Fix for 34400 and 49406. 34400 is r=waterson, a=brendan. 49406 is r=danm, a=brendan

layout/base/nsCSSFrameConstructor.cpp

@@ -3302,6 +3302,32 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
                                        PR_FALSE,
                                        getter_AddRefs(styleContext));
 
+  const nsStyleUserInterface* ui= (const nsStyleUserInterface*)
+        styleContext->GetStyleData(eStyleStruct_UserInterface);
+
+  // Ensure that our XBL bindings are installed.
+  if (!ui->mBehavior.IsEmpty()) {
+    // Get the XBL loader.
+    nsresult rv;
+    NS_WITH_SERVICE(nsIXBLService, xblService, "@mozilla.org/xbl;1", &rv);
+    if (!xblService)
+      return rv;
+
+    PRBool resolveStyle;
+    nsCOMPtr<nsIXBLBinding> binding;
+    rv = xblService->LoadBindings(aDocElement, ui->mBehavior, PR_FALSE, getter_AddRefs(binding), &resolveStyle);
+    if (NS_FAILED(rv))
+      return NS_OK; // Binding will load asynchronously.
+
+    if (resolveStyle) {
+      nsCOMPtr<nsIAtom> tag;
+      aDocElement->GetTag(*getter_AddRefs(tag));
+      rv = ResolveStyleContext(aPresContext, aParentFrame, aDocElement, tag, getter_AddRefs(styleContext));
+      if (NS_FAILED(rv))
+        return rv;
+    }
+  }
+
   const nsStyleDisplay* display = 
     (const nsStyleDisplay*)styleContext->GetStyleData(eStyleStruct_Display);
   const nsStyleColor* color = 
@@ -3453,13 +3479,14 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
       }
     }
 
+     // Create any anonymous frames the doc element frame requires
+    CreateAnonymousFrames(aPresShell, aPresContext, nsnull, aState, aDocElement, contentFrame,
+                          childItems);
+
     // Set the initial child lists
     contentFrame->SetInitialChildList(aPresContext, nsnull,
                                       childItems.childList);
  
-    // Create any anonymous frames the doc element frame requires
-    CreateAnonymousFrames(aPresShell, aPresContext, nsnull, aState, aDocElement, contentFrame,
-                          childItems);
 
     // only support absolute positioning if we are a block.
     // if we are a box don't do it.
@@ -8688,6 +8715,12 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext* aPresContext,
 
     if (aChild == docElement.get()) {
       NS_PRECONDITION(nsnull == mInitialContainingBlock, "initial containing block already created");
+      
+      if (!mDocElementContainingBlock)
+        return NS_OK; // We get into this situation when an XBL binding is asynchronously
+                      // applied to the root tag (e.g., <window> in XUL).  It's ok.  We can
+                      // just bail here because the root will really be built later during
+                      // InitialReflow.
 
       // Get the style context of the containing block frame
       nsCOMPtr<nsIStyleContext> containerStyle;
@@ -10066,8 +10099,8 @@ nsCSSFrameConstructor::AttributeChanged(nsIPresContext* aPresContext,
     nsCOMPtr<nsIAtom> tag;
     aContent->GetTag(*getter_AddRefs(tag));
     if (reframe == PR_FALSE && tag && (tag.get() == nsXULAtoms::treechildren ||
-      tag.get() == nsXULAtoms::treeitem || tag.get() == nsXULAtoms::treerow ||
-      tag.get() == nsXULAtoms::treecell))
+      (tag.get() == nsXULAtoms::treeitem && aAttribute != nsXULAtoms::open) ||
+      tag.get() == nsXULAtoms::treerow || tag.get() == nsXULAtoms::treecell))
       return NS_OK;
   }
 #endif // INCLUDE_XUL

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -3302,6 +3302,32 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
                                        PR_FALSE,
                                        getter_AddRefs(styleContext));
 
+  const nsStyleUserInterface* ui= (const nsStyleUserInterface*)
+        styleContext->GetStyleData(eStyleStruct_UserInterface);
+
+  // Ensure that our XBL bindings are installed.
+  if (!ui->mBehavior.IsEmpty()) {
+    // Get the XBL loader.
+    nsresult rv;
+    NS_WITH_SERVICE(nsIXBLService, xblService, "@mozilla.org/xbl;1", &rv);
+    if (!xblService)
+      return rv;
+
+    PRBool resolveStyle;
+    nsCOMPtr<nsIXBLBinding> binding;
+    rv = xblService->LoadBindings(aDocElement, ui->mBehavior, PR_FALSE, getter_AddRefs(binding), &resolveStyle);
+    if (NS_FAILED(rv))
+      return NS_OK; // Binding will load asynchronously.
+
+    if (resolveStyle) {
+      nsCOMPtr<nsIAtom> tag;
+      aDocElement->GetTag(*getter_AddRefs(tag));
+      rv = ResolveStyleContext(aPresContext, aParentFrame, aDocElement, tag, getter_AddRefs(styleContext));
+      if (NS_FAILED(rv))
+        return rv;
+    }
+  }
+
   const nsStyleDisplay* display = 
     (const nsStyleDisplay*)styleContext->GetStyleData(eStyleStruct_Display);
   const nsStyleColor* color = 
@@ -3453,13 +3479,14 @@ nsCSSFrameConstructor::ConstructDocElementFrame(nsIPresShell*        aPresShell,
       }
     }
 
+     // Create any anonymous frames the doc element frame requires
+    CreateAnonymousFrames(aPresShell, aPresContext, nsnull, aState, aDocElement, contentFrame,
+                          childItems);
+
     // Set the initial child lists
     contentFrame->SetInitialChildList(aPresContext, nsnull,
                                       childItems.childList);
  
-    // Create any anonymous frames the doc element frame requires
-    CreateAnonymousFrames(aPresShell, aPresContext, nsnull, aState, aDocElement, contentFrame,
-                          childItems);
 
     // only support absolute positioning if we are a block.
     // if we are a box don't do it.
@@ -8688,6 +8715,12 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext* aPresContext,
 
     if (aChild == docElement.get()) {
       NS_PRECONDITION(nsnull == mInitialContainingBlock, "initial containing block already created");
+      
+      if (!mDocElementContainingBlock)
+        return NS_OK; // We get into this situation when an XBL binding is asynchronously
+                      // applied to the root tag (e.g., <window> in XUL).  It's ok.  We can
+                      // just bail here because the root will really be built later during
+                      // InitialReflow.
 
       // Get the style context of the containing block frame
       nsCOMPtr<nsIStyleContext> containerStyle;
@@ -10066,8 +10099,8 @@ nsCSSFrameConstructor::AttributeChanged(nsIPresContext* aPresContext,
     nsCOMPtr<nsIAtom> tag;
     aContent->GetTag(*getter_AddRefs(tag));
     if (reframe == PR_FALSE && tag && (tag.get() == nsXULAtoms::treechildren ||
-      tag.get() == nsXULAtoms::treeitem || tag.get() == nsXULAtoms::treerow ||
-      tag.get() == nsXULAtoms::treecell))
+      (tag.get() == nsXULAtoms::treeitem && aAttribute != nsXULAtoms::open) ||
+      tag.get() == nsXULAtoms::treerow || tag.get() == nsXULAtoms::treecell))
       return NS_OK;
   }
 #endif // INCLUDE_XUL

xpfe/appshell/src/nsWebShellWindow.cpp

@@ -1235,14 +1235,24 @@ nsWebShellWindow::OnEndDocumentLoad(nsIDocumentLoader* loader,
   printf("OnEndDocumentLoad\n");
 #endif
 
-  /* We get notified every time a page/Frame is loaded. But we need to
-   * Load the menus, run the startup script etc.. only once. So, Use
-   * the mChrome Initialized  member to check whether chrome should be 
-   * initialized or not - Radha
-   */
   if (mChromeLoaded)
     return NS_OK;
 
+  // We get notified every time a subframe is loaded. We
+  // need to properly ignore the load of subframes and only really
+  // execute our onload handler when we get a notification for ourselves
+  nsCOMPtr<nsISupports> container;
+  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem, parent;
+
+  loader->GetContainer(getter_AddRefs(container));
+  // Is this a frame ?
+  docShellAsItem = do_QueryInterface(container);
+  if (docShellAsItem) {
+    docShellAsItem->GetSameTypeParent(getter_AddRefs(parent));
+  }
+  if (parent)
+    return NS_OK; // We're a subframe. Get out of dodge.
+
   mChromeLoaded = PR_TRUE;
 
   mLockedUntilChromeLoad = PR_FALSE;