Bug 369077 - listbox/richlistbox is corrupted if @selected is inside item, r=neil, enn.deakin

toolkit/content/widgets/listbox.xml

@@ -537,14 +537,6 @@
         </body>
       </method>
 
-      <constructor>
-      <![CDATA[
-        var els = this.getElementsByAttribute("selected", "true");
-        for (var i = 0; i < els.length; ++i)
-          this.selectedItems.push(els[i]);
-      ]]>
-      </constructor>
-
       <field name="_suppressOnSelect">false</field>
       <field name="_selectTimeout">null</field>
       <field name="_currentItem">null</field>
@@ -675,6 +667,17 @@
         </body>
       </method>
 
+      <constructor>
+      <![CDATA[
+        var count = this.itemCount;
+        for (var index = 0; index < count; index++) {
+          var item = this.getItemAtIndex(index);
+          if (item.getAttribute("selected") == "true")
+            this.selectedItems.push(item);
+        }
+      ]]>
+      </constructor>
+
       <!-- ///////////////// nsIDOMXULSelectControlElement ///////////////// -->
 
       <method name="appendItem">

toolkit/content/widgets/richlistbox.xml

@@ -377,9 +377,11 @@
 
               // cf. listbox constructor:
               // select items according to their attributes
-              var els = this.getElementsByAttribute("selected", "true");
-              for (i = 0; i < els.length; i++)
-                this.selectedItems.push(els[i]);
+              var children = this.children;
+              for (var i = 0; i < children.length; ++i) {
+                if (children[i].getAttribute("selected") == "true")
+                  this.selectedItems.push(children[i]);
+              }
             }
 
             if (this.selType != "multiple" && this.selectedCount == 0)