Checking in the real fix for 34130.

content/xbl/src/nsXBLBinding.cpp

@@ -333,12 +333,11 @@ nsXBLBinding::nsXBLBinding(void)
   }
 }
 
-/**
- * Removes a root inadvertently left over.
- * This is really an error condition, but I've written
- * this to prevent the JS GC from asserting.
- */
-static nsresult removeRoot(void* aSlot)
+
+// Error code that ensures the binding clears
+// out its script object, even in cases where it should
+// have done so earlier.
+static nsresult RemoveRoot(void* aSlot)
 {
   const char kJSRuntimeServiceProgID[] = "nsJSRuntimeService";
   nsresult rv;
@@ -350,12 +349,11 @@ static nsresult removeRoot(void* aSlot)
   return (JS_RemoveRootRT(rt, aSlot) ? NS_OK : NS_ERROR_FAILURE);
 }
  
-
 nsXBLBinding::~nsXBLBinding(void)
 {
-
+  NS_ASSERTION(!mScriptObject, "XBL binding hasn't properly cleared its script object out.");
   if (mScriptObject) {
-        removeRoot(&mScriptObject);
+    RemoveRoot(&mScriptObject);
     mScriptObject = nsnull;
   }
  

content/xbl/src/nsXBLService.cpp

@@ -341,6 +341,20 @@ nsXBLService::FlushBindings(nsIContent* aContent)
   if (!bindable)
     return NS_ERROR_FAILURE;
 
+  // Get the original binding.
+  nsCOMPtr<nsIXBLBinding> binding;
+  bindable->GetBinding(getter_AddRefs(binding));
+  if (binding) {
+    // Clear out the script references.
+    nsCOMPtr<nsIDocument> document;
+    aContent->GetDocument(*getter_AddRefs(document));
+    nsCOMPtr<nsIScriptGlobalObject> global;
+    document->GetScriptGlobalObject(getter_AddRefs(global));
+    nsCOMPtr<nsIScriptContext> context;
+    global->GetContext(getter_AddRefs(context));
+    binding->RemoveScriptReferences(context);
+  }
+  
   bindable->SetBinding(nsnull); // Flush old bindings
   return NS_OK;
 }

layout/xbl/src/nsXBLBinding.cpp

@@ -333,12 +333,11 @@ nsXBLBinding::nsXBLBinding(void)
   }
 }
 
-/**
- * Removes a root inadvertently left over.
- * This is really an error condition, but I've written
- * this to prevent the JS GC from asserting.
- */
-static nsresult removeRoot(void* aSlot)
+
+// Error code that ensures the binding clears
+// out its script object, even in cases where it should
+// have done so earlier.
+static nsresult RemoveRoot(void* aSlot)
 {
   const char kJSRuntimeServiceProgID[] = "nsJSRuntimeService";
   nsresult rv;
@@ -350,12 +349,11 @@ static nsresult removeRoot(void* aSlot)
   return (JS_RemoveRootRT(rt, aSlot) ? NS_OK : NS_ERROR_FAILURE);
 }
  
-
 nsXBLBinding::~nsXBLBinding(void)
 {
-
+  NS_ASSERTION(!mScriptObject, "XBL binding hasn't properly cleared its script object out.");
   if (mScriptObject) {
-        removeRoot(&mScriptObject);
+    RemoveRoot(&mScriptObject);
     mScriptObject = nsnull;
   }
  

layout/xbl/src/nsXBLService.cpp

@@ -341,6 +341,20 @@ nsXBLService::FlushBindings(nsIContent* aContent)
   if (!bindable)
     return NS_ERROR_FAILURE;
 
+  // Get the original binding.
+  nsCOMPtr<nsIXBLBinding> binding;
+  bindable->GetBinding(getter_AddRefs(binding));
+  if (binding) {
+    // Clear out the script references.
+    nsCOMPtr<nsIDocument> document;
+    aContent->GetDocument(*getter_AddRefs(document));
+    nsCOMPtr<nsIScriptGlobalObject> global;
+    document->GetScriptGlobalObject(getter_AddRefs(global));
+    nsCOMPtr<nsIScriptContext> context;
+    global->GetContext(getter_AddRefs(context));
+    binding->RemoveScriptReferences(context);
+  }
+  
   bindable->SetBinding(nsnull); // Flush old bindings
   return NS_OK;
 }