From c8cd3be1ef052d085aadebb2e5b82153e0097831 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Sat, 31 Jan 2009 14:34:01 +0200
Subject: [PATCH]  Bug 476097, ASSERTION: killing mutation events with <input
 type=file>, r+sr=bz

---
 content/base/public/nsIContent.h    |  6 +++---
 content/base/src/nsContentUtils.cpp | 20 +++++++++++---------
 layout/forms/nsFileControlFrame.cpp |  6 ++++++
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index cfb38f76b5a5..873adcaffa44 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -65,8 +65,8 @@ class nsISMILAttr;
 
 // IID for the nsIContent interface
 #define NS_ICONTENT_IID       \
-{ 0x2813b1d9, 0x7fe1, 0x496f, \
- { 0x85, 0x52, 0xa2, 0xc1, 0xc5, 0x6b, 0x15, 0x40 } }
+{ 0x48cb2d6d, 0x9ccc, 0x4d0b, \
+  { 0x8c, 0x07, 0x29, 0x96, 0xb5, 0xf9, 0x68, 0x55 } }
 
 /**
  * A node of content in a document's content model. This interface
@@ -160,7 +160,7 @@ public:
    */
   void SetNativeAnonymous()
   {
-    SetFlags(NODE_IS_ANONYMOUS);
+    SetFlags(NODE_IS_ANONYMOUS | NODE_IS_IN_ANONYMOUS_SUBTREE);
   }
 
   /**
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index d32d3b850b67..c3e8e6a09573 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -3262,15 +3262,17 @@ nsContentUtils::HasMutationListeners(nsINode* aNode,
   doc->MayDispatchMutationEvent(aTargetForSubtreeModified);
 
   // If we have a window, we can check it for mutation listeners now.
-  nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(window));
-  if (piTarget) {
-    nsCOMPtr<nsIEventListenerManager> manager;
-    piTarget->GetListenerManager(PR_FALSE, getter_AddRefs(manager));
-    if (manager) {
-      PRBool hasListeners = PR_FALSE;
-      manager->HasMutationListeners(&hasListeners);
-      if (hasListeners) {
-        return PR_TRUE;
+  if (aNode->IsInDoc()) {
+    nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(window));
+    if (piTarget) {
+      nsCOMPtr<nsIEventListenerManager> manager;
+      piTarget->GetListenerManager(PR_FALSE, getter_AddRefs(manager));
+      if (manager) {
+        PRBool hasListeners = PR_FALSE;
+        manager->HasMutationListeners(&hasListeners);
+        if (hasListeners) {
+          return PR_TRUE;
+        }
       }
     }
   }
diff --git a/layout/forms/nsFileControlFrame.cpp b/layout/forms/nsFileControlFrame.cpp
index a7ad5ed60bcb..39e4c54737ab 100644
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -162,6 +162,9 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   if (!mTextContent)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Mark the element to be native anonymous before setting any attributes.
+  mTextContent->SetNativeAnonymous();
+
   mTextContent->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         NS_LITERAL_STRING("text"), PR_FALSE);
 
@@ -199,6 +202,9 @@ nsFileControlFrame::CreateAnonymousContent(nsTArray<nsIContent*>& aElements)
   if (!mBrowse)
     return NS_ERROR_OUT_OF_MEMORY;
 
+  // Mark the element to be native anonymous before setting any attributes.
+  mBrowse->SetNativeAnonymous();
+
   mBrowse->SetAttr(kNameSpaceID_None, nsGkAtoms::type,
                    NS_LITERAL_STRING("button"), PR_FALSE);
   nsCOMPtr<nsIDOMHTMLInputElement> fileContent = do_QueryInterface(mContent);