diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index b89099a650e6..965e2ac38cef 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -111,6 +111,7 @@
 #include "nsIDOMWindow.h"
 
 #include "nsIDOMElement.h"
+#include "nsIAnonymousContentCreator.h"
 
 static NS_DEFINE_CID(kXIFConverterCID, NS_XIFCONVERTER_CID);
 static NS_DEFINE_CID(kCRangeCID, NS_RANGE_CID);
@@ -1687,6 +1688,28 @@ nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject *aScriptGlobalObject)
         content->SetDocument(nsnull, PR_TRUE, PR_TRUE);
       }
     }
+
+    // XXX You thought that was a hack?  Let's unroot the scrollbars
+    // around the root element.  The frame that created the anonymous
+    // content for them isn't the primary frame for any element, so
+    // we do it here.  This tries not to have too much knowledge of
+    // how scrollbars are implemented today by actually checking all
+    // the frames up to the top.
+    nsCOMPtr<nsIPresShell> shell( dont_AddRef(GetShellAt(0)) );
+    if (shell) {
+      nsIFrame *kidFrame = nsnull;
+      shell->GetPrimaryFrameFor(mRootContent, &kidFrame);
+      while (kidFrame) {
+        // XXX Don't release a frame!
+        nsCOMPtr<nsIAnonymousContentCreator> acc( do_QueryInterface(kidFrame) );
+        if (acc) {
+          acc->SetDocumentForAnonymousContent(nsnull, PR_TRUE, PR_TRUE);
+        }
+        nsIFrame *parentFrame;
+        kidFrame->GetParent(&parentFrame);
+        kidFrame = parentFrame;
+      }
+    }
   }
 
   mScriptGlobalObject = aScriptGlobalObject;
diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 61066a7ad132..14fa33f0647b 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -68,6 +68,8 @@
 #include "nsIDOMViewCSS.h"
 #include "nsIXBLService.h"
 
+#include "nsIAnonymousContentCreator.h"
+
 #include "nsLayoutAtoms.h"
 #include "nsHTMLAtoms.h"
 #include "nsLayoutUtils.h"
@@ -1255,18 +1257,43 @@ nsGenericElement::SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aComp
       }
     }
     
-    if (mDocument) {
+    if (mDocument && aDeep) {
+
+      // call SetDocument for XBL anonymous content
+
       nsCOMPtr<nsIBindingManager> bindingManager;
       mDocument->GetBindingManager(getter_AddRefs(bindingManager));
-      nsCOMPtr<nsIXBLBinding> binding;
-      bindingManager->GetBinding(mContent, getter_AddRefs(binding));
-      if (binding) {
-        binding->ChangeDocument(mDocument, aDocument);
-        bindingManager->SetBinding(mContent, nsnull);
-        if (aDocument) {
-          nsCOMPtr<nsIBindingManager> otherManager;
-          aDocument->GetBindingManager(getter_AddRefs(otherManager));
-          otherManager->SetBinding(mContent, binding);
+      NS_ASSERTION(bindingManager, "No binding manager.");
+      if (bindingManager) {
+        nsCOMPtr<nsIXBLBinding> binding;
+        bindingManager->GetBinding(mContent, getter_AddRefs(binding));
+        if (binding) {
+          binding->ChangeDocument(mDocument, aDocument);
+          bindingManager->SetBinding(mContent, nsnull);
+          if (aDocument) {
+            nsCOMPtr<nsIBindingManager> otherManager;
+            aDocument->GetBindingManager(getter_AddRefs(otherManager));
+            otherManager->SetBinding(mContent, binding);
+          }
+        }
+      }
+
+      // call SetDocument for nsIAnonymousContentCreator anonymous content
+
+      // XXX It would slightly help performance to use the same list of
+      // tags as used in nsCSSFrameConstructor::CreateAnonymousFrames,
+      // but that doesn't work for nsGfxScrollFrames.
+
+      nsCOMPtr<nsIPresShell> shell( dont_AddRef(mDocument->GetShellAt(0)) );
+      if (shell) {
+        nsIFrame* frame = nsnull;
+        shell->GetPrimaryFrameFor(mContent, &frame);
+        if (frame) {
+          // XXX nsCOMPtrs for frames are evil...
+          nsCOMPtr<nsIAnonymousContentCreator> creator(do_QueryInterface(frame));
+          if (creator) {
+            creator->SetDocumentForAnonymousContent(aDocument, aDeep, aCompileEventHandlers);
+          }
         }
       }
     }
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index e6855b369464..41b637aac071 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -298,36 +298,6 @@ nsHTMLInputElement::SetParent(nsIContent* aParent)
 NS_IMETHODIMP
 nsHTMLInputElement::SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aCompileEventHandlers)
 {
-#ifdef ENDER_LITE
-  // We must tell the anonymous content to remove roots holding their
-  // JS Objects
-  // XXX This is somewhat ugly, and could go away if the anonymous
-  // content creation is done in XBL.
-  if (!aDocument && aDeep) {
-    nsIFormControlFrame* formControlFrame = nsnull;
-    // Note that we'll call GetPrimaryFrame() with aFlushNotifications
-    // set to false. Flushing now causes evil interactions with the
-    // content sink (see bug 45568). Furthermore, if the frame has
-    // never been created, then the nsIEditor won't have been created,
-    // so there'd be no work to do anyway.
-    nsresult rv = nsGenericHTMLElement::GetPrimaryFrame(this, formControlFrame, PR_FALSE);
-    if (NS_SUCCEEDED(rv) && formControlFrame) {
-      nsCOMPtr<textControlPlace> textControlFrame(do_QueryInterface(formControlFrame));
-      if (textControlFrame) {
-        nsCOMPtr<nsIEditor> editor;
-        textControlFrame->GetEditor(getter_AddRefs(editor));
-        if (editor) {
-          nsCOMPtr<nsIDOMElement> root;
-          editor->GetRootElement(getter_AddRefs(root));
-          if (root) {
-            nsCOMPtr<nsIContent> rootContent( do_QueryInterface(root) );
-            rootContent->SetDocument(nsnull, PR_TRUE, PR_TRUE);
-          }
-        }
-      }
-    }
-  }
-#endif
   return mInner.SetDocumentForFormControls(aDocument, aDeep, aCompileEventHandlers, this, mForm);
 }
 
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 035593531d69..23ae7dff263e 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5350,9 +5350,16 @@ nsCSSFrameConstructor::CreateAnonymousFrames(nsIPresShell*        aPresShell,
       return NS_OK;
     }
   }
-  // if we have no anonymous content from XBL see if we have some from these tags.
-  // only these tags types can have anonymous content. We do this check for performance
-  // reasons. If we did a query interface on every tag it would be very inefficient.
+  // If we have no anonymous content from XBL see if we might have
+  // some by looking at the tag rather than doing a QueryInterface on
+  // the frame.  Only these tags' frames can have anonymous content
+  // through nsIAnonymousContentCreator.  We do this check for
+  // performance reasons. If we did a QueryInterface on every tag it
+  // would be inefficient.
+
+  // nsGenericElement::SetDocument ought to keep a list like this one,
+  // but it can't because nsGfxScrollFrames get around this.
+
   if (aTag !=  nsHTMLAtoms::input &&
       aTag !=  nsHTMLAtoms::textarea &&
       aTag !=  nsHTMLAtoms::combobox &&
diff --git a/layout/base/src/nsDocument.cpp b/layout/base/src/nsDocument.cpp
index b89099a650e6..965e2ac38cef 100644
--- a/layout/base/src/nsDocument.cpp
+++ b/layout/base/src/nsDocument.cpp
@@ -111,6 +111,7 @@
 #include "nsIDOMWindow.h"
 
 #include "nsIDOMElement.h"
+#include "nsIAnonymousContentCreator.h"
 
 static NS_DEFINE_CID(kXIFConverterCID, NS_XIFCONVERTER_CID);
 static NS_DEFINE_CID(kCRangeCID, NS_RANGE_CID);
@@ -1687,6 +1688,28 @@ nsDocument::SetScriptGlobalObject(nsIScriptGlobalObject *aScriptGlobalObject)
         content->SetDocument(nsnull, PR_TRUE, PR_TRUE);
       }
     }
+
+    // XXX You thought that was a hack?  Let's unroot the scrollbars
+    // around the root element.  The frame that created the anonymous
+    // content for them isn't the primary frame for any element, so
+    // we do it here.  This tries not to have too much knowledge of
+    // how scrollbars are implemented today by actually checking all
+    // the frames up to the top.
+    nsCOMPtr<nsIPresShell> shell( dont_AddRef(GetShellAt(0)) );
+    if (shell) {
+      nsIFrame *kidFrame = nsnull;
+      shell->GetPrimaryFrameFor(mRootContent, &kidFrame);
+      while (kidFrame) {
+        // XXX Don't release a frame!
+        nsCOMPtr<nsIAnonymousContentCreator> acc( do_QueryInterface(kidFrame) );
+        if (acc) {
+          acc->SetDocumentForAnonymousContent(nsnull, PR_TRUE, PR_TRUE);
+        }
+        nsIFrame *parentFrame;
+        kidFrame->GetParent(&parentFrame);
+        kidFrame = parentFrame;
+      }
+    }
   }
 
   mScriptGlobalObject = aScriptGlobalObject;
diff --git a/layout/base/src/nsGenericElement.cpp b/layout/base/src/nsGenericElement.cpp
index 61066a7ad132..14fa33f0647b 100644
--- a/layout/base/src/nsGenericElement.cpp
+++ b/layout/base/src/nsGenericElement.cpp
@@ -68,6 +68,8 @@
 #include "nsIDOMViewCSS.h"
 #include "nsIXBLService.h"
 
+#include "nsIAnonymousContentCreator.h"
+
 #include "nsLayoutAtoms.h"
 #include "nsHTMLAtoms.h"
 #include "nsLayoutUtils.h"
@@ -1255,18 +1257,43 @@ nsGenericElement::SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aComp
       }
     }
     
-    if (mDocument) {
+    if (mDocument && aDeep) {
+
+      // call SetDocument for XBL anonymous content
+
       nsCOMPtr<nsIBindingManager> bindingManager;
       mDocument->GetBindingManager(getter_AddRefs(bindingManager));
-      nsCOMPtr<nsIXBLBinding> binding;
-      bindingManager->GetBinding(mContent, getter_AddRefs(binding));
-      if (binding) {
-        binding->ChangeDocument(mDocument, aDocument);
-        bindingManager->SetBinding(mContent, nsnull);
-        if (aDocument) {
-          nsCOMPtr<nsIBindingManager> otherManager;
-          aDocument->GetBindingManager(getter_AddRefs(otherManager));
-          otherManager->SetBinding(mContent, binding);
+      NS_ASSERTION(bindingManager, "No binding manager.");
+      if (bindingManager) {
+        nsCOMPtr<nsIXBLBinding> binding;
+        bindingManager->GetBinding(mContent, getter_AddRefs(binding));
+        if (binding) {
+          binding->ChangeDocument(mDocument, aDocument);
+          bindingManager->SetBinding(mContent, nsnull);
+          if (aDocument) {
+            nsCOMPtr<nsIBindingManager> otherManager;
+            aDocument->GetBindingManager(getter_AddRefs(otherManager));
+            otherManager->SetBinding(mContent, binding);
+          }
+        }
+      }
+
+      // call SetDocument for nsIAnonymousContentCreator anonymous content
+
+      // XXX It would slightly help performance to use the same list of
+      // tags as used in nsCSSFrameConstructor::CreateAnonymousFrames,
+      // but that doesn't work for nsGfxScrollFrames.
+
+      nsCOMPtr<nsIPresShell> shell( dont_AddRef(mDocument->GetShellAt(0)) );
+      if (shell) {
+        nsIFrame* frame = nsnull;
+        shell->GetPrimaryFrameFor(mContent, &frame);
+        if (frame) {
+          // XXX nsCOMPtrs for frames are evil...
+          nsCOMPtr<nsIAnonymousContentCreator> creator(do_QueryInterface(frame));
+          if (creator) {
+            creator->SetDocumentForAnonymousContent(aDocument, aDeep, aCompileEventHandlers);
+          }
         }
       }
     }
diff --git a/layout/forms/nsComboboxControlFrame.cpp b/layout/forms/nsComboboxControlFrame.cpp
index 954ceb8cf2c4..d8c532b56410 100644
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -2206,6 +2206,16 @@ nsComboboxControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsComboboxControlFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                       PRBool aDeep,
+                                                       PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
+
 NS_IMETHODIMP 
 nsComboboxControlFrame::CreateFrameFor(nsIPresContext*   aPresContext,
                                        nsIContent *      aContent,
diff --git a/layout/forms/nsComboboxControlFrame.h b/layout/forms/nsComboboxControlFrame.h
index 7449a20bb153..236454838540 100644
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -79,6 +79,9 @@ public:
    // nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame);
diff --git a/layout/forms/nsFileControlFrame.cpp b/layout/forms/nsFileControlFrame.cpp
index aaf225d9bdce..0deec71b9449 100644
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -155,6 +155,15 @@ nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsFileControlFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                   PRBool aDeep,
+                                                   PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
 // Frames are not refcounted, no need to AddRef
 NS_IMETHODIMP
 nsFileControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
diff --git a/layout/forms/nsFileControlFrame.h b/layout/forms/nsFileControlFrame.h
index d788e171bad1..86d9dcc79391 100644
--- a/layout/forms/nsFileControlFrame.h
+++ b/layout/forms/nsFileControlFrame.h
@@ -125,6 +125,9 @@ public:
   // from nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }
diff --git a/layout/forms/nsGfxButtonControlFrame.cpp b/layout/forms/nsGfxButtonControlFrame.cpp
index e03c555f8c9a..40602459002b 100644
--- a/layout/forms/nsGfxButtonControlFrame.cpp
+++ b/layout/forms/nsGfxButtonControlFrame.cpp
@@ -397,6 +397,15 @@ nsGfxButtonControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return result;
 }
 
+NS_IMETHODIMP
+nsGfxButtonControlFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                        PRBool aDeep,
+                                                        PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
 // Frames are not refcounted, no need to AddRef
 NS_IMETHODIMP
 nsGfxButtonControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
diff --git a/layout/forms/nsGfxButtonControlFrame.h b/layout/forms/nsGfxButtonControlFrame.h
index ec889e1b1e02..12531898a1ba 100644
--- a/layout/forms/nsGfxButtonControlFrame.h
+++ b/layout/forms/nsGfxButtonControlFrame.h
@@ -68,6 +68,9 @@ public:
   // nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 146aa27c335d..dc066351860a 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -444,6 +444,40 @@ nsGfxScrollFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsGfxScrollFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                 PRBool aDeep,
+                                                 PRBool aCompileEventHandlers)
+{
+  // XXX Propogate return values?? (but don't stop part way through)
+
+  if (mInner->mHScrollbarBox) {
+    nsIFrame* hframe = nsnull;
+    mInner->mHScrollbarBox->GetFrame(&hframe);
+    if (hframe) {
+      nsCOMPtr<nsIContent> hcontent;
+      hframe->GetContent(getter_AddRefs(hcontent));
+      if (hcontent) {
+        hcontent->SetDocument(aDocument, aDeep, aCompileEventHandlers);
+      }
+    }
+  }
+
+  if (mInner->mHScrollbarBox) {
+    nsIFrame* vframe = nsnull;
+    mInner->mVScrollbarBox->GetFrame(&vframe);
+    if (vframe) {
+      nsCOMPtr<nsIContent> vcontent;
+      vframe->GetContent(getter_AddRefs(vcontent));
+      if (vcontent) {
+        vcontent->SetDocument(aDocument, aDeep, aCompileEventHandlers);
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsGfxScrollFrame::Destroy(nsIPresContext* aPresContext)
 
diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
index c1c59e02a0e5..34122b8c127c 100644
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -109,6 +109,9 @@ public:
   // nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aAnonymousItems);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }
diff --git a/layout/generic/nsIAnonymousContentCreator.h b/layout/generic/nsIAnonymousContentCreator.h
index feb843496e06..e48c6bb42753 100644
--- a/layout/generic/nsIAnonymousContentCreator.h
+++ b/layout/generic/nsIAnonymousContentCreator.h
@@ -50,6 +50,11 @@ public:
      NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                        nsISupportsArray& aAnonymousItems)=0;
 
+     // Needed to unroot script objects in anonymous content
+     NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                               PRBool aDeep,
+                                               PRBool aCompileEventHandlers) = 0;
+
      // If the creator doesn't want to create special fframe ro frame hierarchy
      // then it should null out the style content arg and return NS_ERROR_FAILURE
      NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
diff --git a/layout/html/base/src/nsGfxScrollFrame.cpp b/layout/html/base/src/nsGfxScrollFrame.cpp
index 146aa27c335d..dc066351860a 100644
--- a/layout/html/base/src/nsGfxScrollFrame.cpp
+++ b/layout/html/base/src/nsGfxScrollFrame.cpp
@@ -444,6 +444,40 @@ nsGfxScrollFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsGfxScrollFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                 PRBool aDeep,
+                                                 PRBool aCompileEventHandlers)
+{
+  // XXX Propogate return values?? (but don't stop part way through)
+
+  if (mInner->mHScrollbarBox) {
+    nsIFrame* hframe = nsnull;
+    mInner->mHScrollbarBox->GetFrame(&hframe);
+    if (hframe) {
+      nsCOMPtr<nsIContent> hcontent;
+      hframe->GetContent(getter_AddRefs(hcontent));
+      if (hcontent) {
+        hcontent->SetDocument(aDocument, aDeep, aCompileEventHandlers);
+      }
+    }
+  }
+
+  if (mInner->mHScrollbarBox) {
+    nsIFrame* vframe = nsnull;
+    mInner->mVScrollbarBox->GetFrame(&vframe);
+    if (vframe) {
+      nsCOMPtr<nsIContent> vcontent;
+      vframe->GetContent(getter_AddRefs(vcontent));
+      if (vcontent) {
+        vcontent->SetDocument(aDocument, aDeep, aCompileEventHandlers);
+      }
+    }
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsGfxScrollFrame::Destroy(nsIPresContext* aPresContext)
 
diff --git a/layout/html/base/src/nsGfxScrollFrame.h b/layout/html/base/src/nsGfxScrollFrame.h
index c1c59e02a0e5..34122b8c127c 100644
--- a/layout/html/base/src/nsGfxScrollFrame.h
+++ b/layout/html/base/src/nsGfxScrollFrame.h
@@ -109,6 +109,9 @@ public:
   // nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aAnonymousItems);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }
diff --git a/layout/html/base/src/nsIAnonymousContentCreator.h b/layout/html/base/src/nsIAnonymousContentCreator.h
index feb843496e06..e48c6bb42753 100644
--- a/layout/html/base/src/nsIAnonymousContentCreator.h
+++ b/layout/html/base/src/nsIAnonymousContentCreator.h
@@ -50,6 +50,11 @@ public:
      NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                        nsISupportsArray& aAnonymousItems)=0;
 
+     // Needed to unroot script objects in anonymous content
+     NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                               PRBool aDeep,
+                                               PRBool aCompileEventHandlers) = 0;
+
      // If the creator doesn't want to create special fframe ro frame hierarchy
      // then it should null out the style content arg and return NS_ERROR_FAILURE
      NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
diff --git a/layout/html/content/src/nsHTMLInputElement.cpp b/layout/html/content/src/nsHTMLInputElement.cpp
index e6855b369464..41b637aac071 100644
--- a/layout/html/content/src/nsHTMLInputElement.cpp
+++ b/layout/html/content/src/nsHTMLInputElement.cpp
@@ -298,36 +298,6 @@ nsHTMLInputElement::SetParent(nsIContent* aParent)
 NS_IMETHODIMP
 nsHTMLInputElement::SetDocument(nsIDocument* aDocument, PRBool aDeep, PRBool aCompileEventHandlers)
 {
-#ifdef ENDER_LITE
-  // We must tell the anonymous content to remove roots holding their
-  // JS Objects
-  // XXX This is somewhat ugly, and could go away if the anonymous
-  // content creation is done in XBL.
-  if (!aDocument && aDeep) {
-    nsIFormControlFrame* formControlFrame = nsnull;
-    // Note that we'll call GetPrimaryFrame() with aFlushNotifications
-    // set to false. Flushing now causes evil interactions with the
-    // content sink (see bug 45568). Furthermore, if the frame has
-    // never been created, then the nsIEditor won't have been created,
-    // so there'd be no work to do anyway.
-    nsresult rv = nsGenericHTMLElement::GetPrimaryFrame(this, formControlFrame, PR_FALSE);
-    if (NS_SUCCEEDED(rv) && formControlFrame) {
-      nsCOMPtr<textControlPlace> textControlFrame(do_QueryInterface(formControlFrame));
-      if (textControlFrame) {
-        nsCOMPtr<nsIEditor> editor;
-        textControlFrame->GetEditor(getter_AddRefs(editor));
-        if (editor) {
-          nsCOMPtr<nsIDOMElement> root;
-          editor->GetRootElement(getter_AddRefs(root));
-          if (root) {
-            nsCOMPtr<nsIContent> rootContent( do_QueryInterface(root) );
-            rootContent->SetDocument(nsnull, PR_TRUE, PR_TRUE);
-          }
-        }
-      }
-    }
-  }
-#endif
   return mInner.SetDocumentForFormControls(aDocument, aDeep, aCompileEventHandlers, this, mForm);
 }
 
diff --git a/layout/html/forms/src/nsComboboxControlFrame.cpp b/layout/html/forms/src/nsComboboxControlFrame.cpp
index 954ceb8cf2c4..d8c532b56410 100644
--- a/layout/html/forms/src/nsComboboxControlFrame.cpp
+++ b/layout/html/forms/src/nsComboboxControlFrame.cpp
@@ -2206,6 +2206,16 @@ nsComboboxControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsComboboxControlFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                       PRBool aDeep,
+                                                       PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
+
 NS_IMETHODIMP 
 nsComboboxControlFrame::CreateFrameFor(nsIPresContext*   aPresContext,
                                        nsIContent *      aContent,
diff --git a/layout/html/forms/src/nsComboboxControlFrame.h b/layout/html/forms/src/nsComboboxControlFrame.h
index 7449a20bb153..236454838540 100644
--- a/layout/html/forms/src/nsComboboxControlFrame.h
+++ b/layout/html/forms/src/nsComboboxControlFrame.h
@@ -79,6 +79,9 @@ public:
    // nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame);
diff --git a/layout/html/forms/src/nsFileControlFrame.cpp b/layout/html/forms/src/nsFileControlFrame.cpp
index aaf225d9bdce..0deec71b9449 100644
--- a/layout/html/forms/src/nsFileControlFrame.cpp
+++ b/layout/html/forms/src/nsFileControlFrame.cpp
@@ -155,6 +155,15 @@ nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsFileControlFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                   PRBool aDeep,
+                                                   PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
 // Frames are not refcounted, no need to AddRef
 NS_IMETHODIMP
 nsFileControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
diff --git a/layout/html/forms/src/nsFileControlFrame.h b/layout/html/forms/src/nsFileControlFrame.h
index d788e171bad1..86d9dcc79391 100644
--- a/layout/html/forms/src/nsFileControlFrame.h
+++ b/layout/html/forms/src/nsFileControlFrame.h
@@ -125,6 +125,9 @@ public:
   // from nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }
diff --git a/layout/html/forms/src/nsGfxButtonControlFrame.cpp b/layout/html/forms/src/nsGfxButtonControlFrame.cpp
index e03c555f8c9a..40602459002b 100644
--- a/layout/html/forms/src/nsGfxButtonControlFrame.cpp
+++ b/layout/html/forms/src/nsGfxButtonControlFrame.cpp
@@ -397,6 +397,15 @@ nsGfxButtonControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return result;
 }
 
+NS_IMETHODIMP
+nsGfxButtonControlFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                        PRBool aDeep,
+                                                        PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
 // Frames are not refcounted, no need to AddRef
 NS_IMETHODIMP
 nsGfxButtonControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
diff --git a/layout/html/forms/src/nsGfxButtonControlFrame.h b/layout/html/forms/src/nsGfxButtonControlFrame.h
index ec889e1b1e02..12531898a1ba 100644
--- a/layout/html/forms/src/nsGfxButtonControlFrame.h
+++ b/layout/html/forms/src/nsGfxButtonControlFrame.h
@@ -68,6 +68,9 @@ public:
   // nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }
diff --git a/layout/html/forms/src/nsGfxTextControlFrame2.cpp b/layout/html/forms/src/nsGfxTextControlFrame2.cpp
index bbed7da385c9..864565f65bee 100644
--- a/layout/html/forms/src/nsGfxTextControlFrame2.cpp
+++ b/layout/html/forms/src/nsGfxTextControlFrame2.cpp
@@ -1830,6 +1830,22 @@ nsGfxTextControlFrame2::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsGfxTextControlFrame2::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                       PRBool aDeep,
+                                                       PRBool aCompileEventHandlers)
+{
+  if (mEditor) {
+    nsCOMPtr<nsIDOMElement> root;
+    mEditor->GetRootElement(getter_AddRefs(root));
+    if (root) {
+      nsCOMPtr<nsIContent> rootContent( do_QueryInterface(root) );
+      rootContent->SetDocument(aDocument, aDeep, aCompileEventHandlers);
+    }
+  }
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsGfxTextControlFrame2::Reflow(nsIPresContext*   aPresContext,
                                nsHTMLReflowMetrics&     aDesiredSize,
diff --git a/layout/html/forms/src/nsGfxTextControlFrame2.h b/layout/html/forms/src/nsGfxTextControlFrame2.h
index 1474fd994aec..7a6bfefedaa8 100644
--- a/layout/html/forms/src/nsGfxTextControlFrame2.h
+++ b/layout/html/forms/src/nsGfxTextControlFrame2.h
@@ -82,6 +82,9 @@ public:
   // from nsIAnonymousContentCreator
   NS_IMETHOD CreateAnonymousContent(nsIPresContext* aPresContext,
                                     nsISupportsArray& aChildList);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
 
   // Utility methods to get and set current widget state
   void GetTextControlFrameState(nsString& aValue);
diff --git a/layout/html/style/src/nsCSSFrameConstructor.cpp b/layout/html/style/src/nsCSSFrameConstructor.cpp
index 035593531d69..23ae7dff263e 100644
--- a/layout/html/style/src/nsCSSFrameConstructor.cpp
+++ b/layout/html/style/src/nsCSSFrameConstructor.cpp
@@ -5350,9 +5350,16 @@ nsCSSFrameConstructor::CreateAnonymousFrames(nsIPresShell*        aPresShell,
       return NS_OK;
     }
   }
-  // if we have no anonymous content from XBL see if we have some from these tags.
-  // only these tags types can have anonymous content. We do this check for performance
-  // reasons. If we did a query interface on every tag it would be very inefficient.
+  // If we have no anonymous content from XBL see if we might have
+  // some by looking at the tag rather than doing a QueryInterface on
+  // the frame.  Only these tags' frames can have anonymous content
+  // through nsIAnonymousContentCreator.  We do this check for
+  // performance reasons. If we did a QueryInterface on every tag it
+  // would be inefficient.
+
+  // nsGenericElement::SetDocument ought to keep a list like this one,
+  // but it can't because nsGfxScrollFrames get around this.
+
   if (aTag !=  nsHTMLAtoms::input &&
       aTag !=  nsHTMLAtoms::textarea &&
       aTag !=  nsHTMLAtoms::combobox &&
diff --git a/layout/xul/base/src/nsSplitterFrame.cpp b/layout/xul/base/src/nsSplitterFrame.cpp
index cc7637cc3e85..cd63fe79d82c 100644
--- a/layout/xul/base/src/nsSplitterFrame.cpp
+++ b/layout/xul/base/src/nsSplitterFrame.cpp
@@ -296,6 +296,15 @@ nsSplitterFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsSplitterFrame::SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                                PRBool aDeep,
+                                                PRBool aCompileEventHandlers)
+{
+  // XXX WRITE ME
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsSplitterFrame::GetCursor(nsIPresContext* aPresContext,
                                      nsPoint&        aPoint,
diff --git a/layout/xul/base/src/nsSplitterFrame.h b/layout/xul/base/src/nsSplitterFrame.h
index 9a851167be66..7009a267a18d 100644
--- a/layout/xul/base/src/nsSplitterFrame.h
+++ b/layout/xul/base/src/nsSplitterFrame.h
@@ -71,6 +71,9 @@ public:
   // nsIAnonymousContentCreator
   NS_IMETHOD  CreateAnonymousContent(nsIPresContext* aPresContext,
                                      nsISupportsArray& aAnonymousItems);
+  NS_IMETHOD SetDocumentForAnonymousContent(nsIDocument* aDocument,
+                                            PRBool aDeep,
+                                            PRBool aCompileEventHandlers);
   NS_IMETHOD CreateFrameFor(nsIPresContext*   aPresContext,
                             nsIContent *      aContent,
                             nsIFrame**        aFrame) { if (aFrame) *aFrame = nsnull; return NS_ERROR_FAILURE; }