;
     prevFrame = mFrames.GetPrevSiblingFor(childFrame);
-    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, childFrame, GetStateStorageObject(this, aTableFrame));
+    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, childFrame, nsnull);
     mFrames.DestroyFrame(aPresContext, childFrame);
     // remove the row from the table after it is removed from the sibling chain
     if (rowIndex >= 0) {
@@ -762,7 +757,7 @@ nsTreeRowGroupFrame::PositionChanged(nsIPresContext* aPresContext, PRInt32 aOldI
     PRInt32 startRowIndex, numRows;
     GetRowStartAndCount(this, startRowIndex, numRows);
 
-    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, this, GetStateStorageObject(this, tableFrame));
+    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, this, nsnull);
     mFrames.DestroyFrames(aPresContext);
 
     // remove the rows from the table after removing from the sibling chain
@@ -1266,7 +1261,7 @@ nsTreeRowGroupFrame::GetFirstFrameForReflow(nsIPresContext* aPresContext)
 
     mFrameConstructor->CreateTreeWidgetContent(aPresContext, this, nsnull, startContent,
                                                &mTopFrame, isAppend, PR_FALSE, 
-                                               GetStateStorageObject(this, tableFrame));
+                                               nsnull);
     
     // XXX Can be optimized if we detect that we're appending a row.
     // Also the act of appending or inserting a row group is harmless.
@@ -1352,7 +1347,7 @@ nsTreeRowGroupFrame::GetNextFrameForReflow(nsIPresContext* aPresContext, nsIFram
       }
       mFrameConstructor->CreateTreeWidgetContent(aPresContext, this, prevFrame, nextContent,
                                                  aResult, isAppend, PR_FALSE,
-                                                 GetStateStorageObject(this, tableFrame));
+                                                 nsnull);
 
       // XXX Can be optimized if we detect that we're appending a row to the end of the tree.
       // Also the act of appending or inserting a row group is harmless.
@@ -1470,8 +1465,7 @@ void nsTreeRowGroupFrame::OnContentInserted(nsIPresContext* aPresContext, nsIFra
   while (currFrame) {
     nsIFrame* nextFrame;
     currFrame->GetNextSibling(&nextFrame);
-    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, currFrame, 
-      GetStateStorageObject(this, NULL));
+    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, currFrame, nsnull);
     // get the starting row index and row count
     PRInt32 startRowIndex, numRows;
     GetRowStartAndCount(currFrame, startRowIndex, numRows);
@@ -2089,21 +2083,3 @@ nsTreeRowGroupFrame :: Paint ( nsIPresContext* aPresContext, nsIRenderingContext
   return res;
   
 } // Paint
-
-static nsILayoutHistoryState*
-GetStateStorageObject(nsTreeRowGroupFrame* aTreeRowGroupFrame, nsTableFrame* aTableFrame)
-{
-  nsILayoutHistoryState* object = nsnull;
-  nsTableFrame* tableFrame = nsnull;
-
-  if (aTableFrame)
-    tableFrame = aTableFrame;
-  else
-    nsTableFrame::GetTableFrame(aTreeRowGroupFrame, tableFrame);
-
-  if (tableFrame) {
-    nsTreeFrame* treeFrame = (nsTreeFrame*) tableFrame;
-    treeFrame->GetFrameStateStorageObject(&object);
-  }
-  return object;
-}