From bbbe659e65b0d8a3f460849b835b083ae1797d95 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Wed, 13 Jan 2010 11:30:10 -0500
Subject: [PATCH] Bug 514300 part 1.  Use the owner document to look for the
 binding manager.  r=sicking

---
 layout/xul/base/src/crashtests/514300-1.xul    | 14 ++++++++++++++
 layout/xul/base/src/crashtests/crashtests.list |  1 +
 layout/xul/base/src/nsListBoxObject.cpp        |  2 +-
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 layout/xul/base/src/crashtests/514300-1.xul

diff --git a/layout/xul/base/src/crashtests/514300-1.xul b/layout/xul/base/src/crashtests/514300-1.xul
new file mode 100644
index 000000000000..d0d655011e59
--- /dev/null
+++ b/layout/xul/base/src/crashtests/514300-1.xul
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('listbox').removeChild(document.getElementById('span'));">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listitem></content>
+  </binding>
+</bindings>
+
+<listbox id="listbox" style="-moz-binding: url(#foo)"><span xmlns="http://www.w3.org/1999/xhtml" id="span"/></listbox>
+
+</window>
diff --git a/layout/xul/base/src/crashtests/crashtests.list b/layout/xul/base/src/crashtests/crashtests.list
index 579f2cea9822..96c8eb48af60 100644
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -68,4 +68,5 @@ load 488210-1.xhtml
 load 495728-1.xul
 load 508927-1.xul
 load 508927-2.xul
+load 514300-1.xul
 load 536931-1.xhtml
diff --git a/layout/xul/base/src/nsListBoxObject.cpp b/layout/xul/base/src/nsListBoxObject.cpp
index b4c9222c3386..af418255dcc0 100644
--- a/layout/xul/base/src/nsListBoxObject.cpp
+++ b/layout/xul/base/src/nsListBoxObject.cpp
@@ -163,7 +163,7 @@ FindBodyContent(nsIContent* aParent, nsIContent** aResult)
   }
   else {
     nsCOMPtr<nsIDOMNodeList> kids;
-    aParent->GetDocument()->BindingManager()->GetXBLChildNodesFor(aParent, getter_AddRefs(kids));
+    aParent->GetOwnerDoc()->BindingManager()->GetXBLChildNodesFor(aParent, getter_AddRefs(kids));
     if (!kids) return;
 
     PRUint32 i;