iceowl (1.0~b1+dfsg2-2+squeeze2) security/squeeze1/Bug-608687-clear-mRoot-after-uninitializing-so-that-.patch

From: Neil Deakin <neil@mozilla.com>
Date: Fri, 21 Jan 2011 13:22:19 -0800
Subject: Bug 608687, clear mRoot after uninitializing so that template generated content gets removed, r=smaug, a=clegnitto

---
 content/xul/templates/src/nsXULTemplateBuilder.cpp |    2 --
 content/xul/templates/src/nsXULTemplateBuilder.h   |    7 +++++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp b/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp
index 5ae3122..d8c8f55 100644
--- a/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -1152,7 +1152,6 @@ nsXULTemplateBuilder::ContentRemoved(nsIDocument* aDocument,
 
         mDB = nsnull;
         mCompDB = nsnull;
-        mRoot = nsnull;
         mDataSource = nsnull;
     }
 }
@@ -1171,7 +1170,6 @@ nsXULTemplateBuilder::NodeWillBeDestroyed(const nsINode* aNode)
     mDataSource = nsnull;
     mDB = nsnull;
     mCompDB = nsnull;
-    mRoot = nsnull;
 
     nsContentUtils::AddScriptRunner(
         NS_NEW_RUNNABLE_METHOD(nsXULTemplateBuilder, this, UninitTrue));
diff --git a/mozilla/content/xul/templates/src/nsXULTemplateBuilder.h b/mozilla/content/xul/templates/src/nsXULTemplateBuilder.h
index 764cc86..c24276a 100644
--- a/mozilla/content/xul/templates/src/nsXULTemplateBuilder.h
+++ b/mozilla/content/xul/templates/src/nsXULTemplateBuilder.h
@@ -166,8 +166,11 @@ public:
         }
       }
     }
-    void UninitFalse() { Uninit(PR_FALSE); }
-    void UninitTrue() { Uninit(PR_TRUE); }
+
+    // mRoot should not be cleared until after Uninit is finished so that
+    // generated content can be removed during uninitialization.
+    void UninitFalse() { Uninit(PR_FALSE); mRoot = nsnull; }
+    void UninitTrue() { Uninit(PR_TRUE); mRoot = nsnull; }
 
     /**
      * Find the <template> tag that applies for this builder