Fix for 44437. r,a=waterson

layout/base/nsIPresState.h

@@ -21,6 +21,8 @@ public:
 			      nsAWritableString& aResult) = 0;
   NS_IMETHOD SetStateProperty(const nsAReadableString& aProperty,
 			      const nsAReadableString& aValue) = 0;
+
+  NS_IMETHOD RemoveStateProperty(const nsAReadableString& aName) = 0;
 };
 
 extern nsresult

layout/base/nsPresState.cpp

@@ -18,6 +18,8 @@ class nsPresState: public nsIPresState
   NS_IMETHOD GetStateProperty(const nsAReadableString& aProperty, nsAWritableString& aResult);
   NS_IMETHOD SetStateProperty(const nsAReadableString& aProperty, const nsAReadableString& aValue);
 
+  NS_IMETHOD RemoveStateProperty(const nsAReadableString& aProperty);
+
 public:
   nsPresState();
   virtual ~nsPresState();
@@ -97,6 +99,19 @@ nsPresState::SetStateProperty(const nsAReadableString& aName, const nsAReadableS
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsPresState::RemoveStateProperty(const nsAReadableString& aName)
+{
+  if (!mPropertyTable)
+    return NS_OK;
+
+  nsAutoString keyStr(aName);
+  nsStringKey key(keyStr);
+
+  mPropertyTable->Remove(&key);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsPresState::GetStatePropertyAsSupports(const nsAReadableString& aName, nsISupports** aResult)
 {

layout/base/public/nsIPresState.h

@@ -21,6 +21,8 @@ public:
 			      nsAWritableString& aResult) = 0;
   NS_IMETHOD SetStateProperty(const nsAReadableString& aProperty,
 			      const nsAReadableString& aValue) = 0;
+
+  NS_IMETHOD RemoveStateProperty(const nsAReadableString& aName) = 0;
 };
 
 extern nsresult

layout/base/src/nsPresState.cpp

@@ -18,6 +18,8 @@ class nsPresState: public nsIPresState
   NS_IMETHOD GetStateProperty(const nsAReadableString& aProperty, nsAWritableString& aResult);
   NS_IMETHOD SetStateProperty(const nsAReadableString& aProperty, const nsAReadableString& aValue);
 
+  NS_IMETHOD RemoveStateProperty(const nsAReadableString& aProperty);
+
 public:
   nsPresState();
   virtual ~nsPresState();
@@ -97,6 +99,19 @@ nsPresState::SetStateProperty(const nsAReadableString& aName, const nsAReadableS
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsPresState::RemoveStateProperty(const nsAReadableString& aName)
+{
+  if (!mPropertyTable)
+    return NS_OK;
+
+  nsAutoString keyStr(aName);
+  nsStringKey key(keyStr);
+
+  mPropertyTable->Remove(&key);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsPresState::GetStatePropertyAsSupports(const nsAReadableString& aName, nsISupports** aResult)
 {

layout/generic/nsFrameFrame.cpp

@@ -64,6 +64,13 @@
 #include "nsXPIDLString.h"
 #include "nsIScrollable.h"
 
+#ifdef INCLUDE_XUL
+#include "nsIDOMXULElement.h"
+#include "nsIBoxObject.h"
+#include "nsIBrowserBoxObject.h"
+#include "nsISHistory.h"
+#endif
+
 class nsHTMLFrame;
 
 static NS_DEFINE_CID(kWebShellCID, NS_WEB_SHELL_CID);
@@ -458,16 +465,34 @@ nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame()
 {
    //printf("nsHTMLFrameInnerFrame destructor %X \n", this);
 
-   if(mSubShell)
-      mSubShell->Destroy();
-   mSubShell = nsnull; // This is the location it was released before...
-                        // Not sure if there is ordering depending on this.
+#ifdef INCLUDE_XUL
+  nsCOMPtr<nsIDOMXULElement> xulElt(do_QueryInterface(mContent));
+  if (xulElt && mSubShell) {
+    // We might be a XUL browser and may need to store the current URL in our box object.
+    nsCOMPtr<nsIBoxObject> boxObject;
+    xulElt->GetBoxObject(getter_AddRefs(boxObject));
+    if (boxObject) {
+      nsCOMPtr<nsIBrowserBoxObject> browser(do_QueryInterface(boxObject));
+      if (browser) {
+        nsCOMPtr<nsIWebNavigation> webShell(do_QueryInterface(mSubShell));
+        nsCOMPtr<nsISHistory> hist;
+        webShell->GetSessionHistory(getter_AddRefs(hist));
+        if (hist)
+          boxObject->SetPropertyAsSupports(NS_LITERAL_STRING("history"), hist);
+      }
+    }
+  }
+#endif
+ 
+  if(mSubShell)
+    mSubShell->Destroy();
+  mSubShell = nsnull; // This is the location it was released before...
+                      // Not sure if there is ordering depending on this.
 }
 
 PRBool nsHTMLFrameInnerFrame::GetURL(nsIContent* aContent, nsString& aResult)
 {
-  aResult.SetLength(0);     
-
+  aResult.SetLength(0);    
   if (NS_CONTENT_ATTR_HAS_VALUE == (aContent->GetAttribute(kNameSpaceID_None, nsHTMLAtoms::src, aResult))) {
     if (aResult.Length() > 0) {
       return PR_TRUE;
@@ -834,6 +859,38 @@ nsHTMLFrameInnerFrame::CreateDocShell(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+static PRBool CheckForBrowser(nsIContent* aContent, nsIBaseWindow* aShell)
+{
+#ifdef INCLUDE_XUL
+  nsCOMPtr<nsIDOMXULElement> xulElt(do_QueryInterface(aContent));
+  if (xulElt) {
+    // We might be a XUL browser and may have stored the URL in our box object.
+    nsCOMPtr<nsIBoxObject> boxObject;
+    xulElt->GetBoxObject(getter_AddRefs(boxObject));
+    if (boxObject) {
+      nsCOMPtr<nsIBrowserBoxObject> browser(do_QueryInterface(boxObject));
+      if (browser) {
+        nsCOMPtr<nsISupports> supp;
+        boxObject->GetPropertyAsSupports(NS_LITERAL_STRING("history"), getter_AddRefs(supp));
+        if (supp) {
+          nsCOMPtr<nsISHistory> hist(do_QueryInterface(supp));
+          if (hist) {
+            nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(aShell));
+            webNav->SetSessionHistory(hist);
+            nsCOMPtr<nsIWebNavigation> histNav(do_QueryInterface(hist));
+            histNav->Reload(0);
+            boxObject->RemoveProperty(NS_LITERAL_STRING("history"));
+          }
+        }
+          
+        return PR_FALSE;
+      }
+    }
+  }
+#endif
+  return PR_TRUE;
+}
+
 nsresult
 nsHTMLFrameInnerFrame::DoLoadURL(nsIPresContext* aPresContext)
 {
@@ -849,80 +906,84 @@ nsHTMLFrameInnerFrame::DoLoadURL(nsIPresContext* aPresContext)
   rv = GetParentContent(*getter_AddRefs(parentContent));
   NS_ENSURE_TRUE(NS_SUCCEEDED(rv) && parentContent, rv);
 
-  nsAutoString url;
-  GetURL(parentContent, url);
-  url.Trim(" \t\n\r");
-  if (url.IsEmpty())  // Load about:blank into a frame if not URL is specified (bug 35986)
-    url = NS_ConvertASCIItoUCS2("about:blank");
+  PRBool load = CheckForBrowser(parentContent, mSubShell);
 
-  // Make an absolute URL
-  nsCOMPtr<nsIURI> baseURL;
-  nsCOMPtr<nsIHTMLContent> htmlContent = do_QueryInterface(parentContent, &rv);
-  if (NS_SUCCEEDED(rv) && htmlContent) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURL));
-  }
-  else {
-    nsCOMPtr<nsIDocument> doc;
-    rv = parentContent->GetDocument(*getter_AddRefs(doc));
-    if (NS_SUCCEEDED(rv) && doc) {
-      doc->GetBaseURL(*getter_AddRefs(baseURL));
+  if (load) {
+    nsAutoString url;
+    GetURL(parentContent, url);
+    url.Trim(" \t\n\r");
+    if (url.IsEmpty())  // Load about:blank into a frame if not URL is specified (bug 35986)
+      url = NS_ConvertASCIItoUCS2("about:blank");
+
+    // Make an absolute URL
+    nsCOMPtr<nsIURI> baseURL;
+    nsCOMPtr<nsIHTMLContent> htmlContent = do_QueryInterface(parentContent, &rv);
+    if (NS_SUCCEEDED(rv) && htmlContent) {
+      htmlContent->GetBaseURL(*getter_AddRefs(baseURL));
     }
-  }
-  nsAutoString absURL;
-  rv = NS_MakeAbsoluteURI(absURL, url, baseURL);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIURI> uri;
-  NS_NewURI(getter_AddRefs(uri), absURL, nsnull);
-
-  // Check for security
-  NS_WITH_SERVICE(nsIScriptSecurityManager, secMan,
-                  NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // Get base URL
-  nsCOMPtr<nsIURI> baseURI;
-  rv = aPresContext->GetBaseURL(getter_AddRefs(baseURI));
-
-  // Get docshell and create load info
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(mSubShell));
-  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
-  nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
-  docShell->CreateLoadInfo(getter_AddRefs(loadInfo));
-  NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);
-
-  // Get referring URL
-  nsCOMPtr<nsIURI> referrer;
-  nsCOMPtr<nsIPrincipal> principal;
-  rv = secMan->GetSubjectPrincipal(getter_AddRefs(principal));
-  NS_ENSURE_SUCCESS(rv, rv);
-  // If we were called from script, get the referring URL from the script
-  if (principal) {
-    nsCOMPtr<nsICodebasePrincipal> codebase = do_QueryInterface(principal);
-    if (codebase) {
-      rv = codebase->GetURI(getter_AddRefs(referrer));
-      NS_ENSURE_SUCCESS(rv, rv);
+    else {
+      nsCOMPtr<nsIDocument> doc;
+      rv = parentContent->GetDocument(*getter_AddRefs(doc));
+      if (NS_SUCCEEDED(rv) && doc) {
+        doc->GetBaseURL(*getter_AddRefs(baseURL));
+      }
     }
-    // Pass the script principal to the docshell
-    nsCOMPtr<nsISupports> owner = do_QueryInterface(principal);
-    loadInfo->SetOwner(owner);
-  }
-  if (!referrer) { // We're not being called form script, tell the docshell
-                   // to inherit an owner from the current document.
-    loadInfo->SetInheritOwner(PR_TRUE);
-    referrer = baseURI;
-  }
+    nsAutoString absURL;
+    rv = NS_MakeAbsoluteURI(absURL, url, baseURL);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  // Check if we are allowed to load absURL
-  nsCOMPtr<nsIURI> newURI;
-  rv = NS_NewURI(getter_AddRefs(newURI), absURL, baseURI);
-  NS_ENSURE_SUCCESS(rv, rv);
-  rv = secMan->CheckLoadURI(referrer, newURI, PR_FALSE);
-  if (NS_FAILED(rv))
-    return rv; // We're not
+    nsCOMPtr<nsIURI> uri;
+    NS_NewURI(getter_AddRefs(uri), absURL, nsnull);
 
-  rv = docShell->LoadURI(uri, loadInfo, nsIWebNavigation::LOAD_FLAGS_NONE);
-  NS_ASSERTION(NS_SUCCEEDED(rv), "failed to load URL");
+    // Check for security
+    NS_WITH_SERVICE(nsIScriptSecurityManager, secMan,
+                    NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Get base URL
+    nsCOMPtr<nsIURI> baseURI;
+    rv = aPresContext->GetBaseURL(getter_AddRefs(baseURI));
+
+    // Get docshell and create load info
+    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(mSubShell));
+    NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+    nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
+    docShell->CreateLoadInfo(getter_AddRefs(loadInfo));
+    NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);
+
+    // Get referring URL
+    nsCOMPtr<nsIURI> referrer;
+    nsCOMPtr<nsIPrincipal> principal;
+    rv = secMan->GetSubjectPrincipal(getter_AddRefs(principal));
+    NS_ENSURE_SUCCESS(rv, rv);
+    // If we were called from script, get the referring URL from the script
+    if (principal) {
+      nsCOMPtr<nsICodebasePrincipal> codebase = do_QueryInterface(principal);
+      if (codebase) {
+        rv = codebase->GetURI(getter_AddRefs(referrer));
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+      // Pass the script principal to the docshell
+      nsCOMPtr<nsISupports> owner = do_QueryInterface(principal);
+      loadInfo->SetOwner(owner);
+    }
+    if (!referrer) { // We're not being called form script, tell the docshell
+                     // to inherit an owner from the current document.
+      loadInfo->SetInheritOwner(PR_TRUE);
+      referrer = baseURI;
+    }
+
+    // Check if we are allowed to load absURL
+    nsCOMPtr<nsIURI> newURI;
+    rv = NS_NewURI(getter_AddRefs(newURI), absURL, baseURI);
+    NS_ENSURE_SUCCESS(rv, rv);
+    rv = secMan->CheckLoadURI(referrer, newURI, PR_FALSE);
+    if (NS_FAILED(rv))
+      return rv; // We're not
+
+    rv = docShell->LoadURI(uri, loadInfo, nsIWebNavigation::LOAD_FLAGS_NONE);
+    NS_ASSERTION(NS_SUCCEEDED(rv), "failed to load URL");
+  }
 
   return rv;
 }

layout/html/document/src/nsFrameFrame.cpp

@@ -64,6 +64,13 @@
 #include "nsXPIDLString.h"
 #include "nsIScrollable.h"
 
+#ifdef INCLUDE_XUL
+#include "nsIDOMXULElement.h"
+#include "nsIBoxObject.h"
+#include "nsIBrowserBoxObject.h"
+#include "nsISHistory.h"
+#endif
+
 class nsHTMLFrame;
 
 static NS_DEFINE_CID(kWebShellCID, NS_WEB_SHELL_CID);
@@ -458,16 +465,34 @@ nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame()
 {
    //printf("nsHTMLFrameInnerFrame destructor %X \n", this);
 
-   if(mSubShell)
-      mSubShell->Destroy();
-   mSubShell = nsnull; // This is the location it was released before...
-                        // Not sure if there is ordering depending on this.
+#ifdef INCLUDE_XUL
+  nsCOMPtr<nsIDOMXULElement> xulElt(do_QueryInterface(mContent));
+  if (xulElt && mSubShell) {
+    // We might be a XUL browser and may need to store the current URL in our box object.
+    nsCOMPtr<nsIBoxObject> boxObject;
+    xulElt->GetBoxObject(getter_AddRefs(boxObject));
+    if (boxObject) {
+      nsCOMPtr<nsIBrowserBoxObject> browser(do_QueryInterface(boxObject));
+      if (browser) {
+        nsCOMPtr<nsIWebNavigation> webShell(do_QueryInterface(mSubShell));
+        nsCOMPtr<nsISHistory> hist;
+        webShell->GetSessionHistory(getter_AddRefs(hist));
+        if (hist)
+          boxObject->SetPropertyAsSupports(NS_LITERAL_STRING("history"), hist);
+      }
+    }
+  }
+#endif
+ 
+  if(mSubShell)
+    mSubShell->Destroy();
+  mSubShell = nsnull; // This is the location it was released before...
+                      // Not sure if there is ordering depending on this.
 }
 
 PRBool nsHTMLFrameInnerFrame::GetURL(nsIContent* aContent, nsString& aResult)
 {
-  aResult.SetLength(0);     
-
+  aResult.SetLength(0);    
   if (NS_CONTENT_ATTR_HAS_VALUE == (aContent->GetAttribute(kNameSpaceID_None, nsHTMLAtoms::src, aResult))) {
     if (aResult.Length() > 0) {
       return PR_TRUE;
@@ -834,6 +859,38 @@ nsHTMLFrameInnerFrame::CreateDocShell(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+static PRBool CheckForBrowser(nsIContent* aContent, nsIBaseWindow* aShell)
+{
+#ifdef INCLUDE_XUL
+  nsCOMPtr<nsIDOMXULElement> xulElt(do_QueryInterface(aContent));
+  if (xulElt) {
+    // We might be a XUL browser and may have stored the URL in our box object.
+    nsCOMPtr<nsIBoxObject> boxObject;
+    xulElt->GetBoxObject(getter_AddRefs(boxObject));
+    if (boxObject) {
+      nsCOMPtr<nsIBrowserBoxObject> browser(do_QueryInterface(boxObject));
+      if (browser) {
+        nsCOMPtr<nsISupports> supp;
+        boxObject->GetPropertyAsSupports(NS_LITERAL_STRING("history"), getter_AddRefs(supp));
+        if (supp) {
+          nsCOMPtr<nsISHistory> hist(do_QueryInterface(supp));
+          if (hist) {
+            nsCOMPtr<nsIWebNavigation> webNav(do_QueryInterface(aShell));
+            webNav->SetSessionHistory(hist);
+            nsCOMPtr<nsIWebNavigation> histNav(do_QueryInterface(hist));
+            histNav->Reload(0);
+            boxObject->RemoveProperty(NS_LITERAL_STRING("history"));
+          }
+        }
+          
+        return PR_FALSE;
+      }
+    }
+  }
+#endif
+  return PR_TRUE;
+}
+
 nsresult
 nsHTMLFrameInnerFrame::DoLoadURL(nsIPresContext* aPresContext)
 {
@@ -849,80 +906,84 @@ nsHTMLFrameInnerFrame::DoLoadURL(nsIPresContext* aPresContext)
   rv = GetParentContent(*getter_AddRefs(parentContent));
   NS_ENSURE_TRUE(NS_SUCCEEDED(rv) && parentContent, rv);
 
-  nsAutoString url;
-  GetURL(parentContent, url);
-  url.Trim(" \t\n\r");
-  if (url.IsEmpty())  // Load about:blank into a frame if not URL is specified (bug 35986)
-    url = NS_ConvertASCIItoUCS2("about:blank");
+  PRBool load = CheckForBrowser(parentContent, mSubShell);
 
-  // Make an absolute URL
-  nsCOMPtr<nsIURI> baseURL;
-  nsCOMPtr<nsIHTMLContent> htmlContent = do_QueryInterface(parentContent, &rv);
-  if (NS_SUCCEEDED(rv) && htmlContent) {
-    htmlContent->GetBaseURL(*getter_AddRefs(baseURL));
-  }
-  else {
-    nsCOMPtr<nsIDocument> doc;
-    rv = parentContent->GetDocument(*getter_AddRefs(doc));
-    if (NS_SUCCEEDED(rv) && doc) {
-      doc->GetBaseURL(*getter_AddRefs(baseURL));
+  if (load) {
+    nsAutoString url;
+    GetURL(parentContent, url);
+    url.Trim(" \t\n\r");
+    if (url.IsEmpty())  // Load about:blank into a frame if not URL is specified (bug 35986)
+      url = NS_ConvertASCIItoUCS2("about:blank");
+
+    // Make an absolute URL
+    nsCOMPtr<nsIURI> baseURL;
+    nsCOMPtr<nsIHTMLContent> htmlContent = do_QueryInterface(parentContent, &rv);
+    if (NS_SUCCEEDED(rv) && htmlContent) {
+      htmlContent->GetBaseURL(*getter_AddRefs(baseURL));
     }
-  }
-  nsAutoString absURL;
-  rv = NS_MakeAbsoluteURI(absURL, url, baseURL);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIURI> uri;
-  NS_NewURI(getter_AddRefs(uri), absURL, nsnull);
-
-  // Check for security
-  NS_WITH_SERVICE(nsIScriptSecurityManager, secMan,
-                  NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // Get base URL
-  nsCOMPtr<nsIURI> baseURI;
-  rv = aPresContext->GetBaseURL(getter_AddRefs(baseURI));
-
-  // Get docshell and create load info
-  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(mSubShell));
-  NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
-  nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
-  docShell->CreateLoadInfo(getter_AddRefs(loadInfo));
-  NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);
-
-  // Get referring URL
-  nsCOMPtr<nsIURI> referrer;
-  nsCOMPtr<nsIPrincipal> principal;
-  rv = secMan->GetSubjectPrincipal(getter_AddRefs(principal));
-  NS_ENSURE_SUCCESS(rv, rv);
-  // If we were called from script, get the referring URL from the script
-  if (principal) {
-    nsCOMPtr<nsICodebasePrincipal> codebase = do_QueryInterface(principal);
-    if (codebase) {
-      rv = codebase->GetURI(getter_AddRefs(referrer));
-      NS_ENSURE_SUCCESS(rv, rv);
+    else {
+      nsCOMPtr<nsIDocument> doc;
+      rv = parentContent->GetDocument(*getter_AddRefs(doc));
+      if (NS_SUCCEEDED(rv) && doc) {
+        doc->GetBaseURL(*getter_AddRefs(baseURL));
+      }
     }
-    // Pass the script principal to the docshell
-    nsCOMPtr<nsISupports> owner = do_QueryInterface(principal);
-    loadInfo->SetOwner(owner);
-  }
-  if (!referrer) { // We're not being called form script, tell the docshell
-                   // to inherit an owner from the current document.
-    loadInfo->SetInheritOwner(PR_TRUE);
-    referrer = baseURI;
-  }
+    nsAutoString absURL;
+    rv = NS_MakeAbsoluteURI(absURL, url, baseURL);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  // Check if we are allowed to load absURL
-  nsCOMPtr<nsIURI> newURI;
-  rv = NS_NewURI(getter_AddRefs(newURI), absURL, baseURI);
-  NS_ENSURE_SUCCESS(rv, rv);
-  rv = secMan->CheckLoadURI(referrer, newURI, PR_FALSE);
-  if (NS_FAILED(rv))
-    return rv; // We're not
+    nsCOMPtr<nsIURI> uri;
+    NS_NewURI(getter_AddRefs(uri), absURL, nsnull);
 
-  rv = docShell->LoadURI(uri, loadInfo, nsIWebNavigation::LOAD_FLAGS_NONE);
-  NS_ASSERTION(NS_SUCCEEDED(rv), "failed to load URL");
+    // Check for security
+    NS_WITH_SERVICE(nsIScriptSecurityManager, secMan,
+                    NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Get base URL
+    nsCOMPtr<nsIURI> baseURI;
+    rv = aPresContext->GetBaseURL(getter_AddRefs(baseURI));
+
+    // Get docshell and create load info
+    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(mSubShell));
+    NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
+    nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
+    docShell->CreateLoadInfo(getter_AddRefs(loadInfo));
+    NS_ENSURE_TRUE(loadInfo, NS_ERROR_FAILURE);
+
+    // Get referring URL
+    nsCOMPtr<nsIURI> referrer;
+    nsCOMPtr<nsIPrincipal> principal;
+    rv = secMan->GetSubjectPrincipal(getter_AddRefs(principal));
+    NS_ENSURE_SUCCESS(rv, rv);
+    // If we were called from script, get the referring URL from the script
+    if (principal) {
+      nsCOMPtr<nsICodebasePrincipal> codebase = do_QueryInterface(principal);
+      if (codebase) {
+        rv = codebase->GetURI(getter_AddRefs(referrer));
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
+      // Pass the script principal to the docshell
+      nsCOMPtr<nsISupports> owner = do_QueryInterface(principal);
+      loadInfo->SetOwner(owner);
+    }
+    if (!referrer) { // We're not being called form script, tell the docshell
+                     // to inherit an owner from the current document.
+      loadInfo->SetInheritOwner(PR_TRUE);
+      referrer = baseURI;
+    }
+
+    // Check if we are allowed to load absURL
+    nsCOMPtr<nsIURI> newURI;
+    rv = NS_NewURI(getter_AddRefs(newURI), absURL, baseURI);
+    NS_ENSURE_SUCCESS(rv, rv);
+    rv = secMan->CheckLoadURI(referrer, newURI, PR_FALSE);
+    if (NS_FAILED(rv))
+      return rv; // We're not
+
+    rv = docShell->LoadURI(uri, loadInfo, nsIWebNavigation::LOAD_FLAGS_NONE);
+    NS_ASSERTION(NS_SUCCEEDED(rv), "failed to load URL");
+  }
 
   return rv;
 }

layout/xul/base/public/nsIBoxObject.idl

@@ -36,6 +36,12 @@ interface nsIBoxObject : nsISupports
   readonly attribute long y;
   readonly attribute long width;
   readonly attribute long height;
+
+  nsISupports getPropertyAsSupports(in wstring propertyName);
+  void setPropertyAsSupports(in wstring propertyName, in nsISupports value);
+  wstring getProperty(in wstring propertyName);
+  void setProperty(in wstring propertyName, in wstring propertyValue);
+  void removeProperty(in wstring propertyName);
 };
 
 %{C++

layout/xul/base/src/nsBoxObject.cpp

@@ -32,6 +32,7 @@
 #include "nsIContent.h"
 #include "nsIStyleContext.h"
 #include "nsIFrame.h"
+#include "nsXPIDLString.h"
 
 // Static IIDs/CIDs. Try to minimize these.
 // None so far.
@@ -97,6 +98,7 @@ nsBoxObject::Init(nsIContent* aContent, nsIPresShell* aShell)
 NS_IMETHODIMP
 nsBoxObject::SetDocument(nsIDocument* aDocument)
 {
+  mPresState = nsnull;
   if (aDocument) {
     nsCOMPtr<nsIPresShell> shell = getter_AddRefs(aDocument->GetShellAt(0));
     mPresShell = shell;
@@ -263,6 +265,66 @@ nsBoxObject::GetHeight(PRInt32* aResult)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsBoxObject::GetPropertyAsSupports(const PRUnichar* aPropertyName, nsISupports** aResult)
+{
+  if (!mPresState) {
+    *aResult = nsnull;
+    return NS_OK;
+  }
+
+  nsAutoString propertyName(aPropertyName);
+  return mPresState->GetStatePropertyAsSupports(propertyName, aResult); // Addref here.
+}
+
+NS_IMETHODIMP
+nsBoxObject::SetPropertyAsSupports(const PRUnichar* aPropertyName, nsISupports* aValue)
+{
+  if (!mPresState)
+    NS_NewPresState(getter_AddRefs(mPresState));
+
+  nsAutoString propertyName(aPropertyName);
+  return mPresState->SetStatePropertyAsSupports(propertyName, aValue);
+}
+
+NS_IMETHODIMP
+nsBoxObject::GetProperty(const PRUnichar* aPropertyName, PRUnichar** aResult)
+{
+  if (!mPresState) {
+    *aResult = nsnull;
+    return NS_OK;
+  }
+
+  nsAutoString propertyName(aPropertyName);
+  nsAutoString result;
+  nsresult rv = mPresState->GetStateProperty(propertyName, result);
+  if (NS_FAILED(rv))
+    return rv;
+  *aResult = nsXPIDLString::Copy(result.GetUnicode());
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsBoxObject::SetProperty(const PRUnichar* aPropertyName, const PRUnichar* aPropertyValue)
+{
+  if (!mPresState)
+    NS_NewPresState(getter_AddRefs(mPresState));
+
+  nsAutoString propertyName(aPropertyName);
+  nsAutoString propertyValue(aPropertyValue);
+  return mPresState->SetStateProperty(propertyName, propertyValue);
+}
+
+NS_IMETHODIMP
+nsBoxObject::RemoveProperty(const PRUnichar* aPropertyName)
+{
+  if (!mPresState)
+    return NS_OK;
+
+  nsAutoString propertyName(aPropertyName);
+  return mPresState->RemoveStateProperty(propertyName);
+}
+
 /* string canCreateWrapper (in nsIIDPtr iid); */
 NS_IMETHODIMP nsBoxObject::CanCreateWrapper(const nsIID * iid, char **_retval)
 {

layout/xul/base/src/nsBoxObject.h

@@ -24,6 +24,7 @@
 #include "nsCOMPtr.h"
 #include "nsIBoxObject.h"
 #include "nsPIBoxObject.h"
+#include "nsIPresState.h"
 
 class nsIBoxLayoutManager;
 class nsIBoxPaintManager;
@@ -51,6 +52,8 @@ public:
 protected: 
   nsCOMPtr<nsIBoxLayoutManager> mLayoutManager; // [OWNER]
   nsCOMPtr<nsIBoxPaintManager> mPaintManager; // [OWNER]
+  nsCOMPtr<nsIPresState> mPresState; // [OWNER]
+
   nsIContent* mContent; // [WEAK]
   nsIPresShell* mPresShell; // [WEAK]
 };

layout/xul/base/src/nsBrowserBoxObject.cpp

@@ -27,6 +27,7 @@
 #include "nsIPresShell.h"
 #include "nsIFrame.h"
 #include "nsIDocShell.h"
+#include "nsXPIDLString.h"
 
 class nsBrowserBoxObject : public nsIBrowserBoxObject, public nsBoxObject
 {
@@ -38,6 +39,7 @@ public:
   virtual ~nsBrowserBoxObject();
   
 protected:
+  nsString* mSrcURL;
 };
 
 /* Implementation file */
@@ -60,6 +62,7 @@ nsBrowserBoxObject::QueryInterface(REFNSIID iid, void** aResult)
 }
   
 nsBrowserBoxObject::nsBrowserBoxObject()
+:mSrcURL(nsnull)
 {
   NS_INIT_ISUPPORTS();
 }
@@ -67,6 +70,7 @@ nsBrowserBoxObject::nsBrowserBoxObject()
 nsBrowserBoxObject::~nsBrowserBoxObject()
 {
   /* destructor code */
+  delete mSrcURL;
 }
 
 /* void openBrowser (in boolean openFlag); */

layout/xul/base/src/nsMenuFrame.cpp

@@ -1469,7 +1469,10 @@ nsMenuFrame::Execute()
   // Get our own content node and hold on to it to keep it from going away.
   nsCOMPtr<nsIContent> content = dont_QueryInterface(mContent);
 
-  // First hide all of the open menus.
+  // Deselect ourselves.
+  SelectMenu(PR_FALSE);
+
+  // Now hide all of the open menus.
   if (mMenuParent)
     mMenuParent->HideChain();
 

layout/xul/base/src/nsPopupSetFrame.cpp

@@ -569,7 +569,7 @@ nsPopupSetFrame::OpenPopup(PRBool aActivateFlag)
 
   }
   else {
-    if (!OnDestroy())
+    if (mCreateHandlerSucceeded && !OnDestroy())
       return;
 
     // Unregister, but not if we're a tooltip

xpfe/global/resources/content/treeBindings.xml

@@ -419,7 +419,7 @@
       <handler event="click" clickcount="2">
       <![CDATA[
          if (event.originalTarget.localName == 'treecell') {
-           var n = event.target.parentNode.parentNode;
+           var n = event.originalTarget.parentNode.parentNode;
            n.toggleOpenState();
          }
       ]]>

xpfe/global/resources/content/xulBindings.xml

@@ -316,6 +316,13 @@
         }
       ]]>
       </handler>
+      <!-- Ensure that our state gets saved/restored across skin switches. -->
+       <handler event="bindingattached" action="var str = this.boxObject.getProperty('value'); 
+                                                if (str) {
+                                                  this.inputField.value=str;
+                                                  this.boxObject.removeProperty('value');
+                                                }"/>
+       <handler event="bindingdetached" action="if (this.inputField.value) this.boxObject.setProperty('value', this.inputField.value);"/>
    </handlers>    
   </binding>