rpms/seamonkey/FC-6 mozilla-267833.patch, NONE, 1.1 mozilla-309322_180_att283610.patch, NONE, 1.1 mozilla-325761.patch, NONE, 1.1 mozilla-345305_venkmanonly.patch, NONE, 1.1 mozilla-361745.patch, NONE, 1.1 mozilla-362901.patch, NONE, 1.1 mozilla-372309.patch, NONE, 1.1 mozilla-378787.patch, NONE, 1.1 mozilla-384105.patch, NONE, 1.1 mozilla-386914.patch, NONE, 1.1 mozilla-387033.patch, NONE, 1.1 mozilla-387881.patch, NONE, 1.1 mozilla-388121.patch, NONE, 1.1 mozilla-388784.patch, NONE, 1.1 mozilla-390078.patch, NONE, 1.1 mozilla-392149-180.patch, NONE, 1.1 mozilla-393537.patch, NONE, 1.1 mozilla-395942-180.patch, NONE, 1.1 firefox-1.5-nopangoxft.patch, 1.2, 1.3 firefox-1.5-pango-printing.patch, 1.1, 1.2 mozilla-358594.patch, 1.1, 1.2 mozilla-381300.patch, 1.1, 1.2 mozilla-version.patch, 1.1, 1.2 seamonkey.spec, 1.21, 1.22 sources, 1.11, 1.12

Martin Stransky (stransky) fedora-extras-commits at redhat.com
Fri Oct 19 12:46:34 UTC 2007


Author: stransky

Update of /cvs/pkgs/rpms/seamonkey/FC-6
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv25197

Modified Files:
	firefox-1.5-nopangoxft.patch firefox-1.5-pango-printing.patch 
	mozilla-358594.patch mozilla-381300.patch 
	mozilla-version.patch seamonkey.spec sources 
Added Files:
	mozilla-267833.patch mozilla-309322_180_att283610.patch 
	mozilla-325761.patch mozilla-345305_venkmanonly.patch 
	mozilla-361745.patch mozilla-362901.patch mozilla-372309.patch 
	mozilla-378787.patch mozilla-384105.patch mozilla-386914.patch 
	mozilla-387033.patch mozilla-387881.patch mozilla-388121.patch 
	mozilla-388784.patch mozilla-390078.patch 
	mozilla-392149-180.patch mozilla-393537.patch 
	mozilla-395942-180.patch 
Log Message:
* Thu Oct 18 2007 Martin Stransky <stransky at redhat.com> - 1.0.9-3
- Update to latest snapshot of Mozilla 1.8.0 branch
- added pathes for Mozilla bugs 267833,309322,345305,361745,
  362901,372309,378787,381300,384105,386914,387033,387881,388121,388784
  390078,393537,395942,325761,392149



mozilla-267833.patch:

--- NEW FILE mozilla-267833.patch ---
---
 content/base/src/nsDocument.cpp                   |   21 ++++
 content/base/src/nsDocument.h                     |    3 
 content/html/document/src/nsHTMLContentSink.cpp   |    3 
 content/xbl/src/nsBindingManager.cpp              |   98 +++++++++++++++++++++-
 content/xbl/src/nsBindingManager.h                |   36 +++++++-
 content/xbl/src/nsXBLResourceLoader.cpp           |    9 --
 content/xul/templates/src/nsXULContentBuilder.cpp |    4 
 layout/base/nsCSSFrameConstructor.cpp             |   18 ----
 layout/base/nsCSSFrameConstructor.h               |   13 ++
 layout/base/nsPresShell.cpp                       |   20 ++++
 10 files changed, 195 insertions(+), 30 deletions(-)

Index: mozilla/content/base/src/nsDocument.cpp
===================================================================
--- mozilla.orig/content/base/src/nsDocument.cpp	2007-10-09 15:26:43.000000000 +0200
+++ mozilla/content/base/src/nsDocument.cpp	2007-10-09 15:27:15.000000000 +0200
@@ -974,22 +974,24 @@
 {
   if (mBindingManager || mCSSLoader || mNodeInfoManager) {
     return NS_ERROR_ALREADY_INITIALIZED;
   }
 
   mLinkMap.Init();
 
   // Force initialization.
-  nsBindingManager *bindingManager = new nsBindingManager();
+  nsBindingManager *bindingManager = new nsBindingManager(this);
   NS_ENSURE_TRUE(bindingManager, NS_ERROR_OUT_OF_MEMORY);
   mBindingManager = bindingManager;
 
   // The binding manager must always be the first observer of the document.
-  mObservers.PrependElement(bindingManager);
+  if (!mObservers.PrependElement(bindingManager)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
 
   mOnloadBlocker = new nsOnloadBlocker();
   NS_ENSURE_TRUE(mOnloadBlocker, NS_ERROR_OUT_OF_MEMORY);
   
   NS_NewCSSLoader(this, &mCSSLoader);
   NS_ENSURE_TRUE(mCSSLoader, NS_ERROR_OUT_OF_MEMORY);
   // Assume we're not HTML and not quirky, until we know otherwise
   mCSSLoader->SetCaseSensitive(PR_TRUE);
@@ -2230,28 +2232,43 @@
   }
 
   return mObservers.Contains(aObserver);
 }
 
 void
 nsDocument::BeginUpdate(nsUpdateType aUpdateType)
 {
+  if (mUpdateNestLevel == 0) {
+    nsIBindingManager* bm = mBindingManager;
+    NS_STATIC_CAST(nsBindingManager*, bm)->BeginOutermostUpdate();
+  }
+  
+  ++mUpdateNestLevel;
   if (mScriptLoader) {
     NS_STATIC_CAST(nsScriptLoader*,
                    NS_STATIC_CAST(nsIScriptLoader*,
                                   mScriptLoader))->AddExecuteBlocker();
   }
   NS_DOCUMENT_NOTIFY_OBSERVERS(BeginUpdate, (this, aUpdateType));
 }
 
 void
 nsDocument::EndUpdate(nsUpdateType aUpdateType)
 {
   NS_DOCUMENT_NOTIFY_OBSERVERS(EndUpdate, (this, aUpdateType));
+
+  --mUpdateNestLevel;
+  if (mUpdateNestLevel == 0) {
+    // This set of updates may have created XBL bindings.  Let the
+    // binding manager know we're done.
+    nsIBindingManager* bm = mBindingManager;
+    NS_STATIC_CAST(nsBindingManager*, bm)->EndOutermostUpdate();
+  }
+
   if (mScriptLoader) {
     NS_STATIC_CAST(nsScriptLoader*,
                    NS_STATIC_CAST(nsIScriptLoader*,
                                   mScriptLoader))->RemoveExecuteBlocker();
   }
 }
 
 void
Index: mozilla/content/base/src/nsDocument.h
===================================================================
--- mozilla.orig/content/base/src/nsDocument.h	2007-10-09 15:26:43.000000000 +0200
+++ mozilla/content/base/src/nsDocument.h	2007-10-09 15:26:47.000000000 +0200
@@ -889,12 +889,15 @@
 
   PRUint32 mOnloadBlockCount;
   nsCOMPtr<nsIRequest> mOnloadBlocker;
   
   // A map from unvisited URI hashes to content elements
   nsTHashtable<nsUint32ToContentHashEntry> mLinkMap;
   // URIs whose visitedness has changed while we were hidden
   nsCOMArray<nsIURI> mVisitednessChangedURIs;
+
+  // Our update nesting level
+  PRUint32 mUpdateNestLevel;
 };
 
 
 #endif /* nsDocument_h___ */
Index: mozilla/content/html/document/src/nsHTMLContentSink.cpp
===================================================================
--- mozilla.orig/content/html/document/src/nsHTMLContentSink.cpp	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/content/html/document/src/nsHTMLContentSink.cpp	2007-10-09 15:28:09.000000000 +0200
@@ -1632,16 +1632,19 @@
  * they are visible in the tree. Specifically, make sure
  * that they are all added to their respective parents.
  * Also, do notification at the top for all content that
  * has been newly added so that the frame tree is complete.
  */
 nsresult
 SinkContext::FlushTags(PRBool aNotify)
 {
+  // Not starting an update here, unlike trunk.  We'll get XBL
+  // constructors firing async of the stuff we flush right now.
+   
   // Don't release last text node in case we need to add to it again
   FlushText();
 
   if (aNotify) {
     // Start from the base of the stack (growing upward) and do
     // a notification from the node that is closest to the root of
     // tree for any content that has been added.
     PRInt32 stackPos = 1;
Index: mozilla/content/xbl/src/nsBindingManager.cpp
===================================================================
--- mozilla.orig/content/xbl/src/nsBindingManager.cpp	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/content/xbl/src/nsBindingManager.cpp	2007-10-09 15:28:06.000000000 +0200
@@ -300,18 +300,21 @@
 // Implementation /////////////////////////////////////////////////////////////////
 
 // Static member variable initialization
 
 // Implement our nsISupports methods
 NS_IMPL_ISUPPORTS3(nsBindingManager, nsIBindingManager, nsIStyleRuleSupplier, nsIDocumentObserver)
 
 // Constructors/Destructors
-nsBindingManager::nsBindingManager(void)
-: mProcessingAttachedStack(PR_FALSE)
+nsBindingManager::nsBindingManager(nsIDocument* aDocument)
+  : mProcessingAttachedStack(PR_FALSE),
+    mProcessOnEndUpdate(PR_FALSE),
+    mProcessAttachedQueueEvent(nsnull),
+    mDocument(aDocument)
 {
   mContentListTable.ops = nsnull;
   mAnonymousNodesTable.ops = nsnull;
   mInsertionParentTable.ops = nsnull;
   mWrapperTable.ops = nsnull;
 }
 
 static PRBool PR_CALLBACK
@@ -781,48 +784,81 @@
 
 NS_IMETHODIMP
 nsBindingManager::AddToAttachedQueue(nsXBLBinding* aBinding)
 {
   if (!mAttachedStack.AppendElement(aBinding))
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(aBinding);
+
+  // If we're in the middle of processing our queue already, don't
+  // bother posting the event.
+  if (!mProcessingAttachedStack && !mProcessAttachedQueueEvent) {
+    nsCOMPtr<nsIEventQueueService> eventQueueService =
+      do_GetService(NS_EVENTQUEUESERVICE_CONTRACTID);
+    nsCOMPtr<nsIEventQueue> eventQueue;
+    if (eventQueueService) {
+      eventQueueService->
+        GetSpecialEventQueue(nsIEventQueueService::UI_THREAD_EVENT_QUEUE,
+                             getter_AddRefs(eventQueue));
+    }
+    if (eventQueue) {
+      ProcessAttachedQueueEvent* ev = new ProcessAttachedQueueEvent(this);
+      if (ev && NS_FAILED(eventQueue->PostEvent(ev))) {
+        PL_DestroyEvent(ev);
+      } else {
+        mProcessAttachedQueueEvent = ev;
+      }
+    }
+  }
+  
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsBindingManager::ClearAttachedQueue()
 {
   mAttachedStack.EnumerateForwards(ReleaseBindings, nsnull);
   mAttachedStack.Clear();
   return NS_OK;
 }
 
+void
+nsBindingManager::DoProcessAttachedQueue()
+{
+  ProcessAttachedQueue();
+
+  NS_ASSERTION(mAttachedStack.Count() == 0,
+               "Shouldn't have pending bindings!");
+  
+  mProcessAttachedQueueEvent = nsnull;
+}
+
 NS_IMETHODIMP
 nsBindingManager::ProcessAttachedQueue()
 {
-  if (mProcessingAttachedStack)
+  if (mProcessingAttachedStack || mAttachedStack.Count() == 0)
     return NS_OK;
 
   mProcessingAttachedStack = PR_TRUE;
 
   PRInt32 lastItem;
   while ((lastItem = mAttachedStack.Count() - 1) >= 0) {
     nsXBLBinding *binding = NS_STATIC_CAST(nsXBLBinding*,
                                            mAttachedStack.FastElementAt(lastItem));
     mAttachedStack.RemoveElementAt(lastItem);
 
     NS_ASSERTION(binding, "null item in attached stack?");
     binding->ExecuteAttachedHandler();
     NS_RELEASE(binding);
   }
 
   mProcessingAttachedStack = PR_FALSE;
-  ClearAttachedQueue();
+  NS_ASSERTION(mAttachedStack.Count() == 0, "How did we get here?");
   return NS_OK;
 }
 
 PR_STATIC_CALLBACK(PLDHashOperator)
 AccumulateBindingsToDetach(nsISupports *aKey, nsXBLBinding *aBinding,
                            void* aVoidArray)
 {
   nsVoidArray* arr = NS_STATIC_CAST(nsVoidArray*, aVoidArray);
@@ -1304,8 +1340,62 @@
         nsXBLInsertionPoint* point = contentList->GetInsertionPointAt(i);
         if (point->GetInsertionIndex() != -1) {
           point->RemoveChild(aChild);
         }
       }
     }
   }
 }
+
+void
+nsBindingManager::DocumentWillBeDestroyed(nsIDocument* aDocument)
+{
+  // Make sure to not run any more XBL constructors
+  mProcessingAttachedStack = PR_TRUE;
+
+  mDocument = nsnull;
+}
+
+void
+nsBindingManager::BeginOutermostUpdate()
+{
+  mProcessOnEndUpdate = (mAttachedStack.Count() == 0);
+}
+
+void
+nsBindingManager::EndOutermostUpdate()
+{
+  if (mProcessOnEndUpdate) {
+    mProcessOnEndUpdate = PR_FALSE;
+    ProcessAttachedQueue();
+  }
+}
+
+static void PR_CALLBACK
+HandlePLEvent(nsBindingManager::ProcessAttachedQueueEvent* aEvent)
+{
+  aEvent->HandleEvent();
+}
+
+static void PR_CALLBACK
+DestroyPLEvent(nsBindingManager::ProcessAttachedQueueEvent* aEvent)
+{
+  delete aEvent;
+}
+
+nsBindingManager::ProcessAttachedQueueEvent::ProcessAttachedQueueEvent(nsBindingManager* aBindingManager)
+  : mBindingManager(aBindingManager)
+{
+  PL_InitEvent(this, aBindingManager,
+               (PLHandleEventProc) ::HandlePLEvent,
+               (PLDestroyEventProc) ::DestroyPLEvent);
+  if (aBindingManager->mDocument) {
+    aBindingManager->mDocument->BlockOnload();
+  }
+}
+
+nsBindingManager::ProcessAttachedQueueEvent::~ProcessAttachedQueueEvent()
+{
+  if (mBindingManager->mDocument) {
+    mBindingManager->mDocument->UnblockOnload();
+  }
+}
Index: mozilla/content/xbl/src/nsBindingManager.h
===================================================================
--- mozilla.orig/content/xbl/src/nsBindingManager.h	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/content/xbl/src/nsBindingManager.h	2007-10-09 15:28:02.000000000 +0200
@@ -42,16 +42,17 @@
 
 #include "nsIBindingManager.h"
 #include "nsIStyleRuleSupplier.h"
 #include "nsStubDocumentObserver.h"
 #include "pldhash.h"
 #include "nsInterfaceHashtable.h"
 #include "nsRefPtrHashtable.h"
 #include "nsURIHashKey.h"
+#include "plevent.h"
 
 class nsIContent;
 class nsIXPConnectWrappedJS;
 class nsIAtom;
 class nsIDOMNodeList;
 class nsVoidArray;
 class nsIDocument;
 class nsIURI;
@@ -61,17 +62,17 @@
 
 class nsBindingManager : public nsIBindingManager,
                          public nsIStyleRuleSupplier,
                          public nsStubDocumentObserver
 {
   NS_DECL_ISUPPORTS
 
 public:
-  nsBindingManager();
+  nsBindingManager(nsIDocument* aDocument);
   ~nsBindingManager();
 
   virtual nsXBLBinding* GetBinding(nsIContent* aContent);
   NS_IMETHOD SetBinding(nsIContent* aContent, nsXBLBinding* aBinding);
 
   NS_IMETHOD GetInsertionParent(nsIContent* aContent, nsIContent** aResult);
   NS_IMETHOD SetInsertionParent(nsIContent* aContent, nsIContent* aResult);
 
@@ -136,31 +137,55 @@
   virtual void ContentInserted(nsIDocument* aDocument,
                                nsIContent* aContainer,
                                nsIContent* aChild,
                                PRInt32 aIndexInContainer);
   virtual void ContentRemoved(nsIDocument* aDocument,
                               nsIContent* aContainer,
                               nsIContent* aChild,
                               PRInt32 aIndexInContainer);
+  virtual void DocumentWillBeDestroyed(nsIDocument* aDocument);
+
+  struct ProcessAttachedQueueEvent;
+  friend struct ProcessAttachedQueueEvent;
+
+  struct ProcessAttachedQueueEvent : public PLEvent {
+    ProcessAttachedQueueEvent(nsBindingManager* aBindingManager);
+    ~ProcessAttachedQueueEvent();
+
+    void HandleEvent() {
+      mBindingManager->DoProcessAttachedQueue();
+    }
+
+    nsRefPtr<nsBindingManager> mBindingManager;
+  };
+
+  // Notify the binding manager when an outermost update begins and
+  // ends.  The end method can execute script.
+  void BeginOutermostUpdate();
+  void EndOutermostUpdate();
 
 protected:
   nsresult GetXBLChildNodesInternal(nsIContent* aContent,
                                     nsIDOMNodeList** aResult,
                                     PRBool* aIsAnonymousContentList);
   nsresult GetAnonymousNodesInternal(nsIContent* aContent,
                                      nsIDOMNodeList** aResult,
                                      PRBool* aIsAnonymousContentList);
 
   nsIContent* GetEnclosingScope(nsIContent* aContent) {
     return aContent->GetBindingParent();
   }
 
   nsresult GetNestedInsertionPoint(nsIContent* aParent, nsIContent* aChild, nsIContent** aResult);
 
+  // Same as ProcessAttachedQueue, but also nulls out
+  // mProcessAttachedQueueEvent
+  void DoProcessAttachedQueue();
+
 // MEMBER VARIABLES
 protected: 
   // A mapping from nsIContent* to the nsXBLBinding* that is
   // installed on that element.
   nsRefPtrHashtable<nsISupportsHashKey,nsXBLBinding> mBindingTable;
 
   // A mapping from nsIContent* to an nsIDOMNodeList*
   // (nsAnonymousContentList*).  This list contains an accurate
@@ -198,14 +223,21 @@
 
   // A mapping from a URL (a string) to a nsIStreamListener. This
   // table is the currently loading binding docs.  If they're in this
   // table, they have not yet finished loading.
   nsInterfaceHashtable<nsURIHashKey,nsIStreamListener> mLoadingDocTable;
 
   // A queue of binding attached event handlers that are awaiting execution.
   nsVoidArray mAttachedStack;
-  PRBool mProcessingAttachedStack;
+  PRPackedBool mProcessingAttachedStack;
+  PRPackedBool mProcessOnEndUpdate;  
+
+  // Our posted event to process the attached queue, if any
+  ProcessAttachedQueueEvent* mProcessAttachedQueueEvent;
+
+  // Our document.  This is a weak ref; the document owns us
+  nsIDocument* mDocument;
 };
 
 PRBool PR_CALLBACK ReleaseInsertionPoint(void* aElement, void* aData);
 
 #endif
Index: mozilla/content/xbl/src/nsXBLResourceLoader.cpp
===================================================================
--- mozilla.orig/content/xbl/src/nsXBLResourceLoader.cpp	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/content/xbl/src/nsXBLResourceLoader.cpp	2007-10-09 15:27:56.000000000 +0200
@@ -233,22 +233,16 @@
       // We need the document to flush out frame construction and
       // such, so we want to use the current document.
       nsIDocument* doc = content->GetCurrentDoc();
     
       if (doc) {
         // Flush first to make sure we can get the frame for content
         doc->FlushPendingNotifications(Flush_Frames);
 
-        // Notify
-        nsIContent* parent = content->GetParent();
-        PRInt32 index = 0;
-        if (parent)
-          index = parent->IndexOf(content);
-        
         // If |content| is (in addition to having binding |mBinding|)
         // also a descendant of another element with binding |mBinding|,
         // then we might have just constructed it due to the
         // notification of its parent.  (We can know about both if the
         // binding loads were triggered from the DOM rather than frame
         // construction.)  So we have to check both whether the element
         // has a primary frame and whether it's in the undisplayed map
         // before sending a ContentInserted notification, or bad things
@@ -258,18 +252,17 @@
           nsIFrame* childFrame;
           shell->GetPrimaryFrameFor(content, &childFrame);
           if (!childFrame) {
             // Check to see if it's in the undisplayed content map.
             nsStyleContext* sc =
               shell->FrameManager()->GetUndisplayedContent(content);
 
             if (!sc) {
-              nsCOMPtr<nsIDocumentObserver> obs(do_QueryInterface(shell));
-              obs->ContentInserted(doc, parent, content, index);
+              shell->RecreateFramesFor(content);
             }
           }
         }
 
         // Flush again
         // XXXbz why is this needed?
         doc->FlushPendingNotifications(Flush_ContentAndNotify);
       }
Index: mozilla/content/xul/templates/src/nsXULContentBuilder.cpp
===================================================================
--- mozilla.orig/content/xul/templates/src/nsXULContentBuilder.cpp	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/content/xul/templates/src/nsXULContentBuilder.cpp	2007-10-09 15:28:12.000000000 +0200
@@ -1768,16 +1768,18 @@
     if (container && IsLazyWidgetItem(aElement)) {
         // The tree widget is special, and has to be spanked every
         // time we add content to a container.
         nsCOMPtr<nsIDocument> doc = mRoot->GetDocument();
         NS_ASSERTION(doc, "root element has no document");
         if (! doc)
             return NS_ERROR_UNEXPECTED;
 
+        mozAutoDocUpdate upd(container->GetCurrentDoc(), UPDATE_CONTENT_MODEL,
+                             PR_TRUE);        
         doc->ContentAppended(container, newIndex);
     }
 
     return NS_OK;
 }
 
 nsresult
 nsXULContentBuilder::CloseContainer(nsIContent* aElement)
@@ -1902,16 +1904,18 @@
     CreateTemplateAndContainerContents(mRoot, getter_AddRefs(container), &newIndex);
 
     if (container) {
         nsCOMPtr<nsIDocument> doc = mRoot->GetDocument();
         NS_ASSERTION(doc, "root element has no document");
         if (! doc)
             return NS_ERROR_UNEXPECTED;
 
+        mozAutoDocUpdate upd(container->GetCurrentDoc(), UPDATE_CONTENT_MODEL,
+                             PR_TRUE);
         doc->ContentAppended(container, newIndex);
     }
 
     return NS_OK;
 }
 
 nsresult
 nsXULContentBuilder::CompileCondition(nsIAtom* aTag,
Index: mozilla/layout/base/nsCSSFrameConstructor.cpp
===================================================================
--- mozilla.orig/layout/base/nsCSSFrameConstructor.cpp	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/layout/base/nsCSSFrameConstructor.cpp	2007-10-09 15:27:43.000000000 +0200
@@ -8914,19 +8914,16 @@
     // Don't create child frames for iframes/frames, they should not
     // display any content that they contain.
     else if (nsLayoutAtoms::subDocumentFrame != frameType) {
       // Construct a child frame (that does not have a table as parent)
       ConstructFrame(state, childContent, parentFrame, frameItems);
     }
   }
 
-  // We built some new frames.  Initialize any newly-constructed bindings.
-  mDocument->BindingManager()->ProcessAttachedQueue();
-
   // process the current pseudo frame state
   if (!state.mPseudoFrames.IsEmpty()) {
     ProcessPseudoFrames(state, frameItems);
   }
 
   if (haveFirstLineStyle) {
     // It's possible that some of the new frames go into a
     // first-line frame. Look at them and see...
@@ -9348,18 +9345,16 @@
         if (fdbg) {
           printf("nsCSSFrameConstructor::ContentInserted: resulting frame model:\n");
           fdbg->List(state.mPresContext, stdout, 0);
         }
       }
 #endif
     }
 
-    mDocument->BindingManager()->ProcessAttachedQueue();
-
     // otherwise this is not a child of the root element, and we
     // won't let it have a frame.
     return NS_OK;
   }
 
   // Otherwise, we've got parent content. Find its frame.
   nsIFrame* parentFrame = aContainerFrame;
   if (!parentFrame) {
@@ -9574,20 +9569,16 @@
     if (nsLayoutAtoms::tableCaptionFrame == frameItems.childList->GetType()) {
       NS_ASSERTION(frameItems.childList == frameItems.lastChild ,
                    "adding a non caption frame to the caption childlist?");
       captionItems.AddChild(frameItems.childList);
       frameItems = nsFrameItems();
     }
   }
 
-  // Now that we've created frames, run the attach queue.
-  //XXXwaterson should we do this after we've processed pseudos, too?
-  mDocument->BindingManager()->ProcessAttachedQueue();
-
   // process the current pseudo frame state
   if (!state.mPseudoFrames.IsEmpty())
     ProcessPseudoFrames(state, frameItems);
 
   // If the final parent frame (decided by AdjustParentFrame()) is different
   // from the parent of the insertion point we calculated above then
   // parentFrame/prevSibling/appendAfterFrame are now invalid and  as it is
   // unknown where to insert correctly we append instead (bug 341858).
@@ -13209,18 +13200,16 @@
     if (!state.mPseudoFrames.IsEmpty()) {
       ProcessPseudoFrames(state, frameItems); 
     }
     
     nsIFrame* newFrame = frameItems.childList;
     *aNewFrame = newFrame;
 
     if (NS_SUCCEEDED(rv) && (nsnull != newFrame)) {
-      mDocument->BindingManager()->ProcessAttachedQueue();
-
       // Notify the parent frame
       if (aIsAppend)
         rv = ((nsListBoxBodyFrame*)aParentFrame)->ListBoxAppendFrames(newFrame);
       else
         rv = ((nsListBoxBodyFrame*)aParentFrame)->ListBoxInsertFrames(aPrevFrame, newFrame);
     }
   }
 
@@ -14227,21 +14216,21 @@
          restylesToProcess;
        currentRestyle != lastRestyle;
        ++currentRestyle) {
     ProcessOneRestyle(currentRestyle->mContent,
                       currentRestyle->mRestyleHint,
                       currentRestyle->mChangeHint);
   }
 
+  delete [] restylesToProcess;
+
   EndUpdate();
 
   viewManager->EndUpdateViewBatch(NS_VMREFRESH_NO_SYNC);
-
-  delete [] restylesToProcess;
 }
 
 void
 nsCSSFrameConstructor::PostRestyleEvent(nsIContent* aContent,
                                         nsReStyleHint aRestyleHint,
                                         nsChangeHint aMinChangeHint)
 {
   if (aRestyleHint == 0 && !aMinChangeHint) {
@@ -14276,32 +14265,33 @@
       mRestyleEventQueue = eventQueue;
     }
   }
 }
 
 void nsCSSFrameConstructor::RestyleEvent::HandleEvent() {
   nsCSSFrameConstructor* constructor =
     NS_STATIC_CAST(nsCSSFrameConstructor*, owner);
-  nsIViewManager* viewManager =
+  nsCOMPtr<nsIViewManager> viewManager =
     constructor->mDocument->GetShellAt(0)->GetPresContext()->GetViewManager();
   NS_ASSERTION(viewManager, "Must have view manager for update");
 
   viewManager->BeginUpdateViewBatch();
   // Force flushing of any pending content notifications that might have queued
   // up while our event was pending.  That will ensure that we don't construct
   // frames for content right now that's still waiting to be notified on,
   constructor->mPresShell->GetDocument()->
     FlushPendingNotifications(Flush_ContentAndNotify);
 
   // Make sure that any restyles that happen from now on will go into
   // a new event.
   constructor->mRestyleEventQueue = nsnull;
 
   constructor->ProcessPendingRestyles();
+  constructor->mDocument->BindingManager()->ProcessAttachedQueue();
   viewManager->EndUpdateViewBatch(NS_VMREFRESH_NO_SYNC);
 }
 
 PR_STATIC_CALLBACK(void*)
 HandleRestyleEvent(PLEvent* aEvent)
 {
   nsCSSFrameConstructor::RestyleEvent* evt =
     NS_STATIC_CAST(nsCSSFrameConstructor::RestyleEvent*, aEvent);
Index: mozilla/layout/base/nsCSSFrameConstructor.h
===================================================================
--- mozilla.orig/layout/base/nsCSSFrameConstructor.h	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/layout/base/nsCSSFrameConstructor.h	2007-10-09 15:27:18.000000000 +0200
@@ -133,21 +133,34 @@
   void BeginUpdate() { ++mUpdateCount; }
   void EndUpdate();
   void RecalcQuotesAndCounters();
 
   void WillDestroyFrameTree();
 
   // Note: It's the caller's responsibility to make sure to wrap a
   // ProcessRestyledFrames call in a view update batch.
+  // This function does not call ProcessAttachedQueue() on the binding manager.
+  // If the caller wants that to happen synchronously, it needs to handle that
+  // itself.
   nsresult ProcessRestyledFrames(nsStyleChangeList& aRestyleArray);
 
+private:
+  // This function does not call ProcessAttachedQueue() on the binding manager.
+  // If the caller wants that to happen synchronously, it needs to handle that
+  // itself.
   void ProcessOneRestyle(nsIContent* aContent, nsReStyleHint aRestyleHint,
                          nsChangeHint aChangeHint);
+
+public:
+  // This function does not call ProcessAttachedQueue() on the binding manager.
+  // If the caller wants that to happen synchronously, it needs to handle that
+  // itself.
   void ProcessPendingRestyles();
+
   void PostRestyleEvent(nsIContent* aContent, nsReStyleHint aRestyleHint,
                         nsChangeHint aMinChangeHint);
 
   // Notification that we were unable to render a replaced element.
   nsresult CantRenderReplacedElement(nsIFrame* aFrame);
 
   // Request to create a continuing frame
   nsresult CreateContinuingFrame(nsPresContext* aPresContext,
Index: mozilla/layout/base/nsPresShell.cpp
===================================================================
--- mozilla.orig/layout/base/nsPresShell.cpp	2007-10-09 15:26:44.000000000 +0200
+++ mozilla/layout/base/nsPresShell.cpp	2007-10-09 15:27:51.000000000 +0200
@@ -2980,16 +2980,19 @@
       ti->SetIdle(PR_FALSE);
 
       mPaintSuppressionTimer->InitWithFuncCallback(sPaintSuppressionCallback,
                                                    this, delay, 
                                                    nsITimer::TYPE_ONE_SHOT);
     }
   }
 
+  // Run the XBL binding constructors for any new frames we've constructed
+  mDocument->BindingManager()->ProcessAttachedQueue();
+
   return NS_OK; //XXX this needs to be real. MMP
 }
 
 void
 PresShell::sPaintSuppressionCallback(nsITimer *aTimer, void* aPresShell)
 {
   PresShell* self = NS_STATIC_CAST(PresShell*, aPresShell);
   if (self)
@@ -5382,17 +5385,34 @@
   NS_ASSERTION(!isSafeToFlush || mViewManager, "Must have view manager");
   if (isSafeToFlush && mViewManager) {
     // Style reresolves not in conjunction with reflows can't cause
     // painting or geometry changes, so don't bother with view update
     // batching if we only have style reresolve
     mViewManager->BeginUpdateViewBatch();
 
     if (aType & Flush_StyleReresolves) {
+      // Processing pending restyles can kill us, and some callers only
+      // hold weak refs when calling FlushPendingNotifications().  :(
+      nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
       mFrameConstructor->ProcessPendingRestyles();
+      if (mIsDestroying) {
+        // We no longer have a view manager and all that.
+        // XXX FIXME: Except we're in the middle of a view update batch...  We
+        // need to address that somehow.  See bug 369165.
+        return NS_OK;
+      }
+
+      mDocument->BindingManager()->ProcessAttachedQueue();
+      if (mIsDestroying) {
+        // We no longer have a view manager and all that.
+        // XXX FIXME: Except we're in the middle of a view update batch...  We
+        // need to address that somehow.  See bug 369165.
+        return NS_OK;
+      }
     }
 
     if (aType & Flush_OnlyReflow) {
       mFrameConstructor->RecalcQuotesAndCounters();
       ProcessReflowCommands(PR_FALSE);
     }
 
     PRUint32 updateFlags = NS_VMREFRESH_NO_SYNC;

mozilla-309322_180_att283610.patch:

--- NEW FILE mozilla-309322_180_att283610.patch ---
---
 layout/base/nsCSSFrameConstructor.cpp |  182 +++++++++++++---------------------
 layout/tables/nsTableOuterFrame.cpp   |   61 +++++------
 layout/tables/nsTableOuterFrame.h     |    1 
 3 files changed, 107 insertions(+), 137 deletions(-)

Index: mozilla/layout/base/nsCSSFrameConstructor.cpp
===================================================================
--- mozilla.orig/layout/base/nsCSSFrameConstructor.cpp	2007-10-09 15:03:00.000000000 +0200
+++ mozilla/layout/base/nsCSSFrameConstructor.cpp	2007-10-09 15:15:19.000000000 +0200
@@ -3468,23 +3468,38 @@
   NS_PRECONDITION(aFrameItems, "Must have frame items to work with");
 
   aCreatedPseudo = PR_FALSE;
   if (!aParentFrame) {
     // Nothing to do here
     return NS_OK;
   }
 
+  PRBool childIsSpecialContent = PR_FALSE; // lazy lookup
+  // Only use the outer table frame as parent if the child is going to use a
+  // tableCaptionFrame, otherwise the inner table frame is the parent
+  // (bug 341858).
+  if (aParentFrame->GetType() == nsLayoutAtoms::tableOuterFrame) {
+    childIsSpecialContent = IsSpecialContent(aChildContent, aTag, aNameSpaceID,
+                                             aChildStyle);
+    if (childIsSpecialContent ||
+       (aChildStyle->GetStyleDisplay()->mDisplay !=
+       NS_STYLE_DISPLAY_TABLE_CAPTION)) {
+      aParentFrame = aParentFrame->GetContentInsertionFrame();
+    }
+  }
+
   // If our parent is a table, table-row-group, or table-row, and
   // we're not table-related in any way, we have to create table
   // pseudo-frames so that we have a table cell to live in.
   if (IsTableRelated(aParentFrame->GetType(), PR_FALSE) &&
       (!IsTableRelated(aChildDisplay->mDisplay, PR_TRUE) ||
        // Also need to create a pseudo-parent if the child is going to end up
        // with a frame based on something other than display.
+       childIsSpecialContent || // looked it up before
        IsSpecialContent(aChildContent, aTag, aNameSpaceID, aChildStyle))) {
     nsTableCreator tableCreator(aState.mPresShell);
     nsresult rv = GetPseudoCellFrame(tableCreator, aState, *aParentFrame);
     if (NS_FAILED(rv)) {
       return rv;
     }
 
     NS_ASSERTION(aState.mPseudoFrames.mCellInner.mFrame,
@@ -8389,55 +8404,50 @@
 nsCSSFrameConstructor::IsValidSibling(nsIFrame*              aParentFrame,
                                       const nsIFrame&        aSibling,
                                       PRUint8                aSiblingDisplay,
                                       nsIContent&            aContent,
                                       PRUint8&               aDisplay)
 {
   if ((NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP == aSiblingDisplay) ||
       (NS_STYLE_DISPLAY_TABLE_COLUMN       == aSiblingDisplay) ||
+      (NS_STYLE_DISPLAY_TABLE_CAPTION      == aSiblingDisplay) ||
       (NS_STYLE_DISPLAY_TABLE_HEADER_GROUP == aSiblingDisplay) ||
       (NS_STYLE_DISPLAY_TABLE_ROW_GROUP    == aSiblingDisplay) ||
       (NS_STYLE_DISPLAY_TABLE_FOOTER_GROUP == aSiblingDisplay)) {
     // if we haven't already, construct a style context to find the display type of aContent
     if (UNSET_DISPLAY == aDisplay) {
       nsRefPtr<nsStyleContext> styleContext;
       styleContext = ResolveStyleContext(aSibling.GetParent(), &aContent);
       if (!styleContext) return PR_FALSE;
       const nsStyleDisplay* display = styleContext->GetStyleDisplay();
       aDisplay = display->mDisplay;
     }
     switch (aSiblingDisplay) {
     case NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP:
       return (NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP == aDisplay);
     case NS_STYLE_DISPLAY_TABLE_COLUMN:
       return (NS_STYLE_DISPLAY_TABLE_COLUMN == aDisplay);
+    case NS_STYLE_DISPLAY_TABLE_CAPTION:
+      return (NS_STYLE_DISPLAY_TABLE_CAPTION == aDisplay);
     default: // all of the row group types
       return (NS_STYLE_DISPLAY_TABLE_HEADER_GROUP == aDisplay) ||
              (NS_STYLE_DISPLAY_TABLE_ROW_GROUP    == aDisplay) ||
              (NS_STYLE_DISPLAY_TABLE_FOOTER_GROUP == aDisplay) ||
              (NS_STYLE_DISPLAY_TABLE_CAPTION      == aDisplay);
     }
   }
-  else if (NS_STYLE_DISPLAY_TABLE_CAPTION == aSiblingDisplay) {
-    // Nothing can be a sibling of a caption since there can only be one caption.
-    // But this check is necessary since a row group and caption are siblings
-    // from a content perspective (they share the table content as parent)
-    return PR_FALSE;
-  }
-  else {
-    if (nsLayoutAtoms::fieldSetFrame == aParentFrame->GetType()) {
-      // Legends can be sibling of legends but not of other content in the fieldset
-      nsIAtom* sibType = aSibling.GetType();
-      nsCOMPtr<nsIDOMHTMLLegendElement> legendContent(do_QueryInterface(&aContent));
-
-      if ((legendContent  && (nsLayoutAtoms::legendFrame != sibType)) ||
-          (!legendContent && (nsLayoutAtoms::legendFrame == sibType)))
-        return PR_FALSE;
-    }
+  else if (nsLayoutAtoms::fieldSetFrame == aParentFrame->GetType()) {
+    // Legends can be sibling of legends but not of other content in the fieldset
+    nsIAtom* sibType = aSibling.GetType();
+    nsCOMPtr<nsIDOMHTMLLegendElement> legendContent(do_QueryInterface(&aContent));
+
+    if ((legendContent  && (nsLayoutAtoms::legendFrame != sibType)) ||
+        (!legendContent && (nsLayoutAtoms::legendFrame == sibType)))
+      return PR_FALSE;
   }
 
   return PR_TRUE;
 }
 
 /**
  * Find the ``rightmost'' frame for the content immediately preceding
  * aIndexInContainer, following continuations if necessary.
@@ -8871,46 +8881,28 @@
     RemoveLetterFrames(state.mPresContext, state.mPresShell,
                        state.mFrameManager, containingBlock);
   }
 
   // if the container is a table and a caption was appended, it needs to be put in
   // the outer table frame's additional child list. 
   nsFrameItems captionItems;
   
-  PRBool hasCaption = PR_FALSE;
-  if (nsLayoutAtoms::tableFrame == frameType) {
-    nsIFrame* outerTable = parentFrame->GetParent();
-    if (outerTable) { 
-      if (outerTable->GetFirstChild(nsLayoutAtoms::captionList)) {
-        hasCaption = PR_TRUE;
-      }
-    }  
-  }
   PRUint32 i;
   count = aContainer->GetChildCount();
   for (i = aNewIndexInContainer; i < count; i++) {
     nsIContent *childContent = aContainer->GetChildAt(i);
     // lookup the table child frame type as it is much more difficult to remove a frame
     // and all it descendants (abs. pos. for instance) than to prevent the frame creation.
     if (nsLayoutAtoms::tableFrame == frameType) {
-      if (hasCaption) {
-        // Resolve the style context and get its display
-        nsRefPtr<nsStyleContext> childStyleContext;
-        childStyleContext = ResolveStyleContext(parentFrame, childContent);
-        if (childStyleContext->GetStyleDisplay()->mDisplay == NS_STYLE_DISPLAY_TABLE_CAPTION)
-          continue; //don't create a table caption frame and its descendants
-      }
       nsFrameItems tempItems;
       ConstructFrame(state, childContent, parentFrame, tempItems);
       if (tempItems.childList) {
         if (nsLayoutAtoms::tableCaptionFrame == tempItems.childList->GetType()) {
-          NS_ASSERTION(!captionItems.childList, "don't append twice a caption");
-          hasCaption = PR_TRUE; // remember that we have a caption now
-          captionItems.AddChild(tempItems.childList);        
+          captionItems.AddChild(tempItems.childList);
         }
         else {
           frameItems.AddChild(tempItems.childList);
         }
       }
     }
     else if (nsLayoutAtoms::tableColGroupFrame == frameType) {
       nsRefPtr<nsStyleContext> childStyleContext;
@@ -9117,17 +9109,18 @@
   if (!IsInlineFrame2(aParentFrame)) 
     return PR_FALSE;
 
   // find out if aChild is a block or inline
   PRBool childIsBlock = PR_FALSE;
   if (aChild->IsContentOfType(nsIContent::eELEMENT)) {
     nsRefPtr<nsStyleContext> styleContext;
     styleContext = ResolveStyleContext(aParentFrame, aChild);
-    childIsBlock = styleContext->GetStyleDisplay()->IsBlockLevel();
+    const nsStyleDisplay* display = styleContext->GetStyleDisplay();
+    childIsBlock = display->IsBlockLevel() || IsTableRelated(display->mDisplay, PR_TRUE);
   }
   nsIFrame* prevParent; // parent of prev sibling
   nsIFrame* nextParent; // parent of next sibling
 
   if (childIsBlock) { 
     if (aPrevSibling) {
       prevParent = aPrevSibling->GetParent(); 
       NS_ASSERTION(prevParent, "program error - null parent frame");
@@ -9464,31 +9457,21 @@
     // if we don't need to reframe then set parentFrame and prevSibling to the correct values
     if (NeedSpecialFrameReframe(aContainer, container, parentFrame, 
                                 aChild, aIndexInContainer, prevSibling,
                                 nextSibling)) {
       return ReframeContainingBlock(parentFrame);
     }
   }
 
-  nsFrameItems            frameItems;
   nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
                                 GetAbsoluteContainingBlock(parentFrame),
                                 GetFloatContainingBlock(parentFrame),
                                 aFrameState);
 
-  PRBool hasCaption = PR_FALSE;
-  if (nsLayoutAtoms::tableFrame == parentFrame->GetType()) {
-    nsIFrame* outerTable = parentFrame->GetParent();
-    if (outerTable) {
-      if (outerTable->GetFirstChild(nsLayoutAtoms::captionList)) {
-        hasCaption = PR_TRUE;
-      }
-    }
-  }
 
   // Recover state for the containing block - we need to know if
   // it has :first-letter or :first-line style applied to it. The
   // reason we care is that the internal structure in these cases
   // is not the normal structure and requires custom updating
   // logic.
   nsIFrame* containingBlock = state.mFloatedItems.containingBlock;
   nsStyleContext* blockSC;
@@ -9575,47 +9558,55 @@
     }
   }
   else if (NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP == parentDisplay->mDisplay) {
       nsRefPtr<nsStyleContext> childStyleContext;
       childStyleContext = ResolveStyleContext(parentFrame, aChild);
       if (childStyleContext->GetStyleDisplay()->mDisplay != NS_STYLE_DISPLAY_TABLE_COLUMN)
         return NS_OK; //don't create anything else than columns below a colgroup  
   }
-  else if (parentFrame->GetType() == nsLayoutAtoms::tableFrame && hasCaption) {
-    // Resolve the style context and get its display
-    nsRefPtr<nsStyleContext> childStyleContext;
-    childStyleContext = ResolveStyleContext(parentFrame, aChild);
-    if (childStyleContext->GetStyleDisplay()->mDisplay == NS_STYLE_DISPLAY_TABLE_CAPTION)
-      return NS_OK; //don't create a second table caption frame and its descendants
-  }
 
   // if the container is a table and a caption will be appended, it needs to be
   // put in the outer table frame's additional child list.
   
-  nsFrameItems tempItems, captionItems;
+  nsFrameItems frameItems, captionItems;
 
-  ConstructFrame(state, aChild, parentFrame, tempItems);
-  if (tempItems.childList) {
-    if (nsLayoutAtoms::tableCaptionFrame == tempItems.childList->GetType()) {
-      captionItems.AddChild(tempItems.childList);
-    }
-    else {
-      frameItems.AddChild(tempItems.childList);
+  ConstructFrame(state, aChild, parentFrame, frameItems);
+  if (frameItems.childList) {
+    if (nsLayoutAtoms::tableCaptionFrame == frameItems.childList->GetType()) {
+      NS_ASSERTION(frameItems.childList == frameItems.lastChild ,
+                   "adding a non caption frame to the caption childlist?");
+      captionItems.AddChild(frameItems.childList);
+      frameItems = nsFrameItems();
     }
   }
 
   // Now that we've created frames, run the attach queue.
   //XXXwaterson should we do this after we've processed pseudos, too?
   mDocument->BindingManager()->ProcessAttachedQueue();
 
   // process the current pseudo frame state
   if (!state.mPseudoFrames.IsEmpty())
     ProcessPseudoFrames(state, frameItems);
 
+  // If the final parent frame (decided by AdjustParentFrame()) is different
+  // from the parent of the insertion point we calculated above then
+  // parentFrame/prevSibling/appendAfterFrame are now invalid and  as it is
+  // unknown where to insert correctly we append instead (bug 341858).
+  if (frameItems.childList &&
+      frameItems.childList->GetParent() != parentFrame) {
+    prevSibling = nsnull;
+    isAppend = PR_TRUE;
+    parentFrame =
+      ::AdjustAppendParentForAfterContent(mPresShell->GetPresContext(),
+                                         aContainer,
+                                         frameItems.childList->GetParent(),
+                                         &appendAfterFrame);
+  }
+
   // XXX Bug 19949
   // Although select frame are inline we do not want to call
   // WipeContainingBlock because it will throw away the entire select frame and 
   // start over which is something we do not want to do
   //
   nsCOMPtr<nsIDOMHTMLSelectElement> selectContent = do_QueryInterface(aContainer);
   if (!selectContent) {
     // Perform special check for diddling around with the frames in
@@ -9636,16 +9627,17 @@
       // Use more complicated insert logic when inserting
       InsertFirstLineFrames(state, aContainer, containingBlock, &parentFrame,
                             prevSibling, frameItems);
     }
   }
       
   nsIFrame* newFrame = frameItems.childList;
   if (NS_SUCCEEDED(rv) && newFrame) {
+    NS_ASSERTION(!captionItems.childList, "leaking caption frames");
     // Notify the parent frame
     if (isAppend) {
       AppendFrames(state, aContainer, parentFrame, newFrame, appendAfterFrame);
     }
     else {
       if (!prevSibling) {
         // We're inserting the new frame as the first child. See if the
         // parent has a :before pseudo-element
@@ -9674,23 +9666,26 @@
     if (NS_SUCCEEDED(rv) && newCaptionFrame) {
       nsIFrame* outerTableFrame;
       if (GetCaptionAdjustedParent(parentFrame, newCaptionFrame, &outerTableFrame)) {
         // If the parent is not a outer table frame we will try to add frames
         // to a named child list that the parent does not honour and the frames
         // will get lost
         NS_ASSERTION(nsLayoutAtoms::tableOuterFrame == outerTableFrame->GetType(),
                      "Pseudo frame construction failure, a caption can be only a child of a outer table frame");
-        // the double caption creation was prevented above, so we are sure
-        // that we can append
-        NS_ASSERTION(!outerTableFrame->GetFirstChild(nsLayoutAtoms::captionList),
-                     "No double captions please");
-        state.mFrameManager->AppendFrames(outerTableFrame,
-                                          nsLayoutAtoms::captionList,
-                                          newCaptionFrame);
+        if (isAppend) {
+          state.mFrameManager->AppendFrames(outerTableFrame,
+                                            nsLayoutAtoms::captionList,
+                                            newCaptionFrame);
+        }
+        else {
+          state.mFrameManager->InsertFrames(outerTableFrame,
+                                            nsLayoutAtoms::captionList,
+                                            prevSibling, newCaptionFrame);
+        }
       }
     }
   }
   // Here we have been notified that content has been insert
   // so if the select now has a single item 
   // we need to go in and removed the dummy frame
   nsCOMPtr<nsIDOMHTMLSelectElement> selectElement = do_QueryInterface(aContainer);
   if (selectElement)
@@ -11277,57 +11272,28 @@
     // XXXbz should we be passing in a non-null aContentParentFrame?
     nsHTMLContainerFrame::CreateViewForFrame(newFrame, nsnull, PR_FALSE);
 
     // Create a continuing inner table frame, and if there's a caption then
     // replicate the caption
     nsFrameItems  newChildFrames;
 
     nsIFrame* childFrame = aFrame->GetFirstChild(nsnull);
-    while (childFrame) {
-      // See if it's the inner table frame
-      if (nsLayoutAtoms::tableFrame == childFrame->GetType()) {
-        nsIFrame* continuingTableFrame;
-
-        // It's the inner table frame, so create a continuing frame
-        rv = CreateContinuingFrame(aPresContext, childFrame, newFrame,
-                                   &continuingTableFrame);
-        if (NS_FAILED(rv)) {
-          newFrame->Destroy(aPresContext);
-          *aContinuingFrame = nsnull;
-          return rv;
-        }
-        newChildFrames.AddChild(continuingTableFrame);
-      } else {
-        // XXX remove this code and the above checks. We don't want to replicate 
-        // the caption (that is what the thead is for). This code is not executed 
-        // anyway, because the caption was put in a different child list.
-        nsStyleContext*       captionStyle = childFrame->GetStyleContext();
-        nsIContent*           caption = childFrame->GetContent();
-        NS_ASSERTION(NS_STYLE_DISPLAY_TABLE_CAPTION ==
-                       captionStyle->GetStyleDisplay()->mDisplay,
-                     "expected caption");
-
-        // Replicate the caption frame
-        // XXX We have to do it this way instead of calling ConstructFrameByDisplayType(),
-        // because of a bug in the way ConstructTableFrame() handles the initial child
-        // list...
-        nsIFrame*               captionFrame;
-        nsFrameItems            childItems;
-        NS_NewTableCaptionFrame(aPresShell, &captionFrame);
-        nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
-                                      GetAbsoluteContainingBlock(newFrame),
-                                      captionFrame);
-        captionFrame->Init(aPresContext, caption, newFrame, captionStyle, nsnull);
-        ProcessChildren(state, caption, captionFrame, PR_TRUE, childItems,
-                        PR_TRUE);
-        captionFrame->SetInitialChildList(aPresContext, nsnull, childItems.childList);
-        newChildFrames.AddChild(captionFrame);
+    if (childFrame) {
+      nsIFrame* continuingTableFrame;
+      rv = CreateContinuingFrame(aPresContext, childFrame, newFrame,
+                                 &continuingTableFrame);
+      if (NS_FAILED(rv)) {
+        newFrame->Destroy(aPresContext);
+        *aContinuingFrame = nsnull;
+        return rv;
       }
-      childFrame = childFrame->GetNextSibling();
+      newChildFrames.AddChild(continuingTableFrame);
+      
+      NS_ASSERTION(!childFrame->GetNextSibling(),"there can be only one inner table frame");
     }
 
     // Set the outer table's initial child list
     newFrame->SetInitialChildList(aPresContext, nsnull, newChildFrames.childList);
   }
 
   *aContinuingFrame = newFrame;
   return rv;
Index: mozilla/layout/tables/nsTableOuterFrame.cpp
===================================================================
--- mozilla.orig/layout/tables/nsTableOuterFrame.cpp	2007-10-09 15:03:32.000000000 +0200
+++ mozilla/layout/tables/nsTableOuterFrame.cpp	2007-10-09 15:15:27.000000000 +0200
@@ -69,20 +69,17 @@
 
 nsTableCaptionFrame::~nsTableCaptionFrame()
 {
 }
 
 NS_IMETHODIMP
 nsTableOuterFrame::Destroy(nsPresContext* aPresContext)
 {
-  if (mCaptionFrame) {
-    mCaptionFrame->Destroy(aPresContext);
-  }
-
+  mCaptionFrames.DestroyFrames(aPresContext);
   return nsHTMLContainerFrame::Destroy(aPresContext);
 }
 
 nsIAtom*
 nsTableCaptionFrame::GetType() const
 {
   return nsLayoutAtoms::tableCaptionFrame;
 }
@@ -173,17 +170,17 @@
 
   return rv;
 }
 
 nsIFrame*
 nsTableOuterFrame::GetFirstChild(nsIAtom* aListName) const
 {
   if (nsLayoutAtoms::captionList == aListName) {
-    return mCaptionFrame;
+    return mCaptionFrames.FirstChild();
   }
   if (!aListName) {
     return mFrames.FirstChild();
   }
   return nsnull;
 }
 
 nsIAtom*
@@ -197,17 +194,18 @@
 
 NS_IMETHODIMP 
 nsTableOuterFrame::SetInitialChildList(nsPresContext* aPresContext,
                                        nsIAtom*        aListName,
                                        nsIFrame*       aChildList)
 {
   if (nsLayoutAtoms::captionList == aListName) {
     // the frame constructor already checked for table-caption display type
-    mCaptionFrame = aChildList;
+    mCaptionFrames.SetFrames(aChildList);
+    mCaptionFrame  = mCaptionFrames.FirstChild();
   }
   else {
     NS_ASSERTION(!aListName, "wrong childlist");
     NS_ASSERTION(mFrames.IsEmpty(), "Frame leak!");
     mFrames.SetFrames(aChildList);
     mInnerTableFrame = nsnull;
     if (aChildList) {
       if (nsLayoutAtoms::tableFrame == aChildList->GetType()) {
@@ -220,77 +218,82 @@
 }
 
 NS_IMETHODIMP
 nsTableOuterFrame::AppendFrames(nsIAtom*        aListName,
                                 nsIFrame*       aFrameList)
 {
   nsresult rv;
 
-  // We only have two child frames: the inner table and one caption frame.
+  // We only have two child frames: the inner table and a caption frame.
   // The inner frame is provided when we're initialized, and it cannot change
   if (nsLayoutAtoms::captionList == aListName) {
-    NS_PRECONDITION(!mCaptionFrame, "already have a caption frame");
-    // We only support having a single caption frame
-    if (mCaptionFrame || (LengthOf(aFrameList) > 1)) {
-      rv = NS_ERROR_UNEXPECTED;
-    } else {
-      // Insert the caption frame into the child list
-      mCaptionFrame = aFrameList;
-
-      // Reflow the new caption frame. It's already marked dirty, so generate a reflow
-      // command that tells us to reflow our dirty child frames
-      rv = GetPresContext()->
-          PresShell()->AppendReflowCommand(this, eReflowType_ReflowDirty,
+    mCaptionFrames.AppendFrames(this, aFrameList);
+    mCaptionFrame = mCaptionFrames.FirstChild();
+
+    // Reflow the new caption frame. It's already marked dirty, so generate a reflow
+    // command that tells us to reflow our dirty child frames
+    rv = GetPresContext()->
+        PresShell()->AppendReflowCommand(this, eReflowType_ReflowDirty,
                                            nsnull);
-    }
+    
   }
   else {
     NS_PRECONDITION(PR_FALSE, "unexpected child frame type");
     rv = NS_ERROR_UNEXPECTED;
   }
 
   return rv;
 }
 
 NS_IMETHODIMP
 nsTableOuterFrame::InsertFrames(nsIAtom*        aListName,
                                 nsIFrame*       aPrevFrame,
                                 nsIFrame*       aFrameList)
 {
-  NS_PRECONDITION(!aPrevFrame, "invalid previous frame");
-  return AppendFrames(aListName, aFrameList);
+  if (nsLayoutAtoms::captionList == aListName) {
+    mCaptionFrames.InsertFrames(nsnull, aPrevFrame, aFrameList);
+    mCaptionFrame = mCaptionFrames.FirstChild();
+
+    // Reflow the new caption frame. It's already marked dirty, so
+    // just tell the pres shell.
+    return GetPresContext()->
+        PresShell()->AppendReflowCommand(this, eReflowType_ReflowDirty,
+                                           nsnull);
+  }
+  else {
+    NS_PRECONDITION(!aPrevFrame, "invalid previous frame");
+    return AppendFrames(aListName, aFrameList);
+  }
 }
 
 NS_IMETHODIMP
 nsTableOuterFrame::RemoveFrame(nsIAtom*        aListName,
                                nsIFrame*       aOldFrame)
 {
   // We only have two child frames: the inner table and one caption frame.
   // The inner frame can't be removed so this should be the caption
   NS_PRECONDITION(nsLayoutAtoms::captionList == aListName, "can't remove inner frame");
-  NS_PRECONDITION(aOldFrame == mCaptionFrame, "invalid caption frame");
 
   PRUint8 captionSide = GetCaptionSide();
 
   // See if the (top/bottom) caption's minimum width impacted the inner table or there
   // is a left/right caption (that likely impacts the inner table)
   if ((mMinCaptionWidth == mRect.width) || 
       (NS_SIDE_LEFT == captionSide) || (NS_SIDE_RIGHT == captionSide)) {
     // The old caption width had an effect on the inner table width so
     // we're going to need to reflow it. Mark it dirty
     mInnerTableFrame->AddStateBits(NS_FRAME_IS_DIRTY);
   }
 
-  // Remove the caption frame and destroy it
-  if (mCaptionFrame && (mCaptionFrame == aOldFrame)) {
-    mCaptionFrame->Destroy(GetPresContext());
-    mCaptionFrame = nsnull;
-    mMinCaptionWidth = 0;
-  }
+  // Remove the frame and destroy it
+  mCaptionFrames.DestroyFrame(GetPresContext(), aOldFrame);
+  mCaptionFrame = mCaptionFrames.FirstChild();
+  
+  mMinCaptionWidth = 0;
 
   // Generate a reflow command so we get reflowed
   GetPresContext()->PresShell()->AppendReflowCommand(this,
                                                      eReflowType_ReflowDirty,
                                                      nsnull);
 
   return NS_OK;
 }
Index: mozilla/layout/tables/nsTableOuterFrame.h
===================================================================
--- mozilla.orig/layout/tables/nsTableOuterFrame.h	2007-10-09 15:03:47.000000000 +0200
+++ mozilla/layout/tables/nsTableOuterFrame.h	2007-10-09 15:15:29.000000000 +0200
@@ -398,16 +398,17 @@
                         nscoord                  aAvailableWidth,
                         nsMargin&                aMargin,
                         nsMargin&                aMarginNoAuto,
                         nsMargin&                aPadding);
 
 private:
   // used to keep track of this frame's children. They are redundant with mFrames, but more convient
   nsTableFrame* mInnerTableFrame; 
+  nsFrameList   mCaptionFrames;
   nsIFrame*     mCaptionFrame;
 
   // used to track caption max element size 
   PRInt32   mMinCaptionWidth;
   nscoord   mPriorAvailWidth;
 
 #ifdef DEBUG_TABLE_REFLOW_TIMING
 public:

mozilla-325761.patch:

--- NEW FILE mozilla-325761.patch ---
---
 caps/src/nsScriptSecurityManager.cpp |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: mozilla/caps/src/nsScriptSecurityManager.cpp
===================================================================
--- mozilla.orig/caps/src/nsScriptSecurityManager.cpp
+++ mozilla/caps/src/nsScriptSecurityManager.cpp
@@ -1353,17 +1353,17 @@
         { "aim",             AllowProtocol  },
         { "data",            AllowProtocol  },
         { "keyword",         DenyProtocol   },
         { "resource",        ChromeProtocol },
         { "gopher",          AllowProtocol  },
         { "datetime",        DenyProtocol   },
         { "finger",          AllowProtocol  },
         { "res",             DenyProtocol   },
-        { "x-jsd",           ChromeProtocol },
+        { "x-jsd",           DenyProtocol   },
         { "wyciwyg",         DenyProtocol   }
     };
 
     NS_NAMED_LITERAL_STRING(errorTag, "CheckLoadURIError");
     for (unsigned i=0; i < sizeof(protocolList)/sizeof(protocolList[0]); i++)
     {
         if (targetScheme.LowerCaseEqualsASCII(protocolList[i].name))
         {

mozilla-345305_venkmanonly.patch:

--- NEW FILE mozilla-345305_venkmanonly.patch ---
---
 extensions/venkman/resources/content/venkman-records.js |  151 +++++++++++++---
 extensions/venkman/resources/content/venkman-utils.js   |    2 
 extensions/venkman/resources/content/venkman-views.js   |   40 +---
 3 files changed, 142 insertions(+), 51 deletions(-)

Index: mozilla/extensions/venkman/resources/content/venkman-records.js
===================================================================
--- mozilla.orig/extensions/venkman/resources/content/venkman-records.js	2007-10-09 16:36:04.000000000 +0200
+++ mozilla/extensions/venkman/resources/content/venkman-records.js	2007-10-09 16:36:36.000000000 +0200
@@ -560,30 +560,31 @@
         ValueRecord.prototype.showConstants = e.toggle;
         console.prefs["valueRecord.showConstants"] = e.toggle;
     }
 
     if ("isInteractive" in e && e.isInteractive)
         dispatch("pref valueRecord.showConstants", { isInteractive: true });
 }
 
-function ValueRecord (value, name, flags)
+function ValueRecord (value, name, flags, jsdFrame)
 {
     if (!(value instanceof jsdIValue))
         throw new BadMojo (ERR_INVALID_PARAM, "value", String(value));
 
     this.setColumnPropertyName ("col-0", "displayName");
     this.setColumnPropertyName ("col-1", "displayType");
     this.setColumnPropertyName ("col-2", "displayValue");
     this.setColumnPropertyName ("col-3", "displayFlags");    
     this.displayName = name;
     this.displayFlags = formatFlags(flags);
     this.name = name;
     this.flags = flags;
     this.value = value;
+    this.jsdFrame = jsdFrame;
     this.jsType = null;
     this.onPreRefresh = false;
     this.refresh();
     delete this.onPreRefresh;
 }
 
 ValueRecord.prototype = new XULTreeViewRecord (null);
 
@@ -595,16 +596,59 @@
      
     if ("parentRecord" in this)
         return this.__share = this.parentRecord._share;
  
     ASSERT (0, "ValueRecord cannot be the root of a visible tree.");
     return null;
 }
 
+ValueRecord.prototype.__defineGetter__("expression", vr_getexpressionl);
+function vr_getexpressionl()
+{
+    return this.getExpression();
+}
+
+ValueRecord.prototype.getExpression =
+function vr_getexpression(extra)
+{
+    var items = [this.displayName];
+
+    if ("value" in this.parentRecord)
+    {
+        var cur = this.parentRecord;
+        while (cur != console.views["locals"].childData &&
+               cur != console.views["locals"].scopeRecord)
+        {
+            if ("isECMAProto" in cur)
+                items.unshift("__proto__");
+            else if ("isECMAParent" in cur)
+                items.unshift("__parent__");
+            else
+                items.unshift(cur.displayName);
+            cur = cur.parentRecord;
+        }
+    }
+
+    if (typeof extra == "string")
+        items.push(extra);
+
+    return makeExpression(items);
+}
+
+ValueRecord.prototype.evalString =
+function vr_evalstring(string)
+{
+    //dd("ValueRecord(" + this.displayName + ").evalString(" + string + ")");
+    var rval = new Object();
+    if (this.jsdFrame.eval(string, JSD_URL_SCHEME + "value-record", 1, rval))
+        return rval.value;
+    return undefined;
+}
+
 ValueRecord.prototype.showFunctions = false;
 ValueRecord.prototype.showECMAProps = false;
 ValueRecord.prototype.showConstants = false;
 
 ValueRecord.prototype.getProperties =
 function vr_getprops (properties)
 {
     if ("valueIsException" in this || this.flags & PROP_EXCEPTION)
@@ -645,18 +689,20 @@
         var prop = value.getProperty (this.name);
         if (prop)
         {
             this.flags = prop.flags;
             this.value = prop.value;
         }
         else
         {
-            var jsval = value.getWrappedValue();
-            this.value = console.jsds.wrapValue(jsval[this.name]);
+            ASSERT(this.jsdFrame, "ValueRecord(" + this.displayName +
+                   ").onPreRefresh: no jsdIStackFrame to safely eval on!");
+
+            this.value = this.evalString(this.expression);
             this.flags = PROP_ENUMERATE | PROP_HINTED;
         }
     }
 }
     
 ValueRecord.prototype.refresh =
 function vr_refresh ()
 {
@@ -817,51 +863,107 @@
         default:
             ASSERT (0, "invalid value");
     }
 }
 
 ValueRecord.prototype.countProperties =
 function vr_countprops ()
 {
-    var c = 0;
-    var jsval = this.value.getWrappedValue();
-    try
-    {
-        for (var p in jsval)
-            ++c;
-    }
-    catch (ex)
-    {
-        dd ("caught exception counting properties\n" + ex);
-    }
-    
-    return c;
+    ASSERT(this.jsdFrame, "ValueRecord(" + this.displayName +
+           ").countProperties: no jsdIStackFrame to safely eval on!");
+
+    // Note: uses an inline function to avoid polluting the frame's scope.
+    var code = "(function(obj){" +
+               "    var count = 0;" +
+               "    for (var prop in obj)" +
+               "        ++count;" +
+               "    return count;" +
+               "})(" + this.expression + ")";
+
+    // rv is undefined if an exception occured.
+    var rv = this.evalString(code);
+    if (typeof rv == "undefined")
+        return 0;
+
+    return rv.intValue;
 }
 
 ValueRecord.prototype.listProperties =
 function vr_listprops ()
 {
+    function charEscapeReplace(s, c)
+    {
+        return String.fromCharCode(parseInt(c, 16));
+    };
+
     // the ":" prefix for keys in the propMap avoid collisions with "real"
     // pseudo-properties, such as __proto__.  If we were to actually assign
     // to those we would introduce bad side affects.
 
     //dd ("listProperties {");
-    var i;
-    var jsval = this.value.getWrappedValue();
+    var i, jsval;
     var propMap = new Object();
 
     /* get the enumerable properties */
-    
-    for (var p in jsval)
+
+    ASSERT(this.jsdFrame, "ValueRecord(" + this.displayName +
+           ").listProperties: no jsdIStackFrame to safely eval on!");
+
+    var propList = new Array();
+
+    // quote() puts double-quotes at either end of the string,
+    // backspash-escapes double-quotes in the string, and (quite
+    // importantly) uses \xXX and \uXXXX escapes for non-ASCII
+    // characters.
+
+    // Note: uses an inline function to avoid polluting the frame's scope.
+    var code = "(function(obj){" +
+               "    var string = '';" +
+               "    for (var prop in obj) {" +
+               "        if (string)" +
+               "            string += ',';" +
+               "        string += prop.quote();" +
+               "    }" +
+               "    return string;" +
+               "})(" + this.expression + ")";
+
+    // list is undefined if an exception occured.
+    var list = this.evalString(code);
+    if (typeof list != "undefined") {
+        list = list.stringValue;
+        //dd("ValueRecord(" + this.displayName +
+        //   ").listProperties: list: " + list);
+        if (list) {
+            list = ('",' + list + ',"').split('","');
+
+            for (i = 0; i < list.length; i++)
+            {
+                if (!list[i])
+                    continue;
+
+                var prop = list[i];
+                prop = prop.replace(/\\x([0-9a-f]{2})/i, charEscapeReplace);
+                prop = prop.replace(/\\u([0-9a-f]{4})/i, charEscapeReplace);
+                prop = prop.replace(/\\(.)/, "$1");
+                propList.push(prop);
+                //dd("ValueRecord(" + this.displayName +
+                //   ").listProperties: prop: " + prop);
+            }
+        }
+    }
+
+    for (i = 0; i < propList.length; i++)
     {
+        var p = propList[i];
         var value;
         try
         {
-            value = console.jsds.wrapValue(jsval[p]);
+            value = this.evalString(this.getExpression(p));
+
             if (this.showFunctions || value.jsType != TYPE_FUNCTION)
             {
                 propMap[":" + p] = { name: p, value: value,
                                      flags: PROP_ENUMERATE | PROP_HINTED };
             }
             else
             {
                 //dd ("not including function " + name);
@@ -987,25 +1089,25 @@
         this.propertyList = this.listProperties();
         
         if (this.showECMAProps)
         {
             var rec;
             if (this.value.jsPrototype)
             {
                 rec = new ValueRecord(this.value.jsPrototype,
-                                      MSG_VAL_PROTO);
+                                      MSG_VAL_PROTO, "", this.jsdFrame);
                 rec.isECMAProto = true;
                 this.appendChild (rec);
             }
             
             if (this.value.jsParent)
             {
                 rec = new ValueRecord(this.value.jsParent,
-                                      MSG_VAL_PARENT);
+                                      MSG_VAL_PARENT, "", this.jsdFrame);
                 rec.isECMAParent = true;
                 this.appendChild (rec);
             }
         }
         
         if (!this.childData.length && !this.propertyList.length)
         {
             rec = new XTLabelRecord ("col-0", MSG_VAL_NONE,
@@ -1014,17 +1116,18 @@
             return;
         }
         
         for (var i = 0; i < this.propertyList.length; ++i)
         {
             var prop = this.propertyList[i];
             this.appendChild(new ValueRecord(prop.value,
                                              prop.name,
-                                             prop.flags));
+                                             prop.flags,
+                                             this.jsdFrame));
         }
     }
     catch (ex)
     {
         display (getMsg (MSN_ERR_FAILURE, ex), MT_ERROR);
     }
 }
 
Index: mozilla/extensions/venkman/resources/content/venkman-utils.js
===================================================================
--- mozilla.orig/extensions/venkman/resources/content/venkman-utils.js	2007-10-09 16:36:04.000000000 +0200
+++ mozilla/extensions/venkman/resources/content/venkman-utils.js	2007-10-09 16:36:39.000000000 +0200
@@ -1004,17 +1004,17 @@
 function makeExpression (items)
 {
     function escapeItem (item, first)
     {
         // Numbers.
         if (item.match(/^[0-9]+$/i))
             return "[" + item + "]";
         // Words/other items that don't need quoting.
-        if (item.match(/^[a-z_][a-z0-9_]+$/i))
+        if (item.match(/^[a-z_][a-z0-9_]*$/i))
             return (!first ? "." : "") + item;
         // Quote everything else.
         return "[" + item.quote() + "]";
     };
     
     var expression = escapeItem(items[0], true);
     
     for (var i = 1; i < items.length; i++)
Index: mozilla/extensions/venkman/resources/content/venkman-views.js
===================================================================
--- mozilla.orig/extensions/venkman/resources/content/venkman-views.js	2007-10-09 16:36:04.000000000 +0200
+++ mozilla/extensions/venkman/resources/content/venkman-views.js	2007-10-09 16:36:29.000000000 +0200
@@ -607,17 +607,18 @@
     {
         var tag = jsdFrame.script.tag;
         if (tag in this.savedStates)
             state = this.savedStates[tag];
     }
     
     if (jsdFrame.scope)
     {
-        this.scopeRecord = new ValueRecord (jsdFrame.scope, MSG_VAL_SCOPE, "");
+        this.scopeRecord = new ValueRecord(jsdFrame.scope, MSG_VAL_SCOPE, "",
+                                           jsdFrame);
         this.scopeRecord.onPreRefresh = null;
         this.childData.appendChild(this.scopeRecord);
         if (!state && jsdFrame.scope.propertyCount <
             console.prefs["localsView.autoOpenMax"])
         {
             this.scopeRecord.open();
         }
         
@@ -629,17 +630,17 @@
                                                "locals:col-3"]);
         this.scopeRecord.property = ValueRecord.prototype.atomObject;
         this.childData.appendChild(this.scopeRecord);
     }
     
     if (jsdFrame.thisValue)
     {
         this.thisRecord = new ValueRecord (jsdFrame.thisValue, MSG_VAL_THIS,
-                                           "");
+                                           "", jsdFrame);
         this.thisRecord.onPreRefresh = null;
         this.childData.appendChild(this.thisRecord);
         if (!state && jsdFrame.thisValue.propertyCount < 
             console.prefs["localsView.autoOpenMax"])
         {
             this.scopeRecord.open();
         }
     }    
@@ -794,40 +795,17 @@
     
     cx.jsdValueList = new Array();
     
     function recordContextGetter (cx, rec, i)
     {
         if (i == 0)
         {
             cx.jsdValue = rec.value;
-            var items = new Array();
-            items.unshift(rec.displayName);
-            
-            if ("value" in rec.parentRecord)
-            {
-                cx.parentValue = rec.parentRecord.value;
-                var cur = rec.parentRecord;
-                while (cur != locals.childData &&
-                       cur != locals.scopeRecord)
-                {
-                    if ("isECMAProto" in cur)
-                        items.unshift("__proto__");
-                    else if ("isECMAParent" in cur)
-                        items.unshift("__parent__");
-                    else
-                        items.unshift(cur.displayName);
-                    cur = cur.parentRecord;
-                }
-            }
-            else
-            {
-                cx.parentValue = null;
-            }
-            cx.expression = makeExpression(items);
+            cx.expression = rec.expression;
             cx.propertyName = rec.displayName;
         }
         else
         {
             cx.jsdValueList.push(rec.value);
         }
         return cx;
     };
@@ -4299,19 +4277,29 @@
         if (!("currentEvalObject" in console))
         {
             display (MSG_ERR_NO_EVAL_OBJECT, MT_ERROR);
             return null;
         }
 
         refresher = function () {
                         if ("frames" in console)
+                        {
+                            this.jsdFrame = getCurrentFrame();
                             this.value = evalInTargetScope(e.expression, true);
+                        }
                         else
+                        {
+                            /* This is a security protection; leaving the
+                             * object open allows access to child items when
+                             * we have no frame to safely eval them on.
+                             */
+                            this.close();
                             throw MSG_VAL_NA;
+                        }
                     };
     }
     else
     {
         refresher = function () {
                         var rv = evalInDebuggerScope(e.expression, true);
                         this.value = console.jsds.wrapValue(rv);
                     };

mozilla-361745.patch:

--- NEW FILE mozilla-361745.patch ---
---
 layout/svg/base/src/nsSVGImageFrame.cpp |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

Index: mozilla/layout/svg/base/src/nsSVGImageFrame.cpp
===================================================================
--- mozilla.orig/layout/svg/base/src/nsSVGImageFrame.cpp	2007-10-09 17:42:44.000000000 +0200
+++ mozilla/layout/svg/base/src/nsSVGImageFrame.cpp	2007-10-09 17:43:02.000000000 +0200
@@ -285,17 +285,17 @@
 
   mX->GetValue(&x);
   mY->GetValue(&y);
   mWidth->GetValue(&width);
   mHeight->GetValue(&height);
 
   /* In a perfect world, this would be handled by the DOM, and 
      return a DOM exception. */
-  if (width == 0 || height == 0)
+  if (width <= 0 || height <= 0)
     return NS_OK;
 
   pathBuilder->Moveto(x, y);
   pathBuilder->Lineto(x+width, y);
   pathBuilder->Lineto(x+width, y+height);
   pathBuilder->Lineto(x, y+height);
   pathBuilder->ClosePath(&x, &y);
 
@@ -305,16 +305,22 @@
 //----------------------------------------------------------------------
 // nsISVGChildFrame methods:
 NS_IMETHODIMP
 nsSVGImageFrame::PaintSVG(nsISVGRendererCanvas* canvas, const nsRect& dirtyRectTwips)
 {
   if (!GetStyleVisibility()->IsVisible())
     return NS_OK;
 
+  float width, height;
+  mWidth->GetValue(&width);
+  mHeight->GetValue(&height);
+  if (width <= 0 || height <= 0)
+    return NS_OK;
+
   if (mSurfaceInvalid) {
     nsCOMPtr<imgIRequest> currentRequest;
     nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
     if (imageLoader)
       imageLoader->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
                               getter_AddRefs(currentRequest));
 
     nsCOMPtr<imgIContainer> currentContainer;
@@ -348,21 +354,19 @@
       clip->ClipPaint(canvas, this, matrix);
     }
   }
 
   if (mSurface) {
     nsCOMPtr<nsIDOMSVGMatrix> ctm;
     GetCanvasTM(getter_AddRefs(ctm));
 
-    float x, y, width, height;
+    float x, y;
     mX->GetValue(&x);
     mY->GetValue(&y);
-    mWidth->GetValue(&width);
-    mHeight->GetValue(&height);
 
     if (GetStyleDisplay()->IsScrollableOverflow())
       canvas->SetClipRect(ctm, x, y, width, height);
 
     PRUint32 nativeWidth, nativeHeight;
     mSurface->GetWidth(&nativeWidth);
     mSurface->GetHeight(&nativeHeight);
 

mozilla-362901.patch:

--- NEW FILE mozilla-362901.patch ---
---
 layout/base/nsCSSFrameConstructor.cpp |  122 +++++++++++++++++++++-------------
 layout/base/nsCSSFrameConstructor.h   |    4 +
 layout/base/nsStyleChangeList.cpp     |    2 
 layout/generic/nsBlockFrame.cpp       |   32 +++++---
 layout/generic/nsBlockFrame.h         |    2 
 layout/generic/nsContainerFrame.cpp   |   18 +++--
 layout/generic/nsTextFrame.cpp        |    4 +
 7 files changed, 122 insertions(+), 62 deletions(-)

Index: mozilla/layout/base/nsCSSFrameConstructor.cpp
===================================================================
--- mozilla.orig/layout/base/nsCSSFrameConstructor.cpp	2007-10-09 12:53:36.000000000 +0200
+++ mozilla/layout/base/nsCSSFrameConstructor.cpp	2007-10-09 13:00:22.000000000 +0200
@@ -8855,21 +8855,20 @@
   nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
                                 GetAbsoluteContainingBlock(parentFrame),
                                 GetFloatContainingBlock(parentFrame));
 
   // See if the containing block has :first-letter style applied.
   PRBool haveFirstLetterStyle = PR_FALSE, haveFirstLineStyle = PR_FALSE;
   nsIFrame* containingBlock = state.mFloatedItems.containingBlock;
   if (containingBlock) {
-    nsIContent* blockContent = containingBlock->GetContent();
-    nsStyleContext* blockSC = containingBlock->GetStyleContext();
-    HaveSpecialBlockStyle(blockContent, blockSC,
-                          &haveFirstLetterStyle,
-                          &haveFirstLineStyle);
+    haveFirstLetterStyle = HaveFirstLetterStyle(containingBlock);
+    haveFirstLineStyle =
+      HaveFirstLineStyle(containingBlock->GetContent(),
+                         containingBlock->GetStyleContext());
   }
 
   if (haveFirstLetterStyle) {
     // Before we get going, remove the current letter frames
     RemoveLetterFrames(state.mPresContext, state.mPresShell,
                        state.mFrameManager, containingBlock);
   }
 
@@ -9507,21 +9506,20 @@
   // place. If its a certain kind of container then some special
   // processing is done.
   if ((NS_STYLE_DISPLAY_BLOCK == parentDisplay->mDisplay) ||
       (NS_STYLE_DISPLAY_LIST_ITEM == parentDisplay->mDisplay) ||
       (NS_STYLE_DISPLAY_INLINE == parentDisplay->mDisplay) ||
       (NS_STYLE_DISPLAY_INLINE_BLOCK == parentDisplay->mDisplay)) {
     // Recover the special style flags for the containing block
     if (containingBlock) {
-      blockSC = containingBlock->GetStyleContext();
-      blockContent = containingBlock->GetContent();
-      HaveSpecialBlockStyle(blockContent, blockSC,
-                            &haveFirstLetterStyle,
-                            &haveFirstLineStyle);
+      haveFirstLetterStyle = HaveFirstLetterStyle(containingBlock);
+      haveFirstLineStyle =
+        HaveFirstLineStyle(containingBlock->GetContent(),
+                           containingBlock->GetStyleContext());
     }
 
     if (haveFirstLetterStyle) {
       // Get the correct parentFrame and prevSibling - if a
       // letter-frame is present, use its parent.
       if (parentFrame->GetType() == nsLayoutAtoms::letterFrame) {
         parentFrame = parentFrame->GetParent();
         container = parentFrame->GetContent();
@@ -10011,20 +10009,17 @@
     if (parentFrame->GetType() == nsLayoutAtoms::frameSetFrame) {
       // Just reframe the parent, since framesets are weird like that.
       return RecreateFramesForContent(parentFrame->GetContent());
     }
 
     // Examine the containing-block for the removed content and see if
     // :first-letter style applies.
     nsIFrame* containingBlock = GetFloatContainingBlock(parentFrame);
-    PRBool haveFLS = containingBlock ?
-      HaveFirstLetterStyle(containingBlock->GetContent(),
-                           containingBlock->GetStyleContext()) :
-      PR_FALSE;
+    PRBool haveFLS = containingBlock && HaveFirstLetterStyle(containingBlock);
     if (haveFLS) {
       // Trap out to special routine that handles adjusting a blocks
       // frame tree when first-letter style is present.
 #ifdef NOISY_FIRST_LETTER
       printf("ContentRemoved: containingBlock=");
       nsFrame::ListTag(stdout, containingBlock);
       printf(" parentFrame=");
       nsFrame::ListTag(stdout, parentFrame);
@@ -10428,52 +10423,55 @@
   if (nsnull != frame) {
 #if 0
     NS_FRAME_LOG(NS_FRAME_TRACE_CALLS,
        ("nsCSSFrameConstructor::CharacterDataChanged: content=%p[%s] subcontent=%p frame=%p",
         aContent, ContentTag(aContent, 0),
         aSubContent, frame));
 #endif
 
-    // Special check for text content that is a child of a letter
-    // frame. There are two interesting cases that we have to handle
-    // carefully: text content that is going empty (which means we
-    // should select a new text node as the first-letter text) or text
-    // content that empty but is no longer empty (it might be the
-    // first-letter text but isn't currently).
-    //
-    // To deal with both of these we make a simple change: map a
-    // CharacterDataChanged into a ReinsertContent when we are changing text
-    // that is part of a first-letter situation.
-    PRBool doCharacterDataChanged = PR_TRUE;
+    // Special check for text content that is a child of a letter frame.  If
+    // this happens, we should remove the letter frame, do whatever we're
+    // planning to do with this notification, then put the letter frame back.
+    // Note that this is basically what ReinsertContent ends up doing; the
+    // reason we dont' want to call that here is that our text content could be
+    // native anonymous, in which case ReinsertContent would completely barf on
+    // it.  And reinserting the non-anonymous ancestor would just lead us to
+    // come back into this notification (e.g. if quotes or counters are
+    // involved), leading to a loop.
+    PRBool haveFirstLetterStyle = PR_FALSE;
+    nsIFrame* block = nsnull;
     nsCOMPtr<nsITextContent> textContent(do_QueryInterface(aContent));
     if (textContent) {
       // Ok, it's text content. Now do some real work...
-      nsIFrame* block = GetFloatContainingBlock(frame);
+      block = GetFloatContainingBlock(frame);
       if (block) {
         // See if the block has first-letter style applied to it.
-        nsIContent* blockContent = block->GetContent();
-        nsStyleContext* blockSC = block->GetStyleContext();
-        PRBool haveFirstLetterStyle =
-          HaveFirstLetterStyle(blockContent, blockSC);
+        haveFirstLetterStyle = HaveFirstLetterStyle(block);
         if (haveFirstLetterStyle) {
-          // The block has first-letter style. Use content-replaced to
-          // repair the blocks frame structure properly.
-          nsCOMPtr<nsIContent> container = aContent->GetParent();
-          if (container) {
-            doCharacterDataChanged = PR_FALSE;
-            rv = ReinsertContent(container, aContent);
-          }
+          RemoveLetterFrames(mPresShell->GetPresContext(), mPresShell,
+                             mPresShell->FrameManager(), block);
+          // Reget |frame|, since we might have killed it.  Do we
+          // really need to call CharacterDataChanged in this case,
+          // though?
+          mPresShell->GetPrimaryFrameFor(aContent, &frame);
+          NS_ASSERTION(frame, "Should have frame here!");
         }
       }
     }
 
-    if (doCharacterDataChanged) {
-      frame->CharacterDataChanged(mPresShell->GetPresContext(), aContent,
-                                  aAppend);
+    frame->CharacterDataChanged(mPresShell->GetPresContext(), aContent,
+                                aAppend);
+
+    if (haveFirstLetterStyle) {
+      // Note that if we got here |block| is not null
+      nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
+                                    GetAbsoluteContainingBlock(frame),
+                                    block, nsnull);
+      RecoverLetterFrames(state, block);
     }
   }
 
   return rv;
 }
 
 #ifdef ACCESSIBILITY
 nsIAtom*
@@ -12184,16 +12182,32 @@
                                             nsStyleContext* aStyleContext)
 {
   return nsLayoutUtils::HasPseudoStyle(aContent, aStyleContext,
                                        nsCSSPseudoElements::firstLetter,
                                        mPresShell->GetPresContext());
 }
 
 PRBool
+nsCSSFrameConstructor::HaveFirstLetterStyle(nsIFrame* aBlockFrame)
+{
+  NS_PRECONDITION(aBlockFrame, "Need a frame");
+  
+#ifdef DEBUG
+  nsBlockFrame* block;
+  NS_ASSERTION(NS_SUCCEEDED(aBlockFrame->QueryInterface(kBlockFrameCID,
+                                                        (void**)&block)) &&
+               block,
+               "Not a block frame?");
+#endif
+
+  return (aBlockFrame->GetStateBits() & NS_BLOCK_HAS_FIRST_LETTER_STYLE) != 0;
+}
+
+PRBool
 nsCSSFrameConstructor::HaveFirstLineStyle(nsIContent* aContent,
                                           nsStyleContext* aStyleContext)
 {
   return nsLayoutUtils::HasPseudoStyle(aContent, aStyleContext,
                                        nsCSSPseudoElements::firstLine,
                                        mPresShell->GetPresContext());
 }
 
@@ -12694,17 +12708,24 @@
   nsFrameItems& aResult)
 {
   // Create the first-letter-frame
   nsresult rv;
   nsIFrame* letterFrame;
   nsStyleSet *styleSet = mPresShell->StyleSet();
 
   NS_NewFirstLetterFrame(mPresShell, &letterFrame);  
-  InitAndRestoreFrame(aState, aTextContent, aParentFrame, aStyleContext,
+  // We don't want to use a text content for a non-text frame (because we want
+  // its primary frame to be a text frame).  So use its parent for the
+  // first-letter.
+  nsIContent* letterContent = aTextContent->GetParent();
+  NS_ASSERTION(letterContent->GetBindingParent() != letterContent,
+               "Reframes of this letter frame will mess with the root of a "
+               "native anonymous content subtree!");
+  InitAndRestoreFrame(aState, letterContent, aParentFrame, aStyleContext,
                       nsnull, letterFrame);
 
   // Init the text frame to refer to the letter frame. Make sure we
   // get a proper style context for it (the one passed in is for the
   // letter frame and will have the float property set on it; the text
   // frame shouldn't have that set).
   nsRefPtr<nsStyleContext> textSC;
   textSC = styleSet->ResolveStyleForNonElement(aStyleContext);
@@ -12713,17 +12734,17 @@
 
   // And then give the text frame to the letter frame
   letterFrame->SetInitialChildList(aState.mPresContext, nsnull, aTextFrame);
 
   // Now make the placeholder
   nsIFrame* placeholderFrame;
   CreatePlaceholderFrameFor(mPresShell,
                             aState.mPresContext, aState.mFrameManager,
-                            aTextContent, letterFrame,
+                            letterContent, letterFrame,
                             aStyleContext, aParentFrame,
                             &placeholderFrame);
 
   // See if we will need to continue the text frame (does it contain
   // more than just the first-letter text or not?) If it does, then we
   // create (in advance) a continuation frame for it.
   nsIFrame* nextTextFrame = nsnull;
   if (NeedFirstLetterContinuation(aTextContent)) {
@@ -12790,18 +12811,24 @@
                                   blockContent, aParentFrame,
                                   sc, aResult);
       }
       else {
         // Make an inflow first-letter frame
         nsIFrame* letterFrame;
         nsresult rv = NS_NewFirstLetterFrame(mPresShell, &letterFrame);
         if (NS_SUCCEEDED(rv)) {
-          // Initialize the first-letter-frame.
-          letterFrame->Init(aState.mPresContext, aTextContent, aParentFrame,
+          // Initialize the first-letter-frame.  We don't want to use a text
+          // content for a non-text frame (because we want its primary frame to
+          // be a text frame).  So use its parent for the first-letter.
+          nsIContent* letterContent = aTextContent->GetParent();
+          NS_ASSERTION(letterContent->GetBindingParent() != letterContent,
+                       "Reframes of this letter frame will mess with the root "
+                       "of a native anonymous content subtree!");
+          letterFrame->Init(aState.mPresContext, letterContent, aParentFrame,
                             sc, nsnull);
           nsRefPtr<nsStyleContext> textSC;
           textSC = mPresShell->StyleSet()->ResolveStyleForNonElement(sc);
 
           InitAndRestoreFrame(aState, aTextContent, letterFrame, textSC,
                               nsnull, textFrame);
 
           letterFrame->SetInitialChildList(aState.mPresContext, nsnull,
@@ -12819,16 +12846,18 @@
 nsCSSFrameConstructor::WrapFramesInFirstLetterFrame(
   nsFrameConstructorState& aState,
   nsIContent*              aBlockContent,
   nsIFrame*                aBlockFrame,
   nsFrameItems&            aBlockFrames)
 {
   nsresult rv = NS_OK;
 
+  aBlockFrame->AddStateBits(NS_BLOCK_HAS_FIRST_LETTER_STYLE);
+
   nsIFrame* parentFrame = nsnull;
   nsIFrame* textFrame = nsnull;
   nsIFrame* prevFrame = nsnull;
   nsFrameItems letterFrames;
   PRBool stopLooking = PR_FALSE;
   rv = WrapFramesInFirstLetterFrame(aState, aBlockFrame,
                                     aBlockFrames.childList,
                                     &parentFrame, &textFrame, &prevFrame,
@@ -13139,16 +13168,18 @@
 
 // Fixup the letter frame situation for the given block
 nsresult
 nsCSSFrameConstructor::RecoverLetterFrames(nsFrameConstructorState& aState,
                                            nsIFrame* aBlockFrame)
 {
   nsresult rv = NS_OK;
 
+  aBlockFrame->AddStateBits(NS_BLOCK_HAS_FIRST_LETTER_STYLE);
+
   nsIFrame* blockKids = aBlockFrame->GetFirstChild(nsnull);
   nsIFrame* parentFrame = nsnull;
   nsIFrame* textFrame = nsnull;
   nsIFrame* prevFrame = nsnull;
   nsFrameItems letterFrames;
   PRBool stopLooking = PR_FALSE;
   rv = WrapFramesInFirstLetterFrame(aState, aBlockFrame, blockKids,
                                     &parentFrame, &textFrame, &prevFrame,
@@ -14246,16 +14277,19 @@
 nsCSSFrameConstructor::PostRestyleEvent(nsIContent* aContent,
                                         nsReStyleHint aRestyleHint,
                                         nsChangeHint aMinChangeHint)
 {
   if (aRestyleHint == 0 && !aMinChangeHint) {
     // Nothing to do here
     return;
   }
+
+  NS_ASSERTION(aContent->IsContentOfType(nsIContent::eELEMENT),
+               "Shouldn't be trying to restyle non-elements directly");
   
   RestyleData existingData;
   existingData.mRestyleHint = nsReStyleHint(0);
   existingData.mChangeHint = NS_STYLE_HINT_NONE;
 
   mPendingRestyles.Get(aContent, &existingData);
   existingData.mRestyleHint =
     nsReStyleHint(existingData.mRestyleHint | aRestyleHint);
Index: mozilla/layout/base/nsCSSFrameConstructor.h
===================================================================
--- mozilla.orig/layout/base/nsCSSFrameConstructor.h	2007-10-09 12:49:22.000000000 +0200
+++ mozilla/layout/base/nsCSSFrameConstructor.h	2007-10-09 13:00:22.000000000 +0200
@@ -736,16 +736,20 @@
 
   already_AddRefed<nsStyleContext>
   GetFirstLineStyle(nsIContent*      aContent,
                     nsStyleContext*  aStyleContext);
 
   PRBool HaveFirstLetterStyle(nsIContent*      aContent,
                               nsStyleContext*  aStyleContext);
 
+  // Check whether a given block has first-letter style.  Make sure to
+  // only pass in blocks!  And don't pass in null either.
+  PRBool HaveFirstLetterStyle(nsIFrame* aBlockFrame);
+
   PRBool HaveFirstLineStyle(nsIContent*      aContent,
                             nsStyleContext*  aStyleContext);
 
   void HaveSpecialBlockStyle(nsIContent*      aContent,
                              nsStyleContext*  aStyleContext,
                              PRBool*          aHaveFirstLetterStyle,
                              PRBool*          aHaveFirstLineStyle);
 
Index: mozilla/layout/base/nsStyleChangeList.cpp
===================================================================
--- mozilla.orig/layout/base/nsStyleChangeList.cpp	2007-10-09 12:49:22.000000000 +0200
+++ mozilla/layout/base/nsStyleChangeList.cpp	2007-10-09 13:00:22.000000000 +0200
@@ -84,16 +84,18 @@
 
 nsresult 
 nsStyleChangeList::AppendChange(nsIFrame* aFrame, nsIContent* aContent, nsChangeHint aHint)
 {
   NS_ASSERTION(aFrame || (aHint & nsChangeHint_ReconstructFrame),
                "must have frame");
   NS_ASSERTION(aContent || !(aHint & nsChangeHint_ReconstructFrame),
                "must have content");
+  NS_ASSERTION(!aContent || aContent->IsContentOfType(nsIContent::eELEMENT),
+               "Shouldn't be trying to restyle non-elements directly");
 
   if ((0 < mCount) && (aHint & nsChangeHint_ReconstructFrame)) { // filter out all other changes for same content
     if (aContent) {
       PRInt32 index = mCount;
       while (0 < index--) {
         if (aContent == mArray[index].mContent) { // remove this change
           mCount--;
           if (index < mCount) { // move later changes down
Index: mozilla/layout/generic/nsBlockFrame.cpp
===================================================================
--- mozilla.orig/layout/generic/nsBlockFrame.cpp	2007-10-09 12:49:22.000000000 +0200
+++ mozilla/layout/generic/nsBlockFrame.cpp	2007-10-09 13:00:22.000000000 +0200
@@ -76,16 +76,17 @@
 #include "nsAutoPtr.h"
 #include "nsIServiceManager.h"
 #include "nsIScrollableFrame.h"
 #ifdef ACCESSIBILITY
 #include "nsIAccessibilityService.h"
 #endif
 #include "nsLayoutUtils.h"
 #include "nsBoxLayoutState.h"
+#include "nsCSSAnonBoxes.h"
 
 #ifdef IBMBIDI
 #include "nsBidiPresUtils.h"
 #endif // IBMBIDI
 
 #include "nsIDOMHTMLBodyElement.h"
 #include "nsIDOMHTMLHtmlElement.h"
 
@@ -7237,28 +7238,37 @@
   if (mAbsoluteContainer.GetChildListName() == aListName) {
     mAbsoluteContainer.SetInitialChildList(this, aPresContext, aListName, aChildList);
   }
   else if (nsLayoutAtoms::floatList == aListName) {
     mFloats.SetFrames(aChildList);
   }
   else {
 
-    // Lookup up the two pseudo style contexts
-    if (nsnull == mPrevInFlow) {
-      nsRefPtr<nsStyleContext> firstLetterStyle = GetFirstLetterStyle(aPresContext);
-      if (nsnull != firstLetterStyle) {
-        mState |= NS_BLOCK_HAS_FIRST_LETTER_STYLE;
-#ifdef NOISY_FIRST_LETTER
-        ListTag(stdout);
-        printf(": first-letter style found\n");
+#ifdef DEBUG
+    // The only times a block that is an anonymous box is allowed to have a
+    // first-letter frame are when it's the block inside a non-anonymous cell,
+    // the block inside a fieldset, a scrolled content block, or a column
+    // content block.  Also, a block that has a previous continuation can't
+    // have a first letter frame.
+    nsIAtom *pseudo = GetStyleContext()->GetPseudoType();
+    PRBool haveFirstLetterStyle =
+      !mPrevInFlow &&
+      (!pseudo ||
+       (pseudo == nsCSSAnonBoxes::cellContent &&
+        mParent->GetStyleContext()->GetPseudoType() == nsnull) ||
+       pseudo == nsCSSAnonBoxes::fieldsetContent ||
+       pseudo == nsCSSAnonBoxes::scrolledContent ||
+       pseudo == nsCSSAnonBoxes::columnContent) &&
+      nsRefPtr<nsStyleContext>(GetFirstLetterStyle(aPresContext)) != nsnull;
+    NS_ASSERTION(haveFirstLetterStyle ==
+                 ((mState & NS_BLOCK_HAS_FIRST_LETTER_STYLE) != 0),
+                 "NS_BLOCK_HAS_FIRST_LETTER_STYLE state out of sync");
 #endif
-      }
-    }
-
+    
     rv = AddFrames(aChildList, nsnull);
     if (NS_FAILED(rv)) {
       return rv;
     }
 
     // Create list bullet if this is a list-item. Note that this is done
     // here so that RenumberLists will work (it needs the bullets to
     // store the bullet numbers).
Index: mozilla/layout/generic/nsBlockFrame.h
===================================================================
--- mozilla.orig/layout/generic/nsBlockFrame.h	2007-10-09 12:49:22.000000000 +0200
+++ mozilla/layout/generic/nsBlockFrame.h	2007-10-09 13:00:22.000000000 +0200
@@ -291,22 +291,24 @@
 
   PRBool HandleOverflowPlaceholdersOnPulledLine(
     nsBlockReflowState& aState, nsLineBox* aLine);
 
 protected:
   nsBlockFrame();
   virtual ~nsBlockFrame();
 
+#ifdef DEBUG
   already_AddRefed<nsStyleContext> GetFirstLetterStyle(nsPresContext* aPresContext)
   {
     return aPresContext->StyleSet()->
       ProbePseudoStyleFor(mContent,
                           nsCSSPseudoElements::firstLetter, mStyleContext);
   }
+#endif
 
   /*
    * Overides member function of nsHTMLContainerFrame. Needed to handle the 
    * lines in a nsBlockFrame properly.
    */
   virtual void PaintTextDecorationLines(nsIRenderingContext& aRenderingContext,
                                         nscolor aColor,
                                         nscoord aOffset,
Index: mozilla/layout/generic/nsContainerFrame.cpp
===================================================================
--- mozilla.orig/layout/generic/nsContainerFrame.cpp	2007-10-09 12:49:22.000000000 +0200
+++ mozilla/layout/generic/nsContainerFrame.cpp	2007-10-09 13:00:22.000000000 +0200
@@ -143,23 +143,27 @@
 nsContainerFrame::Destroy(nsPresContext* aPresContext)
 {
   // Prevent event dispatch during destruction
   if (HasView()) {
     GetView()->SetClientData(nsnull);
   }
 
   if (mState & NS_FRAME_GENERATED_CONTENT) {
-    // Make sure all the content nodes for the generated content inside
-    // this frame know it's going away.
-    // XXXbz would this be better done via a global structure in
-    // nsCSSFrameConstructor that could key off of
-    // GeneratedContentFrameRemoved or something?  The problem is that
-    // our kids are gone by the time that's called.
-    ::CleanupGeneratedContentIn(mContent, this);
+    nsIAtom* type = GetType();
+    if (type == nsLayoutAtoms::inlineFrame ||
+        type== nsLayoutAtoms::blockFrame) {
+      // Make sure all the content nodes for the generated content inside
+      // this frame know it's going away.
+      // XXXbz would this be better done via a global structure in
+      // nsCSSFrameConstructor that could key off of
+      // GeneratedContentFrameRemoved or something?  The problem is that
+      // our kids are gone by the time that's called.
+      ::CleanupGeneratedContentIn(mContent, this);
+    }
   }
   
   // Delete the primary child list
   mFrames.DestroyFrames(aPresContext);
   
   // Destroy overflow frames now
   nsFrameList overflowFrames(GetOverflowFrames(aPresContext, PR_TRUE));
   overflowFrames.DestroyFrames(aPresContext);
Index: mozilla/layout/generic/nsTextFrame.cpp
===================================================================
--- mozilla.orig/layout/generic/nsTextFrame.cpp	2007-10-09 12:49:22.000000000 +0200
+++ mozilla/layout/generic/nsTextFrame.cpp	2007-10-09 13:00:22.000000000 +0200
@@ -948,16 +948,19 @@
 
 NS_IMETHODIMP
 nsContinuingTextFrame::Init(nsPresContext*  aPresContext,
                             nsIContent*      aContent,
                             nsIFrame*        aParent,
                             nsStyleContext*  aContext,
                             nsIFrame*        aPrevInFlow)
 {
+  NS_PRECONDITION(aContent->IsContentOfType(nsIContent::eTEXT),
+                  "Bogus content!");
+
   nsresult  rv;
   
   rv = nsTextFrame::Init(aPresContext, aContent, aParent, aContext, aPrevInFlow);
 
   if (aPrevInFlow) {
     // Hook the frame into the flow
     mPrevInFlow = aPrevInFlow;
     aPrevInFlow->SetNextInFlow(this);
@@ -6561,16 +6564,17 @@
   fprintf(out, " {%d,%d,%d,%d}", mRect.x, mRect.y, mRect.width, mRect.height);
   if (0 != mState) {
     if (mState & NS_FRAME_SELECTED_CONTENT) {
       fprintf(out, " [state=%08x] SELECTED", mState);
     } else {
       fprintf(out, " [state=%08x]", mState);
     }
   }
+  fprintf(out, " [content=%p]", NS_STATIC_CAST(void*, mContent));
   fprintf(out, " sc=%p", NS_STATIC_CAST(void*, mStyleContext));
   nsIAtom* pseudoTag = mStyleContext->GetPseudoType();
   if (pseudoTag) {
     nsAutoString atomString;
     pseudoTag->ToString(atomString);
     fprintf(out, " pst=%s",
             NS_LossyConvertUCS2toASCII(atomString).get());
   }

mozilla-372309.patch:

--- NEW FILE mozilla-372309.patch ---
---
 js/src/jsarray.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

Index: mozilla/js/src/jsarray.c
===================================================================
--- mozilla.orig/js/src/jsarray.c	2007-10-09 18:05:26.000000000 +0200
+++ mozilla/js/src/jsarray.c	2007-10-09 18:05:46.000000000 +0200
@@ -1891,19 +1891,24 @@
     if (!proto || !InitArrayObject(cx, proto, 0, NULL))
         return NULL;
     return proto;
 }
 
 JSObject *
 js_NewArrayObject(JSContext *cx, jsuint length, jsval *vector)
 {
+    JSTempValueRooter tvr;
     JSObject *obj;
 
     obj = js_NewObject(cx, &js_ArrayClass, NULL, NULL);
     if (!obj)
         return NULL;
-    if (!InitArrayObject(cx, obj, length, vector)) {
-        cx->weakRoots.newborn[GCX_OBJECT] = NULL;
-        return NULL;
-    }
+
+    JS_PUSH_TEMP_ROOT_OBJECT(cx, obj, &tvr);
+    if (!InitArrayObject(cx, obj, length, vector))
+        obj = NULL;
+    JS_POP_TEMP_ROOT(cx, &tvr);
+
+    /* Set/clear newborn root, in case we lost it.  */
+    cx->weakRoots.newborn[GCX_OBJECT] = (JSGCThing *) obj;
     return obj;
 }

mozilla-378787.patch:

--- NEW FILE mozilla-378787.patch ---
---
 netwerk/protocol/http/src/nsHttpDigestAuth.cpp |   82 +++++++++++++++++++++----
 netwerk/protocol/http/src/nsHttpDigestAuth.h   |    4 +
 2 files changed, 73 insertions(+), 13 deletions(-)

Index: mozilla/netwerk/protocol/http/src/nsHttpDigestAuth.cpp
===================================================================
--- mozilla.orig/netwerk/protocol/http/src/nsHttpDigestAuth.cpp	2007-10-09 18:13:40.000000000 +0200
+++ mozilla/netwerk/protocol/http/src/nsHttpDigestAuth.cpp	2007-10-09 18:13:54.000000000 +0200
@@ -337,57 +337,78 @@
 
   rv = CalculateHA2(httpMethod, path, qop, upload_data_digest, ha2_digest);
   if (NS_FAILED(rv)) return rv;
 
   rv = CalculateResponse(ha1_digest, ha2_digest, nonce, qop, nonce_count,
                          cnonce, response_digest);
   if (NS_FAILED(rv)) return rv;
 
+  //
+  // Values that need to match the quoted-string production from RFC 2616:
+  //
+  //    username
+  //    realm
+  //    nonce
+  //    opaque
+  //    cnonce
+  //
+
   nsCAutoString authString;
-  authString.AssignLiteral("Digest username=\"");
-  authString += cUser;
-  authString.AppendLiteral("\", realm=\"");
-  authString += realm;
-  authString.AppendLiteral("\", nonce=\"");
-  authString += nonce;
-  authString.AppendLiteral("\", uri=\"");
+
+  authString.AssignLiteral("Digest username=");
+  rv = AppendQuotedString(cUser, authString);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  authString.AppendLiteral(", realm=");
+  rv = AppendQuotedString(realm, authString);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  authString.AppendLiteral(", nonce=");
+  rv = AppendQuotedString(nonce, authString);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  authString.AppendLiteral(", uri=\"");
   authString += path;
   if (algorithm & ALGO_SPECIFIED) {
     authString.AppendLiteral("\", algorithm=");
     if (algorithm & ALGO_MD5_SESS)
       authString.AppendLiteral("MD5-sess");
     else
       authString.AppendLiteral("MD5");
   } else {
     authString += '\"';
   }
   authString.AppendLiteral(", response=\"");
   authString += response_digest;
+  authString += '\"';
 
   if (!opaque.IsEmpty()) {
-    authString.AppendLiteral("\", opaque=\"");
-    authString += opaque;
+    authString.AppendLiteral(", opaque=");
+    rv = AppendQuotedString(opaque, authString);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
   if (qop) {
-    authString.AppendLiteral("\", qop=");
+    authString.AppendLiteral(", qop=");
     if (requireExtraQuotes)
       authString += '\"';
     authString.AppendLiteral("auth");
     if (qop & QOP_AUTH_INT)
       authString.AppendLiteral("-int");
     if (requireExtraQuotes)
       authString += '\"';
     authString.AppendLiteral(", nc=");
     authString += nonce_count;
-    authString.AppendLiteral(", cnonce=\"");
-    authString += cnonce;
+
+    authString.AppendLiteral(", cnonce=");
+    rv = AppendQuotedString(cnonce, authString);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
-  authString += '\"';
+
 
   *creds = ToNewCString(authString);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHttpDigestAuth::GetAuthFlags(PRUint32 *flags)
 {
@@ -668,9 +689,44 @@
             nsCRT::strncasecmp(challenge+algostart, "auth-int", 8) == 0)
           *qop |= QOP_AUTH_INT;
       }
     }
   }
   return NS_OK;
 }
 
+nsresult
+nsHttpDigestAuth::AppendQuotedString(const nsACString & value,
+                                     nsACString & aHeaderLine)
+{
+  nsCAutoString quoted;
+  nsACString::const_iterator s, e;
+  value.BeginReading(s);
+  value.EndReading(e);
+
+  //
+  // Encode string according to RFC 2616 quoted-string production
+  //
+  quoted.Append('"');
+  for ( ; s != e; ++s) {
+    //
+    // CTL = <any US-ASCII control character (octets 0 - 31) and DEL (127)>
+    //
+    if (*s <= 31 || *s == 127) {
+      return NS_ERROR_FAILURE;
+    }
+
+    // Escape two syntactically significant characters
+    if (*s == '"' || *s == '\\') {
+      quoted.Append('\\');
+    }
+
+    quoted.Append(*s);
+  }
+  // FIXME: bug 41489
+  // We should RFC2047-encode non-Latin-1 values according to spec
+  quoted.Append('"');
+  aHeaderLine.Append(quoted);
+  return NS_OK;
+}
+
 // vim: ts=2 sw=2
Index: mozilla/netwerk/protocol/http/src/nsHttpDigestAuth.h
===================================================================
--- mozilla.orig/netwerk/protocol/http/src/nsHttpDigestAuth.h	2007-10-09 18:13:40.000000000 +0200
+++ mozilla/netwerk/protocol/http/src/nsHttpDigestAuth.h	2007-10-09 18:13:58.000000000 +0200
@@ -104,15 +104,19 @@
                             PRUint16 * algorithm,
                             PRUint16 * qop);
 
     // result is in mHashBuf
     nsresult MD5Hash(const char *buf, PRUint32 len);
 
     nsresult GetMethodAndPath(nsIHttpChannel *, PRBool, nsCString &, nsCString &);
 
+    // append the quoted version of value to aHeaderLine
+    nsresult AppendQuotedString(const nsACString & value,
+                                nsACString & aHeaderLine);
+
   protected:
     nsCOMPtr<nsICryptoHash>        mVerifier;
     char                           mHashBuf[DIGEST_LENGTH];
     PRBool                         mGotVerifier;
 };
 
 #endif // nsHttpDigestAuth_h__

mozilla-384105.patch:

--- NEW FILE mozilla-384105.patch ---
---
 layout/xul/base/src/nsMenuFrame.cpp |   53 +++++++++++++++++++++++++++++++++---
 1 file changed, 49 insertions(+), 4 deletions(-)

Index: mozilla/layout/xul/base/src/nsMenuFrame.cpp
===================================================================
--- mozilla.orig/layout/xul/base/src/nsMenuFrame.cpp	2007-10-09 18:25:33.000000000 +0200
+++ mozilla/layout/xul/base/src/nsMenuFrame.cpp	2007-10-09 18:25:54.000000000 +0200
@@ -694,27 +694,72 @@
     if (genVal.IsEmpty()) {
       child->SetAttr(kNameSpaceID_None, nsXULAtoms::menugenerated, NS_LITERAL_STRING("true"), PR_TRUE);
     }
   }
 
   return NS_OK;
 }
 
+struct nsASyncUngenerate : public PLEvent
+{
+  nsASyncUngenerate(nsIContent* aContent)
+    : mContent(aContent)
+  {
+  }
+
+  void HandleEvent() {
+    nsAutoString genVal;
+    mContent->GetAttr(kNameSpaceID_None, nsXULAtoms::menugenerated, genVal);
+    if (!genVal.IsEmpty()) {
+      mContent->UnsetAttr(kNameSpaceID_None, nsXULAtoms::menugenerated,
+                          PR_TRUE);
+    }
+  }
+
+  nsCOMPtr<nsIContent> mContent;
+};
+
+static void* PR_CALLBACK HandleASyncUngenerate(PLEvent* aEvent)
+{
+  NS_STATIC_CAST(nsASyncUngenerate*, aEvent)->HandleEvent();
+  return nsnull;
+}
+
+static void PR_CALLBACK DestroyASyncUngenerate(PLEvent* aEvent)
+{
+  delete NS_STATIC_CAST(nsASyncUngenerate*, aEvent);
+}
+
 NS_IMETHODIMP
 nsMenuFrame::UngenerateMenu()
 {
   nsCOMPtr<nsIContent> child;
   GetMenuChildrenElement(getter_AddRefs(child));
   
   if (child) {
-    nsAutoString genVal;
-    child->GetAttr(kNameSpaceID_None, nsXULAtoms::menugenerated, genVal);
-    if (!genVal.IsEmpty())
-      child->UnsetAttr(kNameSpaceID_None, nsXULAtoms::menugenerated, PR_TRUE);
+    nsCOMPtr<nsIEventQueueService> eventService =
+      do_GetService(kEventQueueServiceCID);
+    if (eventService) {
+      nsCOMPtr<nsIEventQueue> eventQueue;
+        eventService->GetThreadEventQueue(PR_GetCurrentThread(),
+                                          getter_AddRefs(eventQueue));
+      if (eventQueue) {
+        nsASyncUngenerate* ungenerate =
+          new nsASyncUngenerate(child);
+        if (ungenerate) {
+          PL_InitEvent(ungenerate, nsnull,
+                       ::HandleASyncUngenerate,
+                       ::DestroyASyncUngenerate);
+          if (NS_FAILED(eventQueue->PostEvent(ungenerate))) {
+            PL_DestroyEvent(ungenerate);
+          }
+        }
+      }
+    }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsMenuFrame::ActivateMenu(PRBool aActivateFlag)
 {

mozilla-386914.patch:

--- NEW FILE mozilla-386914.patch ---
---
 content/xul/document/src/nsXULDocument.cpp |   33 ++++++++++++++++-------------
 1 file changed, 19 insertions(+), 14 deletions(-)

Index: mozilla/content/xul/document/src/nsXULDocument.cpp
===================================================================
--- mozilla.orig/content/xul/document/src/nsXULDocument.cpp	2007-10-09 18:35:19.000000000 +0200
+++ mozilla/content/xul/document/src/nsXULDocument.cpp	2007-10-09 18:35:37.000000000 +0200
@@ -1097,39 +1097,44 @@
                            PL_DHashTableOperate(mBroadcasterMap, domele.get(),
                                                 PL_DHASH_LOOKUP));
 
         if (PL_DHASH_ENTRY_IS_BUSY(entry)) {
             // We've got listeners: push the value.
             nsAutoString value;
             rv = aElement->GetAttr(kNameSpaceID_None, aAttribute, value);
 
-            for (PRInt32 i = entry->mListeners.Count() - 1; i >= 0; --i) {
+            nsCOMArray<nsIContent> listenerArray;
+            PRInt32 i;
+            for (i = entry->mListeners.Count() - 1; i >= 0; --i) {
                 BroadcastListener* bl =
                     NS_STATIC_CAST(BroadcastListener*, entry->mListeners[i]);
 
                 if ((bl->mAttribute == aAttribute) ||
                     (bl->mAttribute == nsXULAtoms::_star)) {
                     nsCOMPtr<nsIContent> listener
                         = do_QueryInterface(bl->mListener);
-
-                    if (rv == NS_CONTENT_ATTR_NO_VALUE ||
-                        rv == NS_CONTENT_ATTR_HAS_VALUE) {
-                        listener->SetAttr(kNameSpaceID_None, aAttribute, value,
-                                          PR_TRUE);
-                    }
-                    else {
-                        listener->UnsetAttr(kNameSpaceID_None, aAttribute,
-                                            PR_TRUE);
-                    }
-
-                    ExecuteOnBroadcastHandlerFor(aElement, bl->mListener,
-                                                 aAttribute);
+                    listenerArray.AppendObject(listener);
                 }
             }
+            for (i = 0; i < listenerArray.Count(); ++i) {
+                nsIContent* listener = listenerArray[i];
+                 if (rv == NS_CONTENT_ATTR_NO_VALUE ||
+                     rv == NS_CONTENT_ATTR_HAS_VALUE) {
+                     listener->SetAttr(kNameSpaceID_None, aAttribute, value,
+                                       PR_TRUE);
+                 }
+                 else {
+                     listener->UnsetAttr(kNameSpaceID_None, aAttribute,
+                                         PR_TRUE);
+                 }
+
+                nsCOMPtr<nsIDOMElement> listenerEl = do_QueryInterface(listener);
+                ExecuteOnBroadcastHandlerFor(aElement, listenerEl, aAttribute);
+            }
         }
     }
 
     // Now notify external observers
     NS_DOCUMENT_NOTIFY_OBSERVERS(AttributeChanged,
                                  (this, aElement, aNameSpaceID,
                                   aAttribute, aModType));
 

mozilla-387033.patch:

--- NEW FILE mozilla-387033.patch ---
---
 layout/xul/base/src/nsTextBoxFrame.cpp |   86 +++++++++++++++++++++++++--------
 layout/xul/base/src/nsTextBoxFrame.h   |    7 ++
 2 files changed, 73 insertions(+), 20 deletions(-)

Index: mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
===================================================================
--- mozilla.orig/layout/xul/base/src/nsTextBoxFrame.cpp	2007-10-09 18:48:08.000000000 +0200
+++ mozilla/layout/xul/base/src/nsTextBoxFrame.cpp	2007-10-09 18:49:59.000000000 +0200
@@ -63,16 +63,17 @@
 #include "nsIDocument.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMXULLabelElement.h"
 #include "nsIEventStateManager.h"
 #include "nsITheme.h"
 #include "nsUnicharUtils.h"
 #include "nsContentUtils.h"
+#include "nsIReflowCallback.h"
 
 #ifdef IBMBIDI
 #include "nsBidiUtils.h"
 #include "nsBidiPresUtils.h"
 #endif // IBMBIDI
 #include "nsReadableUtils.h"
 
 #define ELLIPSIS "..."
@@ -145,17 +146,19 @@
     // If the accesskey changed, register for the new value
     // The old value has been unregistered in nsXULElement::SetAttr
     if (aAttribute == nsXULAtoms::accesskey || aAttribute == nsXULAtoms::control)
         RegUnregAccessKey(presContext, PR_TRUE);
 
     return NS_OK;
 }
 
-nsTextBoxFrame::nsTextBoxFrame(nsIPresShell* aShell):nsLeafBoxFrame(aShell), mCropType(CropRight),mAccessKeyInfo(nsnull)
+nsTextBoxFrame::nsTextBoxFrame(nsIPresShell* aShell)
+  : nsLeafBoxFrame(aShell), mCropType(CropRight), mAccessKeyInfo(nsnull), 
+    mNeedsReflowCallback(PR_FALSE)
 {
     mState |= NS_STATE_NEED_LAYOUT;
     NeedsRecalc();
 }
 
 nsTextBoxFrame::~nsTextBoxFrame()
 {
     delete mAccessKeyInfo;
@@ -216,16 +219,68 @@
 
     const char* prefName = "intl.menuitems.insertseparatorbeforeaccesskeys";
     nsAdoptingString val = nsContentUtils::GetLocalizedStringPref(prefName);
     gInsertSeparatorBeforeAccessKey = val.EqualsLiteral("true");
   }
   return gInsertSeparatorBeforeAccessKey;
 }
 
+class nsAsyncAccesskeyUpdate : public nsIReflowCallback
+{
+public:
+    nsAsyncAccesskeyUpdate(nsIFrame* aFrame) : mWeakFrame(aFrame)
+    {
+    }
+
+    NS_DECL_ISUPPORTS
+
+    NS_IMETHOD ReflowFinished(nsIPresShell* aShell, PRBool* aFlushFlag)
+    {
+        nsTextBoxFrame* frame =
+            NS_STATIC_CAST(nsTextBoxFrame*, mWeakFrame.GetFrame());
+        if (frame && frame->UpdateAccesskey(mWeakFrame)) {
+            *aFlushFlag = PR_TRUE;
+        }
+        return NS_OK;
+    }
+
+    nsWeakFrame mWeakFrame;
+};
+
+NS_IMPL_ISUPPORTS1(nsAsyncAccesskeyUpdate, nsIReflowCallback)
+
+PRBool
+nsTextBoxFrame::UpdateAccesskey(nsWeakFrame& aWeakThis)
+{
+    nsAutoString accesskey;
+    nsCOMPtr<nsIDOMXULLabelElement> labelElement = do_QueryInterface(mContent);
+    if (labelElement) {
+        // Accesskey may be stored on control.
+        nsCxPusher cx(mContent);
+        labelElement->GetAccessKey(accesskey);
+        NS_ENSURE_TRUE(aWeakThis.IsAlive(), PR_FALSE);
+    }
+    else {
+        mContent->GetAttr(kNameSpaceID_None, nsXULAtoms::accesskey, accesskey);
+    }
+
+    if (!accesskey.Equals(mAccessKey)) {
+        // Need to get clean mTitle.
+        mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::value, mTitle);
+        mAccessKey = accesskey;
+        UpdateAccessTitle();
+        nsPresContext* presContext = GetPresContext();
+        nsBoxLayoutState state(presContext);
+        MarkDirty(state);
+        return PR_TRUE;
+    }
+    return PR_FALSE;
+}
+
 void
 nsTextBoxFrame::UpdateAttributes(nsPresContext*  aPresContext,
                                  nsIAtom*         aAttribute,
                                  PRBool&          aResize,
                                  PRBool&          aRedraw)
 {
     PRBool doUpdateTitle = PR_FALSE;
     aResize = PR_FALSE;
@@ -258,34 +313,19 @@
         mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::value, value);
         if (!value.Equals(mTitle)) {
             mTitle = value;
             doUpdateTitle = PR_TRUE;
         }
     }
 
     if (aAttribute == nsnull || aAttribute == nsXULAtoms::accesskey) {
-        nsAutoString accesskey;
-        nsCOMPtr<nsIDOMXULLabelElement> labelElement = do_QueryInterface(mContent);
-        if (labelElement) {
-          labelElement->GetAccessKey(accesskey);  // Accesskey may be stored on control
-        }
-        else {
-          mContent->GetAttr(kNameSpaceID_None, nsXULAtoms::accesskey, accesskey);
-        }
-        if (!accesskey.Equals(mAccessKey)) {
-            if (!doUpdateTitle) {
-                // Need to get clean mTitle and didn't already
-                nsAutoString value;
-                mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::value, value);
-                mTitle = value;
-                doUpdateTitle = PR_TRUE;
-            }
-            mAccessKey = accesskey;
-        }
+        mNeedsReflowCallback = PR_TRUE;
+        // Ensure that layout is refreshed and reflow callback called.
+        aResize = PR_TRUE;
     }
 
     if (doUpdateTitle) {
         UpdateAccessTitle();
         aResize = PR_TRUE;
     }
 
 }
@@ -795,16 +835,24 @@
                 mAccessKeyInfo->mAccesskeyIndex = kNotFound;
         }
     }
 }
 
 NS_IMETHODIMP
 nsTextBoxFrame::DoLayout(nsBoxLayoutState& aBoxLayoutState)
 {
+    if (mNeedsReflowCallback) {
+        nsCOMPtr<nsIReflowCallback> cb = new nsAsyncAccesskeyUpdate(this);
+        if (cb) {
+            GetPresContext()->PresShell()->PostReflowCallback(cb);
+        }
+        mNeedsReflowCallback = PR_FALSE;
+    }
+
     mState |= NS_STATE_NEED_LAYOUT;
 
     return nsLeafBoxFrame::DoLayout(aBoxLayoutState);
 }
 
 NS_IMETHODIMP
 nsTextBoxFrame::NeedsRecalc()
 {
Index: mozilla/layout/xul/base/src/nsTextBoxFrame.h
===================================================================
--- mozilla.orig/layout/xul/base/src/nsTextBoxFrame.h	2007-10-09 18:48:08.000000000 +0200
+++ mozilla/layout/xul/base/src/nsTextBoxFrame.h	2007-10-09 18:50:03.000000000 +0200
@@ -85,16 +85,20 @@
                    nsIRenderingContext& aRenderingContext,
                    const nsRect&        aDirtyRect,
                    nsFramePaintLayer    aWhichLayer,
                    PRUint32             aFlags = 0);
 
 
   virtual ~nsTextBoxFrame();
 protected:
+  friend class nsAsyncAccesskeyUpdate;
+  // Should be called only by nsAsyncAccesskeyUpdate.
+  // Returns PR_TRUE if accesskey was updated.
+  PRBool UpdateAccesskey(nsWeakFrame& aWeakThis);
 
   void UpdateAccessTitle();
   void UpdateAccessIndex();
 
   NS_IMETHOD PaintTitle(nsPresContext*      aPresContext,
                         nsIRenderingContext& aRenderingContext,
                         const nsRect&        aDirtyRect,
                         const nsRect&        aRect);
@@ -128,17 +132,18 @@
   PRBool InsertSeparatorBeforeAccessKey();
 
   CroppingStyle mCropType;
   nsString mTitle;
   nsString mCroppedTitle;
   nsString mAccessKey;
   nscoord mTitleWidth;
   nsAccessKeyInfo* mAccessKeyInfo;
-  PRBool mNeedsRecalc;
+  PRPackedBool mNeedsRecalc;
+  PRPackedBool mNeedsReflowCallback;
   nsSize mTextSize;
   nscoord mAscent;
 
   static PRBool gAlwaysAppendAccessKey;
   static PRBool gAccessKeyPrefInitialized;
   static PRBool gInsertSeparatorBeforeAccessKey;
   static PRBool gInsertSeparatorPrefInitialized;
 

mozilla-387881.patch:

--- NEW FILE mozilla-387881.patch ---
---
 js/src/jsscript.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

Index: mozilla/js/src/jsscript.c
===================================================================
--- mozilla.orig/js/src/jsscript.c	2007-10-09 18:58:04.000000000 +0200
+++ mozilla/js/src/jsscript.c	2007-10-09 19:03:36.000000000 +0200
@@ -223,19 +223,27 @@
     fp = cx->fp;
     caller = JS_GetScriptedCaller(cx, fp);
     JS_ASSERT(!caller || fp->scopeChain == caller->scopeChain);
 
     if (caller) {
         if (!scopeobj)
             scopeobj = caller->scopeChain;
 
-        file = caller->script->filename;
-        line = js_PCToLineNumber(cx, caller->script, caller->pc);
+        if (!scopeobj)
+            return JS_FALSE;
+
         principals = JS_EvalFramePrincipals(cx, fp, caller);
+        if (principals == caller->script->principals) {
+            file = caller->script->filename;
+            line = js_PCToLineNumber(cx, caller->script, caller->pc);
+        } else {
+            file = principals->codebase;
+            line = 0;
+        }
     } else {
         file = NULL;
         line = 0;
         principals = NULL;
     }
 
     /* Ensure we compile this script with the right (inner) principals. */
     scopeobj = js_CheckScopeChainValidity(cx, scopeobj, js_script_compile);

mozilla-388121.patch:

--- NEW FILE mozilla-388121.patch ---
---
 content/base/src/nsFrameLoader.cpp                         |   31 ++-----
 docshell/base/nsDocShell.cpp                               |   51 +++++++------
 embedding/components/windowwatcher/src/nsWindowWatcher.cpp |   11 ++
 3 files changed, 52 insertions(+), 41 deletions(-)

Index: mozilla/content/base/src/nsFrameLoader.cpp
===================================================================
--- mozilla.orig/content/base/src/nsFrameLoader.cpp	2007-10-09 19:22:51.000000000 +0200
+++ mozilla/content/base/src/nsFrameLoader.cpp	2007-10-09 19:23:15.000000000 +0200
@@ -155,37 +155,26 @@
   rv = CheckForRecursiveLoad(uri);
   NS_ENSURE_SUCCESS(rv, rv);
   
   // Is our principal the system principal?
   nsCOMPtr<nsIPrincipal> sysPrin;
   rv = secMan->GetSystemPrincipal(getter_AddRefs(sysPrin));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (principal == sysPrin) {
-    // We're a chrome node.  Belt and braces -- inherit the principal for this
-    // load instead of just forcing the system principal.  That way if we have
-    // something loaded already the principal used will be that of what we
-    // already have loaded.
-
-    // XXX bz I'd love to nix this, but the problem is chrome calling
-    // setAttribute() on an iframe or browser and passing in a javascript: URI.
-    // We probably don't want to run that with chrome privileges... Though in
-    // similar circumstances, if one sets window.location.href from chrome we
-    // _do_ run that with chrome privileges, so maybe we should do the same
-    // here?
-    loadInfo->SetInheritOwner(PR_TRUE);
-
-    // Also, in this case we don't set a referrer, just in case.
-  } else {
-    // We'll use our principal, not that of the document loaded inside us.
-    // This is very important; needed to prevent XSS attacks on documents
-    // loaded in subframes!
-    loadInfo->SetOwner(principal);
-
+  // We'll use our principal, not that of the document loaded inside us.
+  // This is very important; needed to prevent XSS attacks on documents
+  // loaded in subframes!  Note that if |principal == sysPrin| the
+  // situation is handled by nsDocShell::LoadURI.
+  loadInfo->SetOwner(principal);
+
+  // Don't set referrer if we're the system principal.
+  // XXXbz not like it matters -- the URI of the system principal is
+  // null on branch...
+  if (principal != sysPrin) {
     nsCOMPtr<nsIURI> referrer;  
     rv = principal->GetURI(getter_AddRefs(referrer));
     NS_ENSURE_SUCCESS(rv, rv);
 
     loadInfo->SetReferrer(referrer);
   }
 
   // Kick off the load...
Index: mozilla/docshell/base/nsDocShell.cpp
===================================================================
--- mozilla.orig/docshell/base/nsDocShell.cpp	2007-10-09 19:22:51.000000000 +0200
+++ mozilla/docshell/base/nsDocShell.cpp	2007-10-09 19:23:09.000000000 +0200
@@ -760,41 +760,52 @@
         PR_LOG(gDocShellLog, PR_LOG_DEBUG,
               ("nsDocShell[%p]: loading from session history", this));
 #endif
 
         rv = LoadHistoryEntry(shEntry, loadType);
     }
     // Perform the load...
     else {
-        // We need an owner (a referring principal). 3 possibilities:
-        // (1) If a principal was passed in, that's what we'll use.
-        // (2) If the caller has allowed inheriting from the current document,
-        //   or if we're being called from chrome (if there's system JS on the stack),
-        //   then inheritOwner should be true and InternalLoad will get an owner
-        //   from the current document. If none of these things are true, then
-        // (3) we pass a null owner into the channel, and an owner will be
-        //   created later from the URL.
-        if (!owner && !inheritOwner) {
-            // See if there's system or chrome JS code running
-            nsCOMPtr<nsIScriptSecurityManager> secMan;
+        // We need an owner (a referring principal). 4 possibilities:
+        // (1) If the system principal was passed in and we're a typeContent
+        //     docshell, inherit the principal from the current document
+        //     instead.
+        // (2) In all other cases when the principal passed in is not null,
+        //     use that principal.
+        // (3) If the caller has allowed inheriting from the current
+        //     document, or if we're being called from chrome (if there's
+        //     system JS on the stack), then inheritOwner should be true and
+        //     InternalLoad will get an owner from the current document. If
+        //     none of these things are true, then
+        // (4) we pass a null owner into the channel, and an owner will be
+        //     created later from the channel's internal data.
+        nsCOMPtr<nsIScriptSecurityManager> secMan =
+            do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+        NS_ENSURE_SUCCESS(rv, rv);
 
-            secMan = do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+        // Just to compare, not to use!
+        nsCOMPtr<nsIPrincipal> sysPrin;
+        rv = secMan->GetSystemPrincipal(getter_AddRefs(sysPrin));
+        NS_ENSURE_SUCCESS(rv, rv);
+        
+        if (owner == sysPrin && mItemType != typeChrome) {
+            owner = nsnull;
+            inheritOwner = PR_TRUE;
+        }
+        else if (!owner && !inheritOwner) {
+            // See if there's system or chrome JS code running
             if (NS_SUCCEEDED(rv)) {
-                nsCOMPtr<nsIPrincipal> sysPrin;
                 nsCOMPtr<nsIPrincipal> subjectPrin;
 
-                // Just to compare, not to use!
-                rv = secMan->GetSystemPrincipal(getter_AddRefs(sysPrin));
-                if (NS_SUCCEEDED(rv)) {
-                    rv = secMan->GetSubjectPrincipal(getter_AddRefs(subjectPrin));
-                }
-                // If there's no subject principal, there's no JS running, so we're in system code.
+                rv = secMan->GetSubjectPrincipal(getter_AddRefs(subjectPrin));
+                // If there's no subject principal, there's no JS running, so
+                // we're in system code.
                 if (NS_SUCCEEDED(rv) &&
-                    (!subjectPrin || sysPrin.get() == subjectPrin.get())) {
+                    (!subjectPrin || sysPrin == subjectPrin)) {
                     inheritOwner = PR_TRUE;
                 }
             }
         }
 
         PRUint32 flags = 0;
 
         if (inheritOwner)
Index: mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
===================================================================
--- mozilla.orig/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2007-10-09 19:22:51.000000000 +0200
+++ mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2007-10-09 19:23:12.000000000 +0200
@@ -772,16 +772,27 @@
     nsIPrincipal* newWindowPrincipal = subjectPrincipal;
     if (!newWindowPrincipal && aParent) {
       nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(aParent));
       if (sop) {
         newWindowPrincipal = sop->GetPrincipal();
       }
     }
 
+    nsCOMPtr<nsIPrincipal> systemPrincipal;
+    sm->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
+    if (newWindowPrincipal == systemPrincipal) {
+      // Don't pass this principal along to content windows
+      PRInt32 itemType;
+      rv = newDocShellItem->GetItemType(&itemType);
+      if (NS_FAILED(rv) || itemType != nsIDocShellTreeItem::typeChrome) {
+        newWindowPrincipal = nsnull;        
+      }
+    }
+
     nsCOMPtr<nsPIDOMWindow_MOZILLA_1_8_BRANCH2> newWindow =
       do_QueryInterface(*_retval);
 #ifdef DEBUG
     nsCOMPtr<nsPIDOMWindow> newDebugWindow = do_GetInterface(newDocShell);
     NS_ASSERTION(newWindow == newDebugWindow, "Different windows??");
 #endif
     if (newWindow) {
       newWindow->SetOpenerScriptPrincipal(newWindowPrincipal);

mozilla-388784.patch:

--- NEW FILE mozilla-388784.patch ---
---
 content/html/content/src/nsHTMLLabelElement.cpp |   34 +++++++++++++++++++++---
 1 file changed, 30 insertions(+), 4 deletions(-)

Index: mozilla/content/html/content/src/nsHTMLLabelElement.cpp
===================================================================
--- mozilla.orig/content/html/content/src/nsHTMLLabelElement.cpp	2007-10-11 12:50:48.000000000 +0200
+++ mozilla/content/html/content/src/nsHTMLLabelElement.cpp	2007-10-11 12:51:10.000000000 +0200
@@ -46,17 +46,17 @@
 #include "nsIForm.h"
 #include "nsIDOMHTMLDocument.h"
 #include "nsIDOMXULDocument.h"
 #include "nsIDocument.h"
 #include "nsIFormControlFrame.h"
 #include "nsIPresShell.h"
 #include "nsGUIEvent.h"
 #include "nsIEventStateManager.h"
-
+#include "nsIDOMHTMLInputElement.h"
 
 class nsHTMLLabelElement : public nsGenericHTMLFormElement,
                            public nsIDOMHTMLLabelElement
 {
 public:
   nsHTMLLabelElement(nsINodeInfo *aNodeInfo);
   virtual ~nsHTMLLabelElement();
 
@@ -67,16 +67,19 @@
   NS_FORWARD_NSIDOMNODE_NO_CLONENODE(nsGenericHTMLFormElement::)
 
   // nsIDOMElement
   NS_FORWARD_NSIDOMELEMENT(nsGenericHTMLFormElement::)
 
   // nsIDOMHTMLElement
   NS_FORWARD_NSIDOMHTMLELEMENT(nsGenericHTMLFormElement::)
 
+  // nsIDOMNSHTMLElement
+  NS_IMETHOD Focus();
+
   // nsIDOMHTMLLabelElement
   NS_DECL_NSIDOMHTMLLABELELEMENT
 
   // nsIFormControl
   NS_IMETHOD_(PRInt32) GetType() const { return NS_FORM_LABEL; }
   NS_IMETHOD Reset();
   NS_IMETHOD SubmitNamesValues(nsIFormSubmission* aFormSubmission,
                                nsIContent* aSubmitElement);
@@ -103,28 +106,30 @@
   virtual nsresult UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
                              PRBool aNotify);
 
 protected:
   already_AddRefed<nsIContent> GetForContent();
   already_AddRefed<nsIContent> GetFirstFormControl(nsIContent *current);
 
   // XXX It would be nice if we could use an event flag instead.
-  PRBool mHandlingEvent;
+  PRPackedBool mHandlingEvent;
+  PRPackedBool mFocusCalled;
 };
 
 // construction, destruction
 
 
 NS_IMPL_NS_NEW_HTML_ELEMENT(Label)
 
 
 nsHTMLLabelElement::nsHTMLLabelElement(nsINodeInfo *aNodeInfo)
   : nsGenericHTMLFormElement(aNodeInfo),
-    mHandlingEvent(PR_FALSE)
+    mHandlingEvent(PR_FALSE),
+    mFocusCalled(PR_FALSE)
 {
 }
 
 nsHTMLLabelElement::~nsHTMLLabelElement()
 {
 }
 
 // nsISupports 
@@ -268,24 +273,45 @@
         }
         break;
     }
     mHandlingEvent = PR_FALSE;
   }
   return rv;
 }
 
+nsresult
+nsHTMLLabelElement::Focus()
+{
+  PRBool oldFocusCalled = mFocusCalled;
+  mFocusCalled = PR_TRUE;
+  nsresult rv = nsGenericHTMLFormElement::Focus();
+  mFocusCalled = oldFocusCalled;
+  return rv;
+}
+
 void
 nsHTMLLabelElement::SetFocus(nsPresContext* aContext)
 {
   // Since we don't have '-moz-user-focus: normal', the only time
   // |SetFocus| will be called is when the accesskey is activated.
   nsCOMPtr<nsIContent> content = GetForContent();
-  if (content)
+  if (content) {
+    if (mFocusCalled) {
+      // Handle input element in a special way, so that focusing
+      // <input type="file"> doesn't focus the input field but the
+      // 'browse...' button.
+      nsCOMPtr<nsIDOMHTMLInputElement> input = do_QueryInterface(content);
+      if (input) {
+        input->Focus();
+        return;
+      }
+    }
     content->SetFocus(aContext);
+  }
 }
 
 nsresult
 nsHTMLLabelElement::Reset()
 {
   return NS_OK;
 }
 

mozilla-390078.patch:

--- NEW FILE mozilla-390078.patch ---
---
 js/src/jsgc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: mozilla/js/src/jsgc.c
===================================================================
--- mozilla.orig/js/src/jsgc.c	2007-10-11 13:29:44.000000000 +0200
+++ mozilla/js/src/jsgc.c	2007-10-11 13:31:23.000000000 +0200
@@ -1767,17 +1767,17 @@
                 GC_MARK(cx, fp->thisp, "this", NULL);
                 if (fp->argv) {
                     nslots = fp->argc;
                     if (fp->fun) {
                         if (fp->fun->nargs > nslots)
                             nslots = fp->fun->nargs;
                         nslots += fp->fun->extra;
                     }
-                    GC_MARK_JSVALS(cx, nslots, fp->argv, "arg");
+                    GC_MARK_JSVALS(cx, nslots + 2, fp->argv - 2, "arg");
                 }
                 if (JSVAL_IS_GCTHING(fp->rval))
                     GC_MARK(cx, JSVAL_TO_GCTHING(fp->rval), "rval", NULL);
                 if (fp->vars)
                     GC_MARK_JSVALS(cx, fp->nvars, fp->vars, "var");
                 GC_MARK(cx, fp->scopeChain, "scope chain", NULL);
                 if (fp->sharpArray)
                     GC_MARK(cx, fp->sharpArray, "sharp array", NULL);

mozilla-392149-180.patch:

--- NEW FILE mozilla-392149-180.patch ---
--- mozilla/toolkit/xre/nsAppRunner.cpp.old	2006-11-09 21:55:12.000000000 +0100
+++ mozilla/toolkit/xre/nsAppRunner.cpp	2007-10-17 17:41:20.000000000 +0200
@@ -299,6 +299,12 @@ strimatch(const char* lowerstr, const ch
   return PR_TRUE;
 }
 
+enum RemoteResult {
+  REMOTE_NOT_FOUND  = 0,
+  REMOTE_FOUND      = 1,
+  REMOTE_ARG_BAD    = 2
+};
+
 enum ArgResult {
   ARG_NONE  = 0,
   ARG_FOUND = 1,
@@ -978,7 +984,7 @@ HandleRemoteArgument(const char* remote)
   return 0;
 }
 
-static PRBool
+static RemoteResult
 RemoteCommandLine()
 {
   nsresult rv;
@@ -992,7 +998,7 @@ RemoteCommandLine()
   ar = CheckArg("a", &temp);
   if (ar == ARG_BAD) {
     PR_fprintf(PR_STDERR, "Error: argument -a requires an application name\n");
-    return PR_FALSE;
+    return REMOTE_ARG_BAD;
   } else if (ar == ARG_FOUND) {
     program.Assign(temp);
   }
@@ -1000,13 +1006,13 @@ RemoteCommandLine()
   ar = CheckArg("u", &username);
   if (ar == ARG_BAD) {
     PR_fprintf(PR_STDERR, "Error: argument -u requires a username\n");
-    return PR_FALSE;
+    return REMOTE_ARG_BAD;
   }
 
   XRemoteClient client;
   rv = client.Init();
   if (NS_FAILED(rv))
-    return PR_FALSE;
+    return REMOTE_NOT_FOUND;
  
   nsXPIDLCString response;
   PRBool success = PR_FALSE;
@@ -1015,9 +1021,9 @@ RemoteCommandLine()
                               getter_Copies(response), &success);
   // did the command fail?
   if (NS_FAILED(rv) || !success)
-    return PR_FALSE;
+    return REMOTE_NOT_FOUND;
 
-  return PR_TRUE;
+  return REMOTE_FOUND;
 }
 #endif // MOZ_ENABLE_XREMOTE
 
@@ -2068,8 +2074,11 @@ XRE_main(int argc, char* argv[], const n
 
   if (!PR_GetEnv("MOZ_NO_REMOTE")) {
     // Try to remote the entire command line. If this fails, start up normally.
-    if (RemoteCommandLine())
+    RemoteResult rr = RemoteCommandLine();
+    if (rr == REMOTE_FOUND)
       return 0;
+    else if (rr == REMOTE_ARG_BAD)
+      return 1;
   }
 #endif
 

mozilla-393537.patch:

--- NEW FILE mozilla-393537.patch ---
---
 js/src/jsopcode.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

Index: mozilla/js/src/jsopcode.c
===================================================================
--- mozilla.orig/js/src/jsopcode.c	2007-10-11 13:38:41.000000000 +0200
+++ mozilla/js/src/jsopcode.c	2007-10-11 13:38:52.000000000 +0200
@@ -351,25 +351,29 @@
 
 #define OFF2STR(sp,off) ((sp)->base + (off))
 #define STR2OFF(sp,str) ((str) - (sp)->base)
 #define RETRACT(sp,str) ((sp)->offset = STR2OFF(sp, str))
 
 static JSBool
 SprintAlloc(Sprinter *sp, size_t nb)
 {
-    if (!sp->base) {
-        JS_ARENA_ALLOCATE_CAST(sp->base, char *, sp->pool, nb);
+    char *base;
+
+    base = sp->base;
+    if (!base) {
+        JS_ARENA_ALLOCATE_CAST(base, char *, sp->pool, nb);
     } else {
-        JS_ARENA_GROW_CAST(sp->base, char *, sp->pool, sp->size, nb);
+        JS_ARENA_GROW_CAST(base, char *, sp->pool, sp->size, nb);
     }
-    if (!sp->base) {
+    if (!base) {
         JS_ReportOutOfMemory(sp->context);
         return JS_FALSE;
     }
+    sp->base = base;
     sp->size += nb;
     return JS_TRUE;
 }
 
 static ptrdiff_t
 SprintPut(Sprinter *sp, const char *s, size_t len)
 {
     ptrdiff_t nb, offset;

mozilla-395942-180.patch:

--- NEW FILE mozilla-395942-180.patch ---
---
 browser/components/nsBrowserContentHandler.js           |   28 +++++++++++++---
 toolkit/mozapps/extensions/src/nsExtensionManager.js.in |    6 +++
 xpfe/bootstrap/Makefile.in                              |    1 
 xpfe/bootstrap/nsAppRunner.cpp                          |   21 ++++++++++++
 4 files changed, 51 insertions(+), 5 deletions(-)

Index: mozilla/browser/components/nsBrowserContentHandler.js
===================================================================
--- mozilla.orig/browser/components/nsBrowserContentHandler.js
+++ mozilla/browser/components/nsBrowserContentHandler.js
@@ -44,16 +44,17 @@
 const nsICommandLine         = Components.interfaces.nsICommandLine;
 const nsICommandLineHandler  = Components.interfaces.nsICommandLineHandler;
 const nsIContentHandler      = Components.interfaces.nsIContentHandler;
 const nsIDocShellTreeItem    = Components.interfaces.nsIDocShellTreeItem;
 const nsIDOMChromeWindow     = Components.interfaces.nsIDOMChromeWindow;
 const nsIDOMWindow           = Components.interfaces.nsIDOMWindow;
 const nsIFactory             = Components.interfaces.nsIFactory;
 const nsIFileURL             = Components.interfaces.nsIFileURL;
+const nsIJARURI              = Components.interfaces.nsIJARURI;
 const nsIHttpProtocolHandler = Components.interfaces.nsIHttpProtocolHandler;
 const nsIInterfaceRequestor  = Components.interfaces.nsIInterfaceRequestor;
 const nsIPrefBranch          = Components.interfaces.nsIPrefBranch;
 const nsIPrefLocalizedString = Components.interfaces.nsIPrefLocalizedString;
 const nsISupportsString      = Components.interfaces.nsISupportsString;
 const nsIURIFixup            = Components.interfaces.nsIURIFixup;
 const nsIWebNavigation       = Components.interfaces.nsIWebNavigation;
 const nsIWindowMediator      = Components.interfaces.nsIWindowMediator;
@@ -345,22 +346,39 @@
     }
 
     var chromeParam = cmdLine.handleFlagWithParam("chrome", false);
     if (chromeParam) {
 
       // Handle the old preference dialog URL separately (bug 285416)
       if (chromeParam == "chrome://browser/content/pref/pref.xul") {
         openPreferences();
-      } else {
-        var features = "chrome,dialog=no,all" + this.getFeatures(cmdLine);
-        openWindow(null, chromeParam, "_blank", features, "");
-      }
+        cmdLine.preventDefault = true;
+      } else try {
+        // only load URIs which do not inherit chrome privs.
+        cmdLine.preventDefault = true;
 
-      cmdLine.preventDefault = true;
+        // normally would call checkLoadURI(..., DISALLOW_SCRIPT_OR_DATA)
+        // for this, but in this context we crash when the security manager
+        // tries to throw an exception (no window object here). On the branch
+        // we need to simulate the important bits
+        var uri = resolveURIInternal(cmdLine, chromeParam);
+        while (uri instanceof nsIJARURI) {
+          // unpack to find the real scheme
+          uri = uri.JARFile;
+        }
+        if (!uri.schemeIs("javascript") && !uri.schemeIs("data")) {
+          var features = "chrome,dialog=no,all" + this.getFeatures(cmdLine);
+          openWindow(null, uri.spec, "_blank", features, "");
+          cmdLine.preventDefault = true;
+        }
+      }
+      catch (e) {
+        Components.utils.reportError(e);
+      }
     }
     if (cmdLine.handleFlag("preferences", false)) {
       openPreferences();
       cmdLine.preventDefault = true;
     }
     if (cmdLine.handleFlag("silent", false))
       cmdLine.preventDefault = true;
   },
Index: mozilla/toolkit/mozapps/extensions/src/nsExtensionManager.js.in
===================================================================
--- mozilla.orig/toolkit/mozapps/extensions/src/nsExtensionManager.js.in
+++ mozilla/toolkit/mozapps/extensions/src/nsExtensionManager.js.in
@@ -2506,16 +2506,22 @@
   /**
    * Installs an XPI/JAR file into the KEY_APP_GLOBAL install location.
    * @param   file
    *          The XPI/JAR file to extract
    */
   _installGlobalItem: function(file) {
     if (!file || !file.exists())
       throw new Error("Unable to find the file specified on the command line!");
+#ifdef XP_WIN
+    // make sure the file is local on Windows
+    file.normalize();
+    if (file.path[1] != ':')
+      throw new Error("Can't install global chrome from non-local file "+file.path);
+#endif
     var installManifestFile = extractRDFFileToTempDir(file, FILE_INSTALL_MANIFEST, true);
     if (!installManifestFile.exists())
       throw new Error("The package is missing an install manifest!");
     var installManifest = getInstallManifest(installManifestFile);
     installManifestFile.remove(false);
     var installData = this._getInstallData(installManifest);
     var installer = new Installer(installManifest, installData.id,
                                   InstallLocations.get(KEY_APP_GLOBAL),
Index: mozilla/xpfe/bootstrap/nsAppRunner.cpp
===================================================================
--- mozilla.orig/xpfe/bootstrap/nsAppRunner.cpp
+++ mozilla/xpfe/bootstrap/nsAppRunner.cpp
@@ -87,16 +87,19 @@
 #include "nsIEventQueueService.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsBuildID.h"
 #include "nsIWindowCreator.h"
 #include "nsIWindowWatcher.h"
 #include "nsILocalFile.h"
 #include "nsILookAndFeel.h"
 #include "nsIProcess.h"
+#include "nsIIOService.h"
+#include "nsIJARURI.h"
+#include "nsNetCID.h"
 
 #ifdef MOZ_XPINSTALL
 #include "InstallCleanupDefines.h"
 #include "nsISoftwareUpdate.h"
 #endif
 
 // Interfaces Needed
 #include "nsIXULWindow.h"
@@ -578,16 +581,34 @@
         if (openWindowWithArgs) {
           NS_ConvertASCIItoUTF16 cmdArgs(cmdResult);
 #ifdef DEBUG_CMD_LINE
           printf("opening %s with %s\n", chromeUrlForTask.get(), "OpenWindow");
 #endif /* DEBUG_CMD_LINE */
           rv = OpenWindow(chromeUrlForTask, cmdArgs);
         }
         else {
+          // We need to emulate checkLoadURI because we don't have a window yet
+          nsCOMPtr<nsIIOService> ioService = do_GetService(NS_IOSERVICE_CONTRACTID, &rv);
+          if (NS_FAILED(rv)) return rv;
+          nsCOMPtr<nsIURI> baseURI;
+          rv = ioService->NewURI(cmdResult, nsnull, nsnull, getter_AddRefs(baseURI));
+          if (NS_FAILED(rv)) return rv;
+          nsCOMPtr<nsIJARURI> jarURI(do_QueryInterface(baseURI));
+          while (jarURI) {
+            rv = jarURI->GetJARFile(getter_AddRefs(baseURI));
+            if (NS_FAILED(rv)) return rv;
+            jarURI = do_QueryInterface(baseURI);
+          }
+          PRBool scriptOrData = PR_FALSE;
+          baseURI->SchemeIs("javascript", &scriptOrData);
+          if (!scriptOrData)
+            baseURI->SchemeIs("data", &scriptOrData);
+          if (scriptOrData)
+            return NS_ERROR_FAILURE;
 #ifdef DEBUG_CMD_LINE
           printf("opening %s with %s\n", cmdResult.get(), "OpenWindow");
 #endif /* DEBUG_CMD_LINE */
           rv = OpenWindow(cmdResult, width, height);
           if (NS_FAILED(rv)) return rv;
         }
         // If we get here without an error, then a window was opened OK.
         if (NS_SUCCEEDED(rv)) {
Index: mozilla/xpfe/bootstrap/Makefile.in
===================================================================
--- mozilla.orig/xpfe/bootstrap/Makefile.in
+++ mozilla/xpfe/bootstrap/Makefile.in
@@ -95,16 +95,17 @@
 		  windowwatcher \
 		  embed_base \
 		  embedcomponents \
 		  docshell \
 		  locale \
 		  profile \
 		  chrome \
 		  xremoteclient \
+		  jar \
 		  $(NULL)
 # for jprof
 REQUIRES	+= jprof
 
 ifdef NS_TRACE_MALLOC
 REQUIRES	+= tracemalloc
 endif
 
--- mozilla/mail/components/nsMailDefaultHandler.js.old	2006-04-26 05:49:00.000000000 +0200
+++ mozilla/mail/components/nsMailDefaultHandler.js	2007-10-17 12:42:21.000000000 +0200
@@ -41,6 +41,7 @@ const nsICommandLine           = Compone
 const nsICommandLineHandler    = Components.interfaces.nsICommandLineHandler;
 const nsIDOMWindowInternal     = Components.interfaces.nsIDOMWindowInternal;
 const nsIFactory               = Components.interfaces.nsIFactory;
+const nsIJARURI                = Components.interfaces.nsIJARURI;
 const nsISupportsString        = Components.interfaces.nsISupportsString;
 const nsIWindowMediator        = Components.interfaces.nsIWindowMediator;
 const nsIWindowWatcher         = Components.interfaces.nsIWindowWatcher;
@@ -186,11 +187,31 @@ var nsMailDefaultHandler = {
                              .getService(nsIWindowWatcher);
       var argstring = Components.classes["@mozilla.org/supports-string;1"]
                                 .createInstance(nsISupportsString);
-      wwatch.openWindow(null, chromeParam, "_blank",
-                        "chrome,dialog=no,all", argstring);
-      cmdLine.preventDefault = true;
+
+      try {
+        // only load URIs which do not inherit chrome privs.
+
+        // normally would call checkLoadURI( ,DISALLOW_SCRIPT_OR_DATA)
+        // for this, but in this context we crash when the security manager
+        // tries to throw an exception (no window object here). On the branch
+        // we need to simulate the important bits
+        var uri = resolveURIInternal(cmdLine, chromeParam);
+        while (uri instanceof nsIJARURI) {
+          // unpack to find the real scheme
+          uri = uri.JARFile;
+        }
+        if (!uri.schemeIs("javascript") && !uri.schemeIs("data")) {
+          wwatch.openWindow(null, uri.spec, "_blank",
+                            "chrome,dialog=no,all", argstring);
+          cmdLine.preventDefault = true;
+        }
+      }
+      catch (e) {
+        dump(e);
+        throw Components.results.NS_ERROR_ABORT;
+      }
     }
-    
+
     var count = cmdLine.length;
     if (count) {
       var i = 0;


firefox-1.5-nopangoxft.patch:

Index: firefox-1.5-nopangoxft.patch
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/firefox-1.5-nopangoxft.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- firefox-1.5-nopangoxft.patch	1 Mar 2007 19:06:48 -0000	1.2
+++ firefox-1.5-nopangoxft.patch	19 Oct 2007 12:45:59 -0000	1.3
@@ -1,17 +1,11 @@
 --- mozilla/gfx/src/gtk/mozilla-decoder.cpp.noxft	2004-11-07 18:59:23.000000000 -0500
 +++ mozilla/gfx/src/gtk/mozilla-decoder.cpp	2006-08-06 18:24:37.000000000 -0400
-@@ -40,10 +40,9 @@
- #define PANGO_ENABLE_ENGINE
- 
- #include "mozilla-decoder.h"
--#include <pango/pangoxft.h>
+@@ -40,4 +40,5 @@
  #include <pango/pangofc-fontmap.h>
  #include <pango/pangofc-font.h>
--#include <gdk/gdkx.h>
 +#include <gdk/gdkpango.h>
  
- #include "nsString.h"
- #include "nsIPersistentProperties2.h"
+ #include "mozilla-decoder.h"
 @@ -145,6 +144,13 @@ mozilla_decoders_init(void)
      if (initialized)
          return 0;

firefox-1.5-pango-printing.patch:

Index: firefox-1.5-pango-printing.patch
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/firefox-1.5-pango-printing.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- firefox-1.5-pango-printing.patch	1 Mar 2007 19:06:48 -0000	1.1
+++ firefox-1.5-pango-printing.patch	19 Oct 2007 12:45:59 -0000	1.2
@@ -429,18 +429,20 @@
  class nsFontEnumeratorPango : public nsIFontEnumerator
 --- mozilla/gfx/src/gtk/mozilla-decoder.cpp.pango-printing	2006-12-01 16:23:10.000000000 -0500
 +++ mozilla/gfx/src/gtk/mozilla-decoder.cpp	2006-12-01 16:31:12.000000000 -0500
-@@ -36,14 +36,11 @@
+@@ -36,16 +36,13 @@
   *
   * ***** END LICENSE BLOCK ***** */
  
 -#define PANGO_ENABLE_BACKEND
 -#define PANGO_ENABLE_ENGINE
 -
+-#include <gdk/gdkpango.h>
 -#include "mozilla-decoder.h"
+ #include <pango/pangoxft.h>
 +#include <pango/pangofc-decoder.h>
  #include <pango/pangofc-fontmap.h>
  #include <pango/pangofc-font.h>
--#include <gdk/gdkpango.h>
+ #include <gdk/gdkx.h>
  
 +#include "mozilla-decoder.h"
  #include "nsString.h"

mozilla-358594.patch:

Index: mozilla-358594.patch
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/mozilla-358594.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- mozilla-358594.patch	20 Jul 2007 01:17:01 -0000	1.1
+++ mozilla-358594.patch	19 Oct 2007 12:45:59 -0000	1.2
@@ -1,10 +1,11 @@
+ js/src/jsobj.c    |  135 ++++++++++++++++++++++++++++++++++++------------------
+ js/src/jsopcode.c |   32 +++++++++---
+ 2 files changed, 113 insertions(+), 54 deletions(-)
+
 Index: mozilla/js/src/jsopcode.c
 ===================================================================
-RCS file: /cvsroot/mozilla/js/src/jsopcode.c,v
-retrieving revision 3.89.2.8.2.11
-diff -u -8 -p -r3.89.2.8.2.11 jsopcode.c
---- mozilla/js/src/jsopcode.c	3 Apr 2007 04:59:17 -0000	3.89.2.8.2.11
-+++ mozilla/js/src/jsopcode.c	17 Jul 2007 17:15:52 -0000
+--- mozilla.orig/js/src/jsopcode.c	2007-07-16 10:48:40.000000000 +0000
++++ mozilla/js/src/jsopcode.c	2007-07-16 10:52:44.000000000 +0000
 @@ -61,16 +61,17 @@
  #include "jsconfig.h"
  #include "jsdbgapi.h"
@@ -23,7 +24,7 @@
  const char js_var_str[]         = "var";
  const char js_function_str[]    = "function";
  const char js_in_str[]          = "in";
-@@ -2526,41 +2527,54 @@ Decompile(SprintStack *ss, jsbytecode *p
+@@ -2526,41 +2527,54 @@
                                ? " " : "",
                                (lastop == JSOP_GETTER) ? js_getter_str :
                                (lastop == JSOP_SETTER) ? js_setter_str :
@@ -89,11 +90,8 @@
                case JSOP_DEFSHARP:
 Index: mozilla/js/src/jsobj.c
 ===================================================================
-RCS file: /cvsroot/mozilla/js/src/jsobj.c,v
-retrieving revision 3.208.2.12.2.26
-diff -u -8 -p -r3.208.2.12.2.26 jsobj.c
---- mozilla/js/src/jsobj.c	11 Jul 2007 01:28:31 -0000	3.208.2.12.2.26
-+++ mozilla/js/src/jsobj.c	17 Jul 2007 17:15:53 -0000
+--- mozilla.orig/js/src/jsobj.c	2007-07-16 10:48:40.000000000 +0000
++++ mozilla/js/src/jsobj.c	2007-07-16 10:52:44.000000000 +0000
 @@ -57,16 +57,17 @@
  #include "jscntxt.h"
  #include "jsconfig.h"
@@ -112,7 +110,7 @@
  #include "jsdbgapi.h"   /* whether or not JS_HAS_OBJ_WATCHPOINT */
  
  #if JS_HAS_XML_SUPPORT
-@@ -689,20 +690,22 @@ js_obj_toSource(JSContext *cx, JSObject 
+@@ -689,16 +690,17 @@
      jsint i, j, length, valcnt;
      jsid id;
  #if JS_HAS_GETTER_SETTER
@@ -126,16 +124,11 @@
      JSAtom *atom;
      JSString *idstr, *valstr, *str;
      int stackDummy;
-+    char *atomstrchars;
  
      if (!JS_CHECK_STACK_SIZE(cx, stackDummy)) {
          JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_OVER_RECURSED);
          return JS_FALSE;
-     }
- 
-     /*
-      * obj_toString for 1.2 calls toSource, and doesn't want the extra parens
-@@ -806,91 +809,110 @@ js_obj_toSource(JSContext *cx, JSObject 
+@@ -806,91 +808,110 @@
      /*
       * We have four local roots for cooked and raw value GC safety.  Hoist the
       * "argv + 2" out of the loop using the val local, which refers to the raw
@@ -170,7 +163,7 @@
 +        *rval = STRING_TO_JSVAL(idstr);         /* local root */
 +        idIsLexicalIdentifier = js_IsIdentifier(idstr);
 +
-+        atomstrchars = ATOM_TO_STRING(atom);
++        char *atomstrchars = ATOM_TO_STRING(atom);
 +        needOldStyleGetterSetter = 
 +            !idIsLexicalIdentifier ||
 +            ATOM_KEYWORD(js_AtomizeChars(cx,
@@ -266,7 +259,7 @@
              }
              *rval = STRING_TO_JSVAL(idstr);     /* local root */
          }
-@@ -903,46 +925,67 @@ js_obj_toSource(JSContext *cx, JSObject 
+@@ -903,46 +924,67 @@
              if (!valstr) {
                  ok = JS_FALSE;
                  goto error;
@@ -338,7 +331,7 @@
  
  #define SAFE_ADD(n)                                                          \
      JS_BEGIN_MACRO                                                           \
-@@ -977,38 +1020,41 @@ js_obj_toSource(JSContext *cx, JSObject 
+@@ -977,38 +1019,41 @@
              }
  
              if (comma) {

mozilla-381300.patch:

Index: mozilla-381300.patch
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/mozilla-381300.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- mozilla-381300.patch	20 Jul 2007 01:17:01 -0000	1.1
+++ mozilla-381300.patch	19 Oct 2007 12:45:59 -0000	1.2
@@ -18,9 +18,14 @@
 
 Index: mozilla/caps/src/nsPrincipal.cpp
 ===================================================================
---- mozilla.orig/caps/src/nsPrincipal.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/caps/src/nsPrincipal.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -260,15 +260,10 @@
+--- mozilla.orig/caps/src/nsPrincipal.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/caps/src/nsPrincipal.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -255,60 +255,29 @@
+         aOther->GetSubjectName(str);
+         *aResult = str.Equals(mCert->subjectName) || str.IsEmpty();
+       }
+         
+       return NS_OK;
      }
  
      // Codebases are equal if they have the same origin.
@@ -40,7 +45,9 @@
    }
  
    *aResult = PR_TRUE;
-@@ -278,32 +273,6 @@
+   return NS_OK;
+ }
+ 
  NS_IMETHODIMP
  nsPrincipal::Subsumes(nsIPrincipal *aOther, PRBool *aResult)
  {
@@ -73,11 +80,21 @@
    return Equals(aOther, aResult);
  }
  
+ NS_IMETHODIMP
+ nsPrincipal::CanEnableCapability(const char *capability, PRInt16 *result)
+ {
+   // If this principal is marked invalid, can't enable any capabilities
+   nsCStringKey invalidKey(sInvalid);
 Index: mozilla/caps/src/nsScriptSecurityManager.cpp
 ===================================================================
---- mozilla.orig/caps/src/nsScriptSecurityManager.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/caps/src/nsScriptSecurityManager.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -273,7 +273,7 @@
+--- mozilla.orig/caps/src/nsScriptSecurityManager.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/caps/src/nsScriptSecurityManager.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -268,17 +268,17 @@
+     *result = PR_FALSE;
+ 
+     if (aSourceURI == aTargetURI)
+     {
+         *result = PR_TRUE;
          return NS_OK;
      }
  
@@ -86,7 +103,17 @@
      {
          // return false
          return NS_OK;
-@@ -863,8 +863,14 @@
+     }
+ 
+     // If either uri is a jar URI, get the base URI
+     nsCOMPtr<nsIJARURI> jarURI;
+     nsCOMPtr<nsIURI> sourceBaseURI(aSourceURI);
+@@ -858,34 +858,46 @@
+                                                           PRBool aIsCheckConnect)
+ {
+     /*
+     ** Get origin of subject and object and compare.
+     */
      if (aSubject == aObject)
          return NS_OK;
  
@@ -101,7 +128,10 @@
      if (aIsCheckConnect)
      {
          // Don't use domain for CheckConnect calls, since that's called for
-@@ -875,12 +881,18 @@
+         // data-only load checks like XMLHTTPRequest (bug 290100).
+         aSubject->GetURI(getter_AddRefs(subjectURI));
+         aObject->GetURI(getter_AddRefs(objectURI));
+     }
      else
      {
          aSubject->GetDomain(getter_AddRefs(subjectURI));
@@ -122,7 +152,17 @@
      }
  
      PRBool isSameOrigin = PR_FALSE;
-@@ -899,24 +911,11 @@
+     nsresult rv = SecurityCompareURIs(subjectURI, objectURI, &isSameOrigin);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+     if (isSameOrigin)
+     {   // If either the subject or the object has changed its principal by
+@@ -894,34 +906,21 @@
+         // DNS spoofing based on document.domain (154930)
+ 
+         // But this restriction does not apply to CheckConnect calls, since
+         // that's called for data-only load checks like XMLHTTPRequest where
+         // we ignore domain (bug 290100).
          if (aIsCheckConnect)
              return NS_OK;
  
@@ -148,11 +188,21 @@
      /*
      ** Access tests failed, so now report error.
      */
+     return NS_ERROR_DOM_PROP_ACCESS_DENIED;
+ }
+ 
+ 
+ nsresult
 Index: mozilla/content/base/public/nsIDocument.h
 ===================================================================
---- mozilla.orig/content/base/public/nsIDocument.h	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/content/base/public/nsIDocument.h	2007-07-16 11:53:05.000000000 +0200
-@@ -841,7 +841,7 @@
+--- mozilla.orig/content/base/public/nsIDocument.h	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/content/base/public/nsIDocument.h	2007-10-09 12:48:38.000000000 +0200
+@@ -836,17 +836,17 @@
+   // The document's security info
+   nsCOMPtr<nsISupports> mSecurityInfo;
+ 
+   // if this document is part of a multipart document,
+   // the ID can be used to distinguish it from the other parts.
    PRUint32 mPartID;
  };
  
@@ -161,7 +211,17 @@
  #define NS_IDOCUMENT_MOZILLA_1_8_0_BRANCH_IID      \
  { 0x7d001ad2, 0x01ac, 0x4bf2, \
    { 0xb8, 0x3a, 0x50, 0xaa, 0xed, 0xc6, 0x1d, 0xfa } }
-@@ -870,6 +870,46 @@
+ 
+ class nsIDocument_MOZILLA_1_8_0_BRANCH : public nsISupports
+ {
+ public:
+   NS_DEFINE_STATIC_IID_ACCESSOR(NS_IDOCUMENT_MOZILLA_1_8_0_BRANCH_IID)
+@@ -865,16 +865,56 @@
+    *
+    * @param aIndex the index of the child to remove
+    * @param aNotify whether to notify the document that the remove has
+    *        occurred
+    */
    virtual nsresult RemoveChildAt(PRUint32 aIndex, PRBool aNotify) = 0;
  };
  
@@ -208,11 +268,21 @@
  /**
   * Helper class to automatically handle batching of document updates.  This
   * class will call BeginUpdate on construction and EndUpdate on destruction on
+  * the given document with the given update type.  The document could be null,
+  * in which case no updates will be called.  The constructor also takes a
+  * boolean that can be set to false to prevent notifications.
+  */
+ class mozAutoDocUpdate
 Index: mozilla/content/base/src/nsDocument.cpp
 ===================================================================
---- mozilla.orig/content/base/src/nsDocument.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/content/base/src/nsDocument.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -783,6 +783,7 @@
+--- mozilla.orig/content/base/src/nsDocument.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/content/base/src/nsDocument.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -778,16 +778,17 @@
+ // =
+ // ==================================================================
+ 
+   // NOTE! nsDocument::operator new() zeroes out all members, so don't
+   // bother initializing members to 0.
  
  nsDocument::nsDocument()
    : nsIDocument(),
@@ -220,7 +290,17 @@
      mVisible(PR_TRUE)
  {
  #ifdef PR_LOGGING
-@@ -916,6 +917,7 @@
+   if (!gDocumentLeakPRLog)
+     gDocumentLeakPRLog = PR_NewLogModule("DocumentLeak");
+ 
+   if (gDocumentLeakPRLog)
+     PR_LOG(gDocumentLeakPRLog, PR_LOG_DEBUG,
+@@ -911,16 +912,17 @@
+ }
+ 
+ PRBool gCheckedForXPathDOM = PR_FALSE;
+ PRBool gHaveXPathDOM = PR_FALSE;
+ 
  NS_INTERFACE_MAP_BEGIN(nsDocument)
    NS_INTERFACE_MAP_ENTRY(nsIDocument)
    NS_INTERFACE_MAP_ENTRY(nsIDocument_MOZILLA_1_8_0_BRANCH)
@@ -228,11 +308,21 @@
    NS_INTERFACE_MAP_ENTRY(nsIDOMDocument)
    NS_INTERFACE_MAP_ENTRY(nsIDOMNSDocument)
    NS_INTERFACE_MAP_ENTRY(nsIDOMDocumentEvent)
+   NS_INTERFACE_MAP_ENTRY(nsIDOM3DocumentEvent)
+   NS_INTERFACE_MAP_ENTRY(nsIDOMDocumentStyle)
+   NS_INTERFACE_MAP_ENTRY(nsIDOMNSDocumentStyle)
+   NS_INTERFACE_MAP_ENTRY(nsIDOMDocumentView)
+   NS_INTERFACE_MAP_ENTRY(nsIDOMDocumentRange)
 Index: mozilla/content/base/src/nsDocument.h
 ===================================================================
---- mozilla.orig/content/base/src/nsDocument.h	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/content/base/src/nsDocument.h	2007-07-16 11:53:05.000000000 +0200
-@@ -365,6 +365,7 @@
+--- mozilla.orig/content/base/src/nsDocument.h	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/content/base/src/nsDocument.h	2007-10-09 12:48:38.000000000 +0200
+@@ -360,16 +360,17 @@
+ // really an nsIDOMXMLDocument. The reason for implementing
+ // nsIDOMXMLDocument on this class is to avoid having to duplicate all
+ // its inherited methods on document classes that *are*
+ // nsIDOMXMLDocument's. nsDocument's QI should *not* claim to support
+ // nsIDOMXMLDocument unless someone writes a real implementation of
  // the interface.
  class nsDocument : public nsIDocument,
                     public nsIDocument_MOZILLA_1_8_0_BRANCH,
@@ -240,11 +330,21 @@
                     public nsIDOMXMLDocument, // inherits nsIDOMDocument
                     public nsIDOMNSDocument,
                     public nsIDOMDocumentEvent,
+                    public nsIDOM3DocumentEvent,
+                    public nsIDOMNSDocumentStyle,
+                    public nsIDOMDocumentView,
+                    public nsIDOMDocumentRange,
+                    public nsIDOMDocumentTraversal,
 Index: mozilla/content/base/src/nsFrameLoader.cpp
 ===================================================================
---- mozilla.orig/content/base/src/nsFrameLoader.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/content/base/src/nsFrameLoader.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -165,6 +165,13 @@
+--- mozilla.orig/content/base/src/nsFrameLoader.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/content/base/src/nsFrameLoader.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -160,16 +160,23 @@
+   rv = secMan->GetSystemPrincipal(getter_AddRefs(sysPrin));
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (principal == sysPrin) {
+     // We're a chrome node.  Belt and braces -- inherit the principal for this
      // load instead of just forcing the system principal.  That way if we have
      // something loaded already the principal used will be that of what we
      // already have loaded.
@@ -258,11 +358,21 @@
      loadInfo->SetInheritOwner(PR_TRUE);
  
      // Also, in this case we don't set a referrer, just in case.
+   } else {
+     // We'll use our principal, not that of the document loaded inside us.
+     // This is very important; needed to prevent XSS attacks on documents
+     // loaded in subframes!
+     loadInfo->SetOwner(principal);
 Index: mozilla/content/html/document/src/nsHTMLDocument.cpp
 ===================================================================
---- mozilla.orig/content/html/document/src/nsHTMLDocument.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/content/html/document/src/nsHTMLDocument.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -2020,10 +2020,24 @@
+--- mozilla.orig/content/html/document/src/nsHTMLDocument.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/content/html/document/src/nsHTMLDocument.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -2026,20 +2026,34 @@
+ 
+   // Hold onto ourselves on the offchance that we're down to one ref
+   nsRefPtr<nsHTMLDocument> kungFuDeathGrip(this);
+ 
+   if (mScriptGlobalObject) {
      // Rememer the old scope in case the call to SetNewDocument changes it.
      nsCOMPtr<nsIScriptGlobalObject> oldScope(do_QueryReferent(mScopeObject));
  
@@ -287,7 +397,17 @@
      nsCOMPtr<nsIScriptGlobalObject> newScope(do_QueryReferent(mScopeObject));
      if (oldScope && newScope != oldScope) {
        nsContentUtils::ReparentContentWrappersInScope(oldScope, newScope);
-@@ -2359,36 +2373,6 @@
+     }
+   }
+ 
+   // XXX This is a nasty workaround for a scrollbar code bug
+   // (http://bugzilla.mozilla.org/show_bug.cgi?id=55334).
+@@ -2365,46 +2379,16 @@
+ nsHTMLDocument::ScriptWriteCommon(PRBool aNewlineTerminate)
+ {
+   nsCOMPtr<nsIXPCNativeCallContext> ncc;
+ 
+   nsresult rv = nsContentUtils::XPConnect()->
      GetCurrentNativeCallContext(getter_AddRefs(ncc));
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -324,11 +444,21 @@
    if (ncc) {
      // We're called from JS, concatenate the extra arguments into
      // string_buffer
+     PRUint32 i, argc;
+ 
+     ncc->GetArgc(&argc);
+ 
+     JSContext *cx = nsnull;
 Index: mozilla/docshell/base/nsDocShell.cpp
 ===================================================================
---- mozilla.orig/docshell/base/nsDocShell.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/docshell/base/nsDocShell.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -3226,21 +3226,20 @@
+--- mozilla.orig/docshell/base/nsDocShell.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/docshell/base/nsDocShell.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -3238,31 +3238,30 @@
+     /* If you change this part of code, make sure bug 45297 does not re-occur */
+     if (mOSHE) {
+         rv = LoadHistoryEntry(mOSHE, type);
+     }
+     else if (mLSHE) { // In case a reload happened before the current load is done
          rv = LoadHistoryEntry(mLSHE, type);
      }
      else {
@@ -359,7 +489,17 @@
                            nsnull,         // No window target
                            NS_LossyConvertUCS2toASCII(contentTypeHint).get(),
                            nsnull,         // No post data
-@@ -4859,7 +4858,38 @@
+                           nsnull,         // No headers data
+                           type,           // Load type
+                           nsnull,         // No SHEntry
+                           PR_TRUE,
+                           nsnull,         // No nsIDocShell
+@@ -4871,17 +4870,48 @@
+ NS_IMETHODIMP
+ nsDocShell::EnsureContentViewer()
+ {
+     if (mContentViewer)
+         return NS_OK;
      if (mIsBeingDestroyed)
          return NS_ERROR_FAILURE;
  
@@ -399,7 +539,17 @@
  }
  
  NS_IMETHODIMP
-@@ -6300,12 +6330,28 @@
+ nsDocShell::EnsureDeviceContext()
+ {
+     if (mDeviceContext)
+         return NS_OK;
+ 
+@@ -6322,22 +6352,38 @@
+             return NS_ERROR_CONTENT_BLOCKED_SHOW_ALT;
+         }
+ 
+         return NS_ERROR_CONTENT_BLOCKED;
+     }
  
      nsCOMPtr<nsISupports> owner(aOwner);
      //
@@ -432,7 +582,17 @@
  
      //
      // Resolve the window target before going any further...
-@@ -6684,42 +6730,51 @@
+     // If the load has been targeted to another DocShell, then transfer the
+     // load to it...
+     //
+     if (aWindowTarget && *aWindowTarget) {
+         PRBool bIsNewWindow;
+@@ -6706,52 +6752,61 @@
+     if (NS_FAILED(rv)) {
+         nsCOMPtr<nsIChannel> chan(do_QueryInterface(req));
+         DisplayLoadError(rv, aURI, nsnull, chan);
+     }
+     
      return rv;
  }
  
@@ -505,7 +665,17 @@
  }
  
  nsresult
-@@ -6885,7 +6940,12 @@
+ nsDocShell::DoURILoad(nsIURI * aURI,
+                       nsIURI * aReferrerURI,
+                       PRBool aSendReferrer,
+                       nsISupports * aOwner,
+                       const char * aTypeHint,
+@@ -6907,27 +6962,32 @@
+             // Referrer is currenly only set for link clicks here.
+             httpChannel->SetReferrer(aReferrerURI);
+         }
+     }
+     //
      // Set the owner of the channel - only for javascript and data channels.
      //
      // XXX: Is seems wrong that the owner is ignored - even if one is
@@ -519,7 +689,9 @@
      //
      //      (Currently chrome URIs set the owner when they are created!
      //      So setting a NULL owner would be bad!)
-@@ -6895,7 +6955,7 @@
+     //
+     PRBool isJSOrData = PR_FALSE;
+     aURI->SchemeIs("javascript", &isJSOrData);
      if (!isJSOrData) {
        aURI->SchemeIs("data", &isJSOrData);
      }
@@ -528,7 +700,17 @@
          channel->SetOwner(aOwner);
      }
  
-@@ -8730,3 +8790,21 @@
+     rv = DoChannelLoad(channel, uriLoader);
+     
+     //
+     // If the channel load failed, we failed and nsIWebProgress just ain't
+     // gonna happen.
+@@ -8752,8 +8812,26 @@
+ 
+     nsCOMPtr<nsIDOMWindow> window(do_QueryInterface(mScriptGlobal));
+ 
+     // Get the an auth prompter for our window so that the parenting
+     // of the dialogs works as it should when using tabs.
  
      return wwatch->GetNewAuthPrompter(window, aResult);
  }
@@ -552,9 +734,14 @@
 +                                     
 Index: mozilla/docshell/base/nsDocShell.h
 ===================================================================
---- mozilla.orig/docshell/base/nsDocShell.h	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/docshell/base/nsDocShell.h	2007-07-16 11:53:05.000000000 +0200
-@@ -287,7 +287,18 @@
+--- mozilla.orig/docshell/base/nsDocShell.h	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/docshell/base/nsDocShell.h	2007-10-09 12:48:38.000000000 +0200
+@@ -284,17 +284,28 @@
+     NS_IMETHOD NewContentViewerObj(const char * aContentType, 
+         nsIRequest * request, nsILoadGroup * aLoadGroup, 
+         nsIStreamListener ** aContentHandler, nsIContentViewer ** aViewer);
+     NS_IMETHOD SetupNewViewer(nsIContentViewer * aNewViewer);
+ 
      void SetupReferrerFromChannel(nsIChannel * aChannel);
      
      NS_IMETHOD GetEldestPresContext(nsPresContext** aPresContext);
@@ -574,7 +761,17 @@
      virtual nsresult DoURILoad(nsIURI * aURI,
                                 nsIURI * aReferrer,
                                 PRBool aSendReferrer,
-@@ -511,6 +522,9 @@
+                                nsISupports * aOwner,
+                                const char * aTypeHint,
+                                nsIInputStream * aPostData,
+                                nsIInputStream * aHeadersData,
+                                PRBool firstParty,
+@@ -509,16 +520,19 @@
+     // Begin the toplevel restore process for |aSHEntry|.
+     // This simulates a channel open, and defers the real work until
+     // RestoreFromHistory is called from a PLEvent.
+     nsresult RestorePresentation(nsISHEntry *aSHEntry, PRBool *aRestoring);
+ 
      // Call BeginRestore(nsnull, PR_FALSE) for each child of this shell.
      nsresult BeginRestoreChildren();
  
@@ -584,11 +781,21 @@
  protected:
      // Override the parent setter from nsDocLoader
      virtual nsresult SetDocLoaderParent(nsDocLoader * aLoader);
+ 
+     PRPackedBool               mAllowSubframes;
+     PRPackedBool               mAllowPlugins;
+     PRPackedBool               mAllowJavascript;
+     PRPackedBool               mAllowMetaRedirects;
 Index: mozilla/dom/public/base/nsPIDOMWindow.h
 ===================================================================
---- mozilla.orig/dom/public/base/nsPIDOMWindow.h	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/dom/public/base/nsPIDOMWindow.h	2007-07-16 11:53:05.000000000 +0200
-@@ -50,6 +50,8 @@
+--- mozilla.orig/dom/public/base/nsPIDOMWindow.h	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/dom/public/base/nsPIDOMWindow.h	2007-10-09 12:48:38.000000000 +0200
+@@ -45,16 +45,18 @@
+ #include "nsIDOMXULCommandDispatcher.h"
+ #include "nsIDOMElement.h"
+ #include "nsIDOMWindowInternal.h"
+ #include "nsIChromeEventHandler.h"
+ #include "nsIDOMDocument.h"
  #include "nsIURI.h"
  #include "nsCOMPtr.h"
  
@@ -597,7 +804,17 @@
  // Popup control state enum. The values in this enum must go from most
  // permissive to least permissive so that it's safe to push state in
  // all situations. Pushing popup state onto the stack never makes the
-@@ -252,6 +254,8 @@
+ // current popup state less permissive (see
+ // nsGlobalWindow::PushPopupControlState()).
+ enum PopupControlState {
+   openAllowed = 0,  // open that window without worries
+   openControlled,   // it's a popup, but allow it
+@@ -247,16 +249,18 @@
+       }
+ 
+       win = this;
+     }
+ 
      return win->mIsHandlingResizeEvent;
    }
  
@@ -606,7 +823,17 @@
    virtual void SetOpenerScriptURL(nsIURI* aURI) = 0;
  
    virtual PopupControlState PushPopupControlState(PopupControlState aState,
-@@ -313,7 +317,6 @@
+                                                   PRBool aForce) const = 0;
+   virtual void PopPopupControlState(PopupControlState state) const = 0;
+   virtual PopupControlState GetPopupControlState() const = 0;
+   virtual OpenAllowValue GetOpenAllow(const nsAString &aName) = 0;
+ 
+@@ -308,32 +312,55 @@
+   // These two variables are special in that they're set to the same
+   // value on both the outer window and the current inner window. Make
+   // sure you keep them in sync!
+   nsCOMPtr<nsIChromeEventHandler> mChromeEventHandler; // strong
+   nsCOMPtr<nsIDOMDocument> mDocument; // strong
  
    // These members are only used on outer windows.
    nsIDOMElement *mFrameElement; // weak
@@ -614,7 +841,15 @@
  
    // These variables are only used on inner windows.
    nsTimeout             *mRunningTimeout;
-@@ -329,6 +332,30 @@
+ 
+   PRUint32               mMutationBits;
+ 
+   PRPackedBool           mIsDocumentLoaded;
+   PRPackedBool           mIsHandlingResizeEvent;
+   PRPackedBool           mIsInnerWindow;
+ 
+   // And these are the references between inner and outer windows.
+   nsPIDOMWindow         *mInnerWindow;
    nsPIDOMWindow         *mOuterWindow;
  };
  
@@ -645,11 +880,21 @@
  
  #ifdef _IMPL_NS_LAYOUT
  PopupControlState
+ PushPopupControlState(PopupControlState aState, PRBool aForce);
+ 
+ void
+ PopPopupControlState(PopupControlState aState);
+ 
 Index: mozilla/dom/src/base/nsGlobalWindow.cpp
 ===================================================================
---- mozilla.orig/dom/src/base/nsGlobalWindow.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/dom/src/base/nsGlobalWindow.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -296,13 +296,28 @@
+--- mozilla.orig/dom/src/base/nsGlobalWindow.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/dom/src/base/nsGlobalWindow.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -291,23 +291,38 @@
+ static const char sJSStackContractID[] = "@mozilla.org/js/xpc/ContextStack;1";
+ 
+ static const char kDOMBundleURL[] = "chrome://global/locale/commonDialogs.properties";
+ static const char kDOMSecurityWarningsBundleURL[] = "chrome://global/locale/dom/dom.properties";
+ 
  static const char kCryptoContractID[] = NS_CRYPTO_CONTRACTID;
  static const char kPkcs11ContractID[] = NS_PKCS11_CONTRACTID;
  
@@ -679,7 +924,17 @@
      mIsFrozen(PR_FALSE),
      mFullScreen(PR_FALSE),
      mIsClosed(PR_FALSE), 
-@@ -521,6 +536,7 @@
+     mInClose(PR_FALSE), 
+     mHavePendingClose(PR_FALSE),
+     mOpenerWasCleared(PR_FALSE),
+     mIsPopupSpam(PR_FALSE),
+     mArguments(nsnull),
+@@ -516,16 +531,17 @@
+   NS_INTERFACE_MAP_ENTRY(nsIDOMJSWindow)
+   NS_INTERFACE_MAP_ENTRY(nsIScriptGlobalObject)
+   NS_INTERFACE_MAP_ENTRY(nsIScriptObjectPrincipal)
+   NS_INTERFACE_MAP_ENTRY(nsIDOMEventReceiver)
+   NS_INTERFACE_MAP_ENTRY(nsIDOMEventTarget)
    NS_INTERFACE_MAP_ENTRY(nsIDOM3EventTarget)
    NS_INTERFACE_MAP_ENTRY(nsIDOMNSEventTarget)
    NS_INTERFACE_MAP_ENTRY(nsPIDOMWindow)
@@ -687,7 +942,17 @@
    NS_INTERFACE_MAP_ENTRY(nsIDOMViewCSS)
    NS_INTERFACE_MAP_ENTRY(nsIDOMAbstractView)
    NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
-@@ -581,70 +597,52 @@
+   NS_INTERFACE_MAP_ENTRY(nsIInterfaceRequestor)
+   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(Window)
+ NS_INTERFACE_MAP_END
+ 
+ 
+@@ -576,80 +592,62 @@
+   FORWARD_TO_OUTER(GetContext, (), nsnull);
+ 
+   return mContext;
+ }
+ 
  PRBool
  nsGlobalWindow::WouldReuseInnerWindow(nsIDocument *aNewDocument)
  {
@@ -783,7 +1048,17 @@
    }
  
    nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(mDocShell));
-@@ -664,9 +662,49 @@
+ 
+   if (treeItem) {
+     PRInt32 itemType = nsIDocShellTreeItem::typeContent;
+     treeItem->GetItemType(&itemType);
+ 
+@@ -659,19 +657,59 @@
+ 
+   // No treeItem: don't reuse the current inner window.
+   return PR_FALSE;
+ }
+ 
  void
  nsGlobalWindow::SetOpenerScriptURL(nsIURI* aURI)
  {
@@ -835,7 +1110,17 @@
  }
  
  PopupControlState
-@@ -944,7 +982,7 @@
+ PushPopupControlState(PopupControlState aState, PRBool aForce)
+ {
+   PopupControlState oldState = gPopupControlState;
+ 
+   if (aState < gPopupControlState || aForce) {
+@@ -939,17 +977,17 @@
+   SetStatus(EmptyString());
+   SetDefaultStatus(EmptyString());
+ 
+   // This code should not be called during shutdown any more (now that
+   // we don't ever call SetNewDocument(nsnull), so no need to null
    // check xpc here.
    nsIXPConnect *xpc = nsContentUtils::XPConnect();
  
@@ -844,7 +1129,17 @@
  
    // XXX We used to share event listeners between inner windows in special
    // circumstances (that were remarkably close to the conditions that we set
-@@ -3530,6 +3568,7 @@
+   // reUseInnerWindow in) but that left dangling pointers to the old (destroyed)
+   // inner window (bug 303765). Setting this here should be a no-op.
+   aRemoveEventListeners = !reUseInnerWindow;
+ 
+   // Remember the old document's principal.
+@@ -3525,33 +3563,30 @@
+     if (embeddingWin)
+       embeddingWin->SetFocus();
+   }
+ 
+   nsCOMPtr<nsIPresShell> presShell;
    if (mDocShell) {
      // Don't look for a presshell if we're a root chrome window that's got
      // about:blank loaded.  We don't want to focus our widget in that case.
@@ -852,7 +1147,11 @@
      PRBool lookForPresShell = PR_TRUE;
      PRInt32 itemType = nsIDocShellTreeItem::typeContent;
      nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(mDocShell));
-@@ -3541,12 +3580,8 @@
+     NS_ASSERTION(treeItem, "What happened?");
+     treeItem->GetItemType(&itemType);
+     if (itemType == nsIDocShellTreeItem::typeChrome &&
+         GetPrivateRoot() == NS_STATIC_CAST(nsIDOMWindowInternal*, this) &&
+         mDocument) {
        nsCOMPtr<nsIDocument> doc(do_QueryInterface(mDocument));
        NS_ASSERTION(doc, "Bogus doc?");
        nsIURI* ourURI = doc->GetDocumentURI();
@@ -867,7 +1166,17 @@
        }
      }
        
-@@ -5978,25 +6013,7 @@
+     if (lookForPresShell) {
+       mDocShell->GetEldestPresShell(getter_AddRefs(presShell));
+     }
+   }
+ 
+@@ -5973,35 +6008,17 @@
+                                   aExtraArgument, getter_AddRefs(domReturn));
+         }
+       }
+     }
+   }
  
    // success!
  
@@ -894,11 +1203,21 @@
  
    return rv;
  }
+ 
+ // static
+ void
+ nsGlobalWindow::CloseWindow(nsISupports *aWindow)
+ {
 Index: mozilla/dom/src/base/nsGlobalWindow.h
 ===================================================================
---- mozilla.orig/dom/src/base/nsGlobalWindow.h	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/dom/src/base/nsGlobalWindow.h	2007-07-16 11:53:05.000000000 +0200
-@@ -129,7 +129,7 @@
+--- mozilla.orig/dom/src/base/nsGlobalWindow.h	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/dom/src/base/nsGlobalWindow.h	2007-10-09 12:48:38.000000000 +0200
+@@ -124,17 +124,17 @@
+ // needed to ensure that mOuterWindow doesn't end up dangling. The
+ // nature of PRCList means that the window itself is always in the
+ // list, and an outer window's list will also contain all inner window
+ // objects that are still in memory (and in reality all inner window
+ // object's lists also contain its outer and all other inner windows
  // belonging to the same outer window, but that's an unimportant
  // side effect of inheriting PRCList).
  
@@ -907,7 +1226,17 @@
                         public nsIScriptGlobalObject,
                         public nsIDOMJSWindow,
                         public nsIScriptObjectPrincipal,
-@@ -224,6 +224,10 @@
+                        public nsIDOMEventReceiver,
+                        public nsIDOM3EventTarget,
+                        public nsIDOMNSEventTarget,
+                        public nsIDOMViewCSS,
+                        public nsSupportsWeakReference,
+@@ -219,16 +219,20 @@
+   virtual NS_HIDDEN_(PopupControlState) GetPopupControlState() const;
+   virtual NS_HIDDEN_(OpenAllowValue) GetOpenAllow(const nsAString &aName);
+ 
+   virtual NS_HIDDEN_(nsresult) SaveWindowState(nsISupports **aState);
+   virtual NS_HIDDEN_(nsresult) RestoreWindowState(nsISupports *aState);
  
    virtual NS_HIDDEN_(PRBool) WouldReuseInnerWindow(nsIDocument *aNewDocument);
  
@@ -918,7 +1247,17 @@
    // nsIDOMViewCSS
    NS_DECL_NSIDOMVIEWCSS
  
-@@ -294,8 +298,6 @@
+   // nsIDOMAbstractView
+   NS_DECL_NSIDOMABSTRACTVIEW
+ 
+   // nsIInterfaceRequestor
+   NS_DECL_NSIINTERFACEREQUESTOR
+@@ -289,18 +293,16 @@
+   void FreeInnerObjects(JSContext *cx);
+ 
+   nsresult SetNewDocument(nsIDOMDocument *aDocument,
+                           nsISupports *aState,
+                           PRBool aRemoveEventListeners,
                            PRBool aClearScopeHint,
                            PRBool aIsInternalCall);
  
@@ -927,7 +1266,17 @@
    // Get the parent, returns null if this is a toplevel window
    nsIDOMWindowInternal *GetParentInternal();
  
-@@ -461,6 +463,8 @@
+   // popup tracking
+   PRBool IsPopupSpamWindow()
+   {
+     if (IsInnerWindow() && !mOuterWindow) {
+       return PR_FALSE;
+@@ -456,16 +458,18 @@
+   nsString                      mDefaultStatus;
+ 
+   nsIScriptGlobalObjectOwner*   mGlobalObjectOwner; // Weak Reference
+   nsIDocShell*                  mDocShell;  // Weak Reference
+   nsCOMPtr<nsIDOMCrypto>        mCrypto;
    nsCOMPtr<nsIDOMPkcs11>        mPkcs11;
  
    nsCOMPtr<nsIXPConnectJSObjectHolder> mInnerWindowHolder;
@@ -936,11 +1285,21 @@
  
    // These member variable are used only on inner windows.
    nsCOMPtr<nsIEventListenerManager> mListenerManager;
+   nsTimeout*                    mTimeouts;
+   nsTimeout**                   mTimeoutInsertionPoint;
+   PRUint32                      mTimeoutPublicIdCounter;
+   PRUint32                      mTimeoutFiringDepth;
+ 
 Index: mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp
 ===================================================================
---- mozilla.orig/dom/src/jsurl/nsJSProtocolHandler.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -222,10 +222,8 @@
+--- mozilla.orig/dom/src/jsurl/nsJSProtocolHandler.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -217,20 +217,18 @@
+     PRBool useSandbox = PR_TRUE;
+ 
+     if (owner) {
+         principal = do_QueryInterface(owner, &rv);
+         NS_ASSERTION(principal, "Channel's owner is not a principal");
          if (!principal)
              return NS_ERROR_FAILURE;
  
@@ -953,11 +1312,21 @@
          nsCOMPtr<nsIPrincipal> objectPrincipal;
          rv = securityManager->GetObjectPrincipal(
                                  (JSContext*)scriptContext->GetNativeContext(),
+                                 globalJSObject,
+                                 getter_AddRefs(objectPrincipal));
+         if (NS_FAILED(rv))
+             return rv;
+ 
 Index: mozilla/embedding/components/windowwatcher/src/Makefile.in
 ===================================================================
---- mozilla.orig/embedding/components/windowwatcher/src/Makefile.in	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/embedding/components/windowwatcher/src/Makefile.in	2007-07-16 11:53:05.000000000 +0200
-@@ -63,6 +63,7 @@
+--- mozilla.orig/embedding/components/windowwatcher/src/Makefile.in	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/embedding/components/windowwatcher/src/Makefile.in	2007-10-09 12:48:38.000000000 +0200
+@@ -58,16 +58,17 @@
+ 		  content \
+ 		  pref \
+ 		  necko \
+ 		  docshell \
+ 		  webbrwsr \
  		  embed_base \
  		  intl \
  		  layout \
@@ -965,11 +1334,21 @@
  		  $(NULL)
  
  CPPSRCS		= nsPrompt.cpp \
+                   nsWWJSUtils.cpp \
+                   nsWindowWatcher.cpp  \
+                   $(NULL)
+ 
+ ifdef MOZ_XUL
 Index: mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
 ===================================================================
---- mozilla.orig/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2007-07-16 11:53:05.000000000 +0200
-@@ -58,6 +58,7 @@
+--- mozilla.orig/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp	2007-10-09 12:48:38.000000000 +0200
+@@ -53,16 +53,17 @@
+ #include "nsIDocShellLoadInfo.h"
+ #include "nsIDocShellTreeItem.h"
+ #include "nsIDocShellTreeOwner.h"
+ #include "nsIDocument.h"
+ #include "nsIDOMDocument.h"
  #include "nsIDOMWindow.h"
  #include "nsIDOMChromeWindow.h"
  #include "nsIDOMWindowInternal.h"
@@ -977,7 +1356,17 @@
  #include "nsIScreen.h"
  #include "nsIScreenManager.h"
  #include "nsIScriptContext.h"
-@@ -684,7 +685,7 @@
+ #include "nsIEventQueue.h"
+ #include "nsIEventQueueService.h"
+ #include "nsIGenericFactory.h"
+ #include "nsIJSContextStack.h"
+ #include "nsIObserverService.h"
+@@ -679,17 +680,17 @@
+       }
+     }
+   }
+ 
+   // better have a window to use by this point
    if (!newDocShellItem)
      return rv;
  
@@ -986,7 +1375,17 @@
    if (NS_FAILED(rv))
      return rv;
  
-@@ -750,6 +751,43 @@
+   /* disable persistence of size/position in popups (determined by
+      determining whether the features parameter specifies width or height
+      in any way). We consider any overriding of the window's size or position
+      in the open call as disabling persistence of those attributes.
+      Popup windows (which should not persist size or position) generally set
+@@ -745,16 +746,53 @@
+         nsCOMPtr<nsIMarkupDocumentViewer> newMarkupDocViewer(do_QueryInterface(newContentViewer));
+         if (doc && newMarkupDocViewer) {
+           newMarkupDocViewer->SetDefaultCharacterSet(doc->GetDocumentCharacterSet());
+         }
+       }
      }
    }
  
@@ -1030,7 +1429,17 @@
    if (uriToLoad) { // get the script principal and pass it to docshell
      JSContextAutoPopper contextGuard;
  
-@@ -769,15 +807,8 @@
+     cx = GetJSContextFromCallStack();
+ 
+     // get the security manager
+     if (!cx)
+       cx = GetJSContextFromWindow(aParent);
+@@ -764,25 +802,18 @@
+         return rv;
+       cx = contextGuard.get();
+     }
+ 
+     nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
      newDocShell->CreateLoadInfo(getter_AddRefs(loadInfo));
      NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);
  
@@ -1048,7 +1457,17 @@
      }
  
      // Set the new window's referrer from the calling context's document:
-@@ -1523,6 +1554,7 @@
+ 
+     // get the calling context off the JS context stack
+     nsCOMPtr<nsIJSContextStack> stack = do_GetService(sJSStackContractID);
+ 
+     JSContext* ccx = nsnull;
+@@ -1518,26 +1549,36 @@
+ /* Fetch the nsIDOMWindow corresponding to the given nsIDocShellTreeItem.
+    This forces the creation of a script context, if one has not already
+    been created. Note it also sets the window's opener to the parent,
+    if applicable -- because it's just convenient, that's all. null aParent
+    is acceptable. */
  nsresult
  nsWindowWatcher::ReadyOpenedDocShellItem(nsIDocShellTreeItem *aOpenedItem,
                                           nsIDOMWindow        *aParent,
@@ -1056,7 +1475,10 @@
                                           nsIDOMWindow        **aOpenedWindow)
  {
    nsresult rv = NS_ERROR_FAILURE;
-@@ -1533,6 +1565,15 @@
+ 
+   *aOpenedWindow = 0;
+   nsCOMPtr<nsIScriptGlobalObject> globalObject(do_GetInterface(aOpenedItem));
+   if (globalObject) {
      if (aParent) {
        nsCOMPtr<nsIDOMWindowInternal> internalParent(do_QueryInterface(aParent));
        globalObject->SetOpenerWindow(internalParent); // damnit
@@ -1072,11 +1494,21 @@
      }
      rv = CallQueryInterface(globalObject, aOpenedWindow);
    }
+   return rv;
+ }
+ 
+ /* Size and position the new window according to aFeatures. This method
+    is assumed to be called after the window has already been given
 Index: mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.h
 ===================================================================
---- mozilla.orig/embedding/components/windowwatcher/src/nsWindowWatcher.h	2007-07-16 11:51:44.000000000 +0200
-+++ mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.h	2007-07-16 11:53:05.000000000 +0200
-@@ -100,6 +100,7 @@
+--- mozilla.orig/embedding/components/windowwatcher/src/nsWindowWatcher.h	2007-10-09 12:48:36.000000000 +0200
++++ mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.h	2007-10-09 12:48:38.000000000 +0200
+@@ -95,16 +95,17 @@
+                                          PRBool aFeaturesSpecified,
+                                          PRBool aDialog,
+                                          PRBool aChromeURL,
+                                          PRBool aHasChromeParent);
+   static PRInt32    WinHasOption(const char *aOptions, const char *aName,
                                   PRInt32 aDefault, PRBool *aPresenceFlag);
    static nsresult   ReadyOpenedDocShellItem(nsIDocShellTreeItem *aOpenedItem,
                                              nsIDOMWindow *aParent,
@@ -1084,3 +1516,8 @@
                                              nsIDOMWindow **aOpenedWindow);
    static void       SizeOpenedDocShellItem(nsIDocShellTreeItem *aDocShellItem,
                                             nsIDOMWindow *aParent,
+                                            const char *aFeatures,
+                                            PRUint32 aChromeFlags);
+   static nsresult   AttachArguments(nsIDOMWindow *aWindow,
+                                     PRUint32 argc, jsval *argv);
+   static nsresult   ConvertSupportsTojsvals(nsIDOMWindow *aWindow,

mozilla-version.patch:

Index: mozilla-version.patch
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/mozilla-version.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- mozilla-version.patch	20 Jul 2007 01:17:01 -0000	1.1
+++ mozilla-version.patch	19 Oct 2007 12:45:59 -0000	1.2
@@ -41,5 +41,5 @@
 --- org/mozilla/mail/config/version.txt	2007-05-31 11:22:44.000000000 +0200
 +++ fixed/mozilla/mail/config/version.txt	2007-07-18 13:36:36.000000000 +0200
 @@ -1 +1 @@
--1.5.0.13pre
+-1.5.0.14pre
 +1.5.0.12


Index: seamonkey.spec
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/seamonkey.spec,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- seamonkey.spec	20 Jul 2007 01:17:01 -0000	1.21
+++ seamonkey.spec	19 Oct 2007 12:45:59 -0000	1.22
@@ -11,13 +11,13 @@
 Name:           seamonkey
 Summary:        Web browser, e-mail, news, IRC client, HTML editor
 Version:        1.0.9
-Release:        2%{?dist}
+Release:        3%{?dist}
 URL:            http://www.mozilla.org/projects/seamonkey/
 License:        MPL
 Group:          Applications/Internet
 
 #Source0:        seamonkey-%{version}.source.tar.bz2
-Source0:        mozilla-180-20070717.tar.bz2
+Source0:        mozilla-180-20071018.tar.bz2
 Source1:        seamonkey.sh.in
 Source2:        seamonkey-icon.png
 Source4:        seamonkey.desktop
@@ -42,12 +42,31 @@
 Patch22:        firefox-0.7.3-psfonts.patch
 Patch42:        firefox-1.1-uriloader.patch
 
-Patch60:        mozilla-358594.patch
-Patch61:        mozilla-379245.patch
-Patch62:        mozilla-382532.patch
-Patch63:        mozilla-178993.patch
-Patch65:        mozilla-384925.patch
-Patch66:        mozilla-381300.patch
+Patch50:        mozilla-358594.patch
+#Patch51:        mozilla-379245.patch
+#Patch52:        mozilla-382532.patch
+Patch53:        mozilla-178993.patch
+Patch55:        mozilla-384925.patch
+Patch56:        mozilla-381300.patch
+
+Patch60:        mozilla-309322_180_att283610.patch
+Patch61:        mozilla-267833.patch
+Patch62:        mozilla-345305_venkmanonly.patch
+Patch63:        mozilla-361745.patch
+Patch64:        mozilla-362901.patch
+Patch65:        mozilla-372309.patch
+Patch66:        mozilla-378787.patch
+Patch67:        mozilla-384105.patch
+Patch68:        mozilla-386914.patch
+Patch69:        mozilla-387033.patch
+Patch70:        mozilla-387881.patch
+Patch71:        mozilla-388121.patch
+Patch72:        mozilla-388784.patch
+Patch73:        mozilla-390078.patch
+Patch74:        mozilla-393537.patch
+Patch75:        mozilla-395942-180.patch
+Patch76:        mozilla-325761.patch
+Patch77:        mozilla-392149-180.patch
 
 # font system fixes
 Patch81:        firefox-1.5-nopangoxft.patch
@@ -144,12 +163,33 @@
 %patch21 -p1
 %patch22 -p1
 %patch42 -p0
+
+%patch50 -p1
+#%patch51 -p1
+#%patch52 -p1
+%patch53 -p1
+%patch55 -p1
+%patch56 -p1
+
 %patch60 -p1
 %patch61 -p1
 %patch62 -p1
 %patch63 -p1
+%patch64 -p1
 %patch65 -p1
 %patch66 -p1
+%patch67 -p1
+%patch68 -p1
+%patch69 -p1
+%patch70 -p1
+%patch71 -p1
+%patch72 -p1
+%patch73 -p1
+%patch74 -p1
+%patch75 -p1
+%patch76 -p1
+%patch77 -p1
+
 %patch81 -p1
 %patch82 -p1
 %patch83 -p1
@@ -470,6 +510,11 @@
 
 
 %changelog
+* Thu Oct 18 2007 Martin Stransky <stransky at redhat.com> - 1.0.9-3
+- Update to latest snapshot of Mozilla 1.8.0 branch
+- added pathes for Mozilla bugs 267833,309322,345305,361745,
+  362901,372309,378787,381300,384105,386914,387033,387881,388121,388784
+  390078,393537,395942,325761,392149
 * Fri Jul 20 2007 Kai Engert <kengert at redhat.com> - 1.0.9-2
 - Add a patch to stick with gecko version 1.8.0.12
 - Update to latest snapshot of Mozilla 1.8.0 branch


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/seamonkey/FC-6/sources,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- sources	20 Jul 2007 01:17:01 -0000	1.11
+++ sources	19 Oct 2007 12:45:59 -0000	1.12
@@ -1 +1 @@
-a4e46e60012ac52aa166f291f5ea3007  mozilla-180-20070717.tar.bz2
+398eaad85ecaface152f4580296e09ad  mozilla-180-20071018.tar.bz2




More information about the fedora-extras-commits mailing list