Fix for 33526

content/xbl/public/nsIXBLService.h

@@ -50,6 +50,9 @@ public:
   // onto the element.
   NS_IMETHOD LoadBindings(nsIContent* aContent, const nsString& aURL) = 0;
 
+  // This function clears out the bindings on a given content node.
+  NS_IMETHOD FlushBindings(nsIContent* aContent) = 0;
+
   // For a given element, returns a flat list of all the anonymous children that need
   // frames built.
   NS_IMETHOD GetContentList(nsIContent* aContent, nsISupportsArray** aResult, nsIContent** aChildElement) = 0;

content/xbl/src/nsXBLService.cpp

@@ -118,6 +118,9 @@ class nsXBLService: public nsIXBLService
   // onto the element.
   NS_IMETHOD LoadBindings(nsIContent* aContent, const nsString& aURL);
 
+  // This function clears out the bindings on a given content node.
+  NS_IMETHOD FlushBindings(nsIContent* aContent);
+
   // For a given element, returns a flat list of all the anonymous children that need
   // frames built.
   NS_IMETHOD GetContentList(nsIContent* aContent, nsISupportsArray** aResult, nsIContent** aChildElement);
@@ -259,7 +262,7 @@ nsXBLService::LoadBindings(nsIContent* aContent, const nsString& aURL)
   nsCOMPtr<nsIXBLBinding> binding;
   bindableContent->GetBinding(getter_AddRefs(binding));
   if (binding)
-    bindableContent->SetBinding(nsnull); // Flush old bindings
+    return NS_OK;
 
   nsCAutoString url = aURL;
   if (NS_FAILED(rv = GetBinding(url, getter_AddRefs(binding)))) {
@@ -322,11 +325,22 @@ nsXBLService::GetContentList(nsIContent* aContent, nsISupportsArray** aResult, n
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsXBLService::FlushBindings(nsIContent* aContent)
+{
+  nsCOMPtr<nsIBindableContent> bindable(do_QueryInterface(aContent));
+  if (!bindable)
+    return NS_ERROR_FAILURE;
+
+  bindable->SetBinding(nsnull); // Flush old bindings
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsXBLService::GetBaseTag(nsIContent* aContent, nsIAtom** aResult)
 {
   *aResult = nsnull;
-  nsCOMPtr<nsIBindableContent> bindable = do_QueryInterface(aContent);
+  nsCOMPtr<nsIBindableContent> bindable(do_QueryInterface(aContent));
   if (!bindable)
     return NS_ERROR_FAILURE;
 

layout/base/nsCSSFrameConstructor.cpp

@@ -9352,6 +9352,14 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
 {
   nsresult rv = NS_OK;
 
+  // Flush our anonymous content. When the frame gets recreated,
+  // it may have different anonymous content.
+  NS_WITH_SERVICE(nsIXBLService, xblService, "component://netscape/xbl", &rv);
+  if (!xblService)
+    return rv;
+  // Flush our old bindings.
+  xblService->FlushBindings(aContent);
+
   nsIContent* container;
   rv = aContent->GetParent(container);
   if (NS_SUCCEEDED(rv) && container) {

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -9352,6 +9352,14 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIPresContext* aPresContext,
 {
   nsresult rv = NS_OK;
 
+  // Flush our anonymous content. When the frame gets recreated,
+  // it may have different anonymous content.
+  NS_WITH_SERVICE(nsIXBLService, xblService, "component://netscape/xbl", &rv);
+  if (!xblService)
+    return rv;
+  // Flush our old bindings.
+  xblService->FlushBindings(aContent);
+
   nsIContent* container;
   rv = aContent->GetParent(container);
   if (NS_SUCCEEDED(rv) && container) {

layout/xbl/public/nsIXBLService.h

@@ -50,6 +50,9 @@ public:
   // onto the element.
   NS_IMETHOD LoadBindings(nsIContent* aContent, const nsString& aURL) = 0;
 
+  // This function clears out the bindings on a given content node.
+  NS_IMETHOD FlushBindings(nsIContent* aContent) = 0;
+
   // For a given element, returns a flat list of all the anonymous children that need
   // frames built.
   NS_IMETHOD GetContentList(nsIContent* aContent, nsISupportsArray** aResult, nsIContent** aChildElement) = 0;

layout/xbl/src/nsXBLService.cpp

@@ -118,6 +118,9 @@ class nsXBLService: public nsIXBLService
   // onto the element.
   NS_IMETHOD LoadBindings(nsIContent* aContent, const nsString& aURL);
 
+  // This function clears out the bindings on a given content node.
+  NS_IMETHOD FlushBindings(nsIContent* aContent);
+
   // For a given element, returns a flat list of all the anonymous children that need
   // frames built.
   NS_IMETHOD GetContentList(nsIContent* aContent, nsISupportsArray** aResult, nsIContent** aChildElement);
@@ -259,7 +262,7 @@ nsXBLService::LoadBindings(nsIContent* aContent, const nsString& aURL)
   nsCOMPtr<nsIXBLBinding> binding;
   bindableContent->GetBinding(getter_AddRefs(binding));
   if (binding)
-    bindableContent->SetBinding(nsnull); // Flush old bindings
+    return NS_OK;
 
   nsCAutoString url = aURL;
   if (NS_FAILED(rv = GetBinding(url, getter_AddRefs(binding)))) {
@@ -322,11 +325,22 @@ nsXBLService::GetContentList(nsIContent* aContent, nsISupportsArray** aResult, n
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsXBLService::FlushBindings(nsIContent* aContent)
+{
+  nsCOMPtr<nsIBindableContent> bindable(do_QueryInterface(aContent));
+  if (!bindable)
+    return NS_ERROR_FAILURE;
+
+  bindable->SetBinding(nsnull); // Flush old bindings
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsXBLService::GetBaseTag(nsIContent* aContent, nsIAtom** aResult)
 {
   *aResult = nsnull;
-  nsCOMPtr<nsIBindableContent> bindable = do_QueryInterface(aContent);
+  nsCOMPtr<nsIBindableContent> bindable(do_QueryInterface(aContent));
   if (!bindable)
     return NS_ERROR_FAILURE;
 

layout/xul/base/src/nsMenuFrame.cpp

@@ -1091,7 +1091,7 @@ nsMenuFrame::UpdateMenuSpecialState(nsIPresContext* aPresContext) {
 void 
 nsMenuFrame::BuildAcceleratorText(nsString& aAccelString)
 {
-  nsString accelText;
+  nsAutoString accelText;
   mContent->GetAttribute(kNameSpaceID_None, nsXULAtoms::acceltext, accelText);
   if (!accelText.IsEmpty()) {
     // Just use this.
@@ -1100,7 +1100,7 @@ nsMenuFrame::BuildAcceleratorText(nsString& aAccelString)
   }
 
   // See if we have a key node and use that instead.
-  nsString keyValue;
+  nsAutoString keyValue;
   mContent->GetAttribute(kNameSpaceID_None, nsXULAtoms::key, keyValue);
 
   nsCOMPtr<nsIDocument> document;
@@ -1123,11 +1123,11 @@ nsMenuFrame::BuildAcceleratorText(nsString& aAccelString)
 	nsAutoString commandAtom("command");
   nsAutoString controlAtom("control");
 
-	nsString shiftValue;
-	nsString altValue;
-	nsString commandValue;
-  nsString controlValue;
-	nsString keyChar = " ";
+	nsAutoString shiftValue;
+	nsAutoString altValue;
+	nsAutoString commandValue;
+  nsAutoString controlValue;
+	nsAutoString keyChar = " ";
 	
 	keyElement->GetAttribute(keyAtom, keyChar);
 	keyElement->GetAttribute(shiftAtom, shiftValue);
@@ -1138,13 +1138,13 @@ nsMenuFrame::BuildAcceleratorText(nsString& aAccelString)
   nsAutoString xulkey;
   keyElement->GetAttribute(nsAutoString("xulkey"), xulkey);
   if (xulkey.Equals("true")) {
-      // Set the default for the xul key modifier
+    // Set the default for the xul key modifier
 #ifdef XP_MAC
-      commandValue = "true";
+    commandValue = "true";
 #elif defined(XP_PC) || defined(NTO)
-      controlValue = "true";
+    controlValue = "true";
 #else 
-      altValue = "true";
+    altValue = "true";
 #endif
   }