Fix for 50044, 47861, 47471, r=ben

content/xul/content/src/nsXULElement.cpp

@@ -4213,16 +4213,7 @@ nsXULElement::RemoveFocus(nsIPresContext* aPresContext)
 NS_IMETHODIMP
 nsXULElement::GetBindingParent(nsIContent** aContent)
 {
-  nsCOMPtr<nsIAtom> tag;
-  GetTag(*getter_AddRefs(tag));
-  if (tag.get() == nsXULAtoms::scrollbar) {
-    if (!mParent) {
-      *aContent = (nsIStyledContent*)this;
-    }
-  }
-  else
   *aContent = mBindingParent;
-  
   NS_IF_ADDREF(*aContent);
   return NS_OK;
 }

content/xul/document/public/nsIControllers.idl

@@ -20,12 +20,12 @@
  * Contributor(s): 
  */
 
-#include "nsISupports.idl"
+#include "nsISecurityCheckedComponent.idl"
 #include "nsIController.idl"
 interface nsIDOMXULCommandDispatcher;
 
 [scriptable, uuid(A5ED3A01-7CC7-11d3-BF87-00105A1B0627)]
-interface nsIControllers : nsISupports {
+interface nsIControllers : nsISecurityCheckedComponent {
 	attribute nsIDOMXULCommandDispatcher commandDispatcher;
 
 	nsIController getControllerForCommand(in wstring command);

content/xul/document/src/nsXULControllers.cpp

@@ -66,7 +66,7 @@ NS_NewXULControllers(nsISupports* aOuter, REFNSIID aIID, void** aResult)
     return rv;
 }
 
-NS_IMPL_ISUPPORTS(nsXULControllers, NS_GET_IID(nsIControllers));
+NS_IMPL_ISUPPORTS2(nsXULControllers, nsIControllers, nsISecurityCheckedComponent);
 
 
 NS_IMETHODIMP
@@ -195,3 +195,35 @@ nsXULControllers::GetControllerCount(PRUint32 *_retval)
     return NS_OK;
 }
 
+
+/* string canCreateWrapper (in nsIIDPtr iid); */
+NS_IMETHODIMP nsXULControllers::CanCreateWrapper(const nsIID * iid, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canCallMethod (in nsIIDPtr iid, in wstring methodName); */
+NS_IMETHODIMP nsXULControllers::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canGetProperty (in nsIIDPtr iid, in wstring propertyName); */
+NS_IMETHODIMP nsXULControllers::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canSetProperty (in nsIIDPtr iid, in wstring propertyName); */
+NS_IMETHODIMP nsXULControllers::CanSetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}

content/xul/document/src/nsXULControllers.h

@@ -47,6 +47,7 @@ public:
 
     NS_DECL_ISUPPORTS
     NS_DECL_NSICONTROLLERS
+    NS_DECL_NSISECURITYCHECKEDCOMPONENT
   
 protected:
     nsXULControllers();

layout/base/nsCSSFrameConstructor.cpp

@@ -7925,6 +7925,136 @@ nsCSSFrameConstructor::AppendFrames(nsIPresContext*  aPresContext,
   return rv;
 }
 
+static nsIFrame*
+FindPreviousAnonymousSibling(nsIPresShell* aPresShell,
+                             nsIContent* aContainer,
+                             nsIContent* aChild)
+{
+  nsIFrame* prevSibling = nsnull;
+
+  nsCOMPtr<nsIDOMNodeList> nodeList;
+  
+  nsCOMPtr<nsIDocument> doc;
+  aContainer->GetDocument(*getter_AddRefs(doc));
+  nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
+  nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aContainer));
+  xblDoc->GetAnonymousNodes(elt, getter_AddRefs(nodeList));
+  if (nodeList) {
+    PRUint32 ctr,listLength;
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->GetLength(&listLength);
+    if (listLength == 0)
+      return nsnull;
+    PRBool found = PR_FALSE;
+    for (ctr = listLength; ctr > 0; ctr--) {
+      nodeList->Item(ctr-1, getter_AddRefs(node));
+      nsCOMPtr<nsIContent> childContent(do_QueryInterface(node));
+      if (childContent.get() == aChild) {
+        found = PR_TRUE;
+        continue;
+      }
+
+      if (found) {
+        aPresShell->GetPrimaryFrameFor(childContent, &prevSibling);
+
+        if (nsnull != prevSibling) {
+          // The frame may have a next-in-flow. Get the last-in-flow
+          nsIFrame* nextInFlow;
+          do {
+            prevSibling->GetNextInFlow(&nextInFlow);
+            if (nsnull != nextInFlow) {
+              prevSibling = nextInFlow;
+            }
+          } while (nsnull != nextInFlow);
+
+          // Did we really get the *right* frame?
+          const nsStyleDisplay* display;
+          prevSibling->GetStyleData(eStyleStruct_Display,
+                                    (const nsStyleStruct*&)display);
+          const nsStylePosition* position;
+          prevSibling->GetStyleData(eStyleStruct_Position,
+                                    (const nsStyleStruct*&)position);
+          if (display->IsFloating() || position->IsPositioned()) {
+            // Nope. Get the place-holder instead
+            nsIFrame* placeholderFrame;
+            aPresShell->GetPlaceholderFrameFor(prevSibling, &placeholderFrame);
+            NS_ASSERTION(nsnull != placeholderFrame, "yikes");
+            prevSibling = placeholderFrame;
+          }
+
+          break;
+        }
+      }
+    }
+  }
+
+  return prevSibling;
+}
+
+static nsIFrame*
+FindNextAnonymousSibling(nsIPresShell* aPresShell,
+                         nsIContent* aContainer,
+                         nsIContent* aChild)
+{
+  nsIFrame* nextSibling = nsnull;
+
+  nsCOMPtr<nsIDOMNodeList> nodeList;
+  
+  nsCOMPtr<nsIDocument> doc;
+  aContainer->GetDocument(*getter_AddRefs(doc));
+  nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
+  nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aContainer));
+  xblDoc->GetAnonymousNodes(elt, getter_AddRefs(nodeList));
+  if (nodeList) {
+    PRUint32 ctr,listLength;
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->GetLength(&listLength);
+    PRBool found = PR_FALSE;
+    for (ctr = 0; ctr < listLength; ctr++) {
+      nodeList->Item(ctr, getter_AddRefs(node));
+      nsCOMPtr<nsIContent> childContent(do_QueryInterface(node));
+      if (childContent.get() == aChild) {
+        found = PR_TRUE;
+        continue;
+      }
+
+      if (found) {
+        aPresShell->GetPrimaryFrameFor(childContent, &nextSibling);
+
+        if (nsnull != nextSibling) {
+          // The frame may have a next-in-flow. Get the first-in-flow
+          nsIFrame* prevInFlow;
+          do {
+            nextSibling->GetPrevInFlow(&prevInFlow);
+            if (nsnull != prevInFlow) {
+              nextSibling = prevInFlow;
+            }
+          } while (nsnull != prevInFlow);
+
+          // Did we really get the *right* frame?
+          const nsStyleDisplay* display;
+          nextSibling->GetStyleData(eStyleStruct_Display,
+                                    (const nsStyleStruct*&)display);
+          const nsStylePosition* position;
+          nextSibling->GetStyleData(eStyleStruct_Position,
+                                    (const nsStyleStruct*&)position);
+          if (display->IsFloating() || position->IsPositioned()) {
+            // Nope. Get the place-holder instead
+            nsIFrame* placeholderFrame;
+            aPresShell->GetPlaceholderFrameFor(nextSibling, &placeholderFrame);
+            NS_ASSERTION(nsnull != placeholderFrame, "yikes");
+            nextSibling = placeholderFrame;
+          }
+
+          break;
+        }
+      }
+    }
+  }
+
+  return nextSibling;
+}
+
 static nsIFrame*
 FindPreviousSibling(nsIPresShell* aPresShell,
                     nsIContent*   aContainer,
@@ -7932,6 +8062,7 @@ FindPreviousSibling(nsIPresShell* aPresShell,
 {
   nsIFrame* prevSibling = nsnull;
   
+    // Walk the 
   // Note: not all content objects are associated with a frame (e.g., if their
   // 'display' type is 'hidden') so keep looking until we find a previous frame
   for (PRInt32 i = aIndexInContainer - 1; i >= 0; i--) {
@@ -8475,35 +8606,18 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext* aPresContext,
 
   } else {
     // Find the frame that precedes the insertion point.
-    nsIFrame* prevSibling = FindPreviousSibling(shell, aContainer, aIndexInContainer);
+    nsIFrame* prevSibling = (aIndexInContainer == -1) ? 
-
+                             FindPreviousAnonymousSibling(shell, aContainer, aChild) :
-    /*
+                             FindPreviousSibling(shell, aContainer, aIndexInContainer);
-    if (prevSibling) {
-      nsIFrame* parent;
-      prevSibling->GetParent(&parent);
-      nsIFrame* first;
-      parent->FirstChild(aPresContext, nsnull, &first);
-      PRBool found = PR_FALSE;
-      while(first)
-      {
-        if (first == prevSibling) {
-          found = PR_TRUE;
-          break;
-        }
-
-        first->GetNextSibling(&first);
-      }
-
-      NS_ASSERTION(found,"Error sibling not in parent!!!!!");
-    }
-    */
 
     nsIFrame* nextSibling = nsnull;
     PRBool    isAppend = PR_FALSE;
     
     // If there is no previous sibling, then find the frame that follows
     if (nsnull == prevSibling) {
-      nextSibling = FindNextSibling(shell, aContainer, aIndexInContainer);
+      nextSibling = (aIndexInContainer == -1) ? 
+                    FindNextAnonymousSibling(shell, aContainer, aChild) :
+                    FindNextSibling(shell, aContainer, aIndexInContainer);
     }
 
     // Get the geometric parent. Use the prev sibling if we have it;

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -7925,6 +7925,136 @@ nsCSSFrameConstructor::AppendFrames(nsIPresContext*  aPresContext,
   return rv;
 }
 
+static nsIFrame*
+FindPreviousAnonymousSibling(nsIPresShell* aPresShell,
+                             nsIContent* aContainer,
+                             nsIContent* aChild)
+{
+  nsIFrame* prevSibling = nsnull;
+
+  nsCOMPtr<nsIDOMNodeList> nodeList;
+  
+  nsCOMPtr<nsIDocument> doc;
+  aContainer->GetDocument(*getter_AddRefs(doc));
+  nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
+  nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aContainer));
+  xblDoc->GetAnonymousNodes(elt, getter_AddRefs(nodeList));
+  if (nodeList) {
+    PRUint32 ctr,listLength;
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->GetLength(&listLength);
+    if (listLength == 0)
+      return nsnull;
+    PRBool found = PR_FALSE;
+    for (ctr = listLength; ctr > 0; ctr--) {
+      nodeList->Item(ctr-1, getter_AddRefs(node));
+      nsCOMPtr<nsIContent> childContent(do_QueryInterface(node));
+      if (childContent.get() == aChild) {
+        found = PR_TRUE;
+        continue;
+      }
+
+      if (found) {
+        aPresShell->GetPrimaryFrameFor(childContent, &prevSibling);
+
+        if (nsnull != prevSibling) {
+          // The frame may have a next-in-flow. Get the last-in-flow
+          nsIFrame* nextInFlow;
+          do {
+            prevSibling->GetNextInFlow(&nextInFlow);
+            if (nsnull != nextInFlow) {
+              prevSibling = nextInFlow;
+            }
+          } while (nsnull != nextInFlow);
+
+          // Did we really get the *right* frame?
+          const nsStyleDisplay* display;
+          prevSibling->GetStyleData(eStyleStruct_Display,
+                                    (const nsStyleStruct*&)display);
+          const nsStylePosition* position;
+          prevSibling->GetStyleData(eStyleStruct_Position,
+                                    (const nsStyleStruct*&)position);
+          if (display->IsFloating() || position->IsPositioned()) {
+            // Nope. Get the place-holder instead
+            nsIFrame* placeholderFrame;
+            aPresShell->GetPlaceholderFrameFor(prevSibling, &placeholderFrame);
+            NS_ASSERTION(nsnull != placeholderFrame, "yikes");
+            prevSibling = placeholderFrame;
+          }
+
+          break;
+        }
+      }
+    }
+  }
+
+  return prevSibling;
+}
+
+static nsIFrame*
+FindNextAnonymousSibling(nsIPresShell* aPresShell,
+                         nsIContent* aContainer,
+                         nsIContent* aChild)
+{
+  nsIFrame* nextSibling = nsnull;
+
+  nsCOMPtr<nsIDOMNodeList> nodeList;
+  
+  nsCOMPtr<nsIDocument> doc;
+  aContainer->GetDocument(*getter_AddRefs(doc));
+  nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
+  nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aContainer));
+  xblDoc->GetAnonymousNodes(elt, getter_AddRefs(nodeList));
+  if (nodeList) {
+    PRUint32 ctr,listLength;
+    nsCOMPtr<nsIDOMNode> node;
+    nodeList->GetLength(&listLength);
+    PRBool found = PR_FALSE;
+    for (ctr = 0; ctr < listLength; ctr++) {
+      nodeList->Item(ctr, getter_AddRefs(node));
+      nsCOMPtr<nsIContent> childContent(do_QueryInterface(node));
+      if (childContent.get() == aChild) {
+        found = PR_TRUE;
+        continue;
+      }
+
+      if (found) {
+        aPresShell->GetPrimaryFrameFor(childContent, &nextSibling);
+
+        if (nsnull != nextSibling) {
+          // The frame may have a next-in-flow. Get the first-in-flow
+          nsIFrame* prevInFlow;
+          do {
+            nextSibling->GetPrevInFlow(&prevInFlow);
+            if (nsnull != prevInFlow) {
+              nextSibling = prevInFlow;
+            }
+          } while (nsnull != prevInFlow);
+
+          // Did we really get the *right* frame?
+          const nsStyleDisplay* display;
+          nextSibling->GetStyleData(eStyleStruct_Display,
+                                    (const nsStyleStruct*&)display);
+          const nsStylePosition* position;
+          nextSibling->GetStyleData(eStyleStruct_Position,
+                                    (const nsStyleStruct*&)position);
+          if (display->IsFloating() || position->IsPositioned()) {
+            // Nope. Get the place-holder instead
+            nsIFrame* placeholderFrame;
+            aPresShell->GetPlaceholderFrameFor(nextSibling, &placeholderFrame);
+            NS_ASSERTION(nsnull != placeholderFrame, "yikes");
+            nextSibling = placeholderFrame;
+          }
+
+          break;
+        }
+      }
+    }
+  }
+
+  return nextSibling;
+}
+
 static nsIFrame*
 FindPreviousSibling(nsIPresShell* aPresShell,
                     nsIContent*   aContainer,
@@ -7932,6 +8062,7 @@ FindPreviousSibling(nsIPresShell* aPresShell,
 {
   nsIFrame* prevSibling = nsnull;
   
+    // Walk the 
   // Note: not all content objects are associated with a frame (e.g., if their
   // 'display' type is 'hidden') so keep looking until we find a previous frame
   for (PRInt32 i = aIndexInContainer - 1; i >= 0; i--) {
@@ -8475,35 +8606,18 @@ nsCSSFrameConstructor::ContentInserted(nsIPresContext* aPresContext,
 
   } else {
     // Find the frame that precedes the insertion point.
-    nsIFrame* prevSibling = FindPreviousSibling(shell, aContainer, aIndexInContainer);
+    nsIFrame* prevSibling = (aIndexInContainer == -1) ? 
-
+                             FindPreviousAnonymousSibling(shell, aContainer, aChild) :
-    /*
+                             FindPreviousSibling(shell, aContainer, aIndexInContainer);
-    if (prevSibling) {
-      nsIFrame* parent;
-      prevSibling->GetParent(&parent);
-      nsIFrame* first;
-      parent->FirstChild(aPresContext, nsnull, &first);
-      PRBool found = PR_FALSE;
-      while(first)
-      {
-        if (first == prevSibling) {
-          found = PR_TRUE;
-          break;
-        }
-
-        first->GetNextSibling(&first);
-      }
-
-      NS_ASSERTION(found,"Error sibling not in parent!!!!!");
-    }
-    */
 
     nsIFrame* nextSibling = nsnull;
     PRBool    isAppend = PR_FALSE;
     
     // If there is no previous sibling, then find the frame that follows
     if (nsnull == prevSibling) {
-      nextSibling = FindNextSibling(shell, aContainer, aIndexInContainer);
+      nextSibling = (aIndexInContainer == -1) ? 
+                    FindNextAnonymousSibling(shell, aContainer, aChild) :
+                    FindNextSibling(shell, aContainer, aIndexInContainer);
     }
 
     // Get the geometric parent. Use the prev sibling if we have it;

layout/xul/base/public/nsPIBoxObject.h

@@ -31,13 +31,27 @@ class nsIPresShell;
 class nsIContent;
 class nsIDocument;
 
-class nsPIBoxObject : public nsISupports {
+#include "nsISecurityCheckedComponent.h"
+
+class nsPIBoxObject : public nsISecurityCheckedComponent {
 
 public:
   static const nsIID& GetIID() { static nsIID iid = NS_PIBOXOBJECT_IID; return iid; }
 
   NS_IMETHOD Init(nsIContent* aContent, nsIPresShell* aShell) = 0;
   NS_IMETHOD SetDocument(nsIDocument* aDocument) = 0;
+  
+  /* string canCreateWrapper (in nsIIDPtr iid); */
+  NS_IMETHOD CanCreateWrapper(const nsIID * iid, char **_retval) = 0;
+
+  /* string canCallMethod (in nsIIDPtr iid, in wstring methodName); */
+  NS_IMETHOD CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval) = 0;
+
+  /* string canGetProperty (in nsIIDPtr iid, in wstring propertyName); */
+  NS_IMETHOD CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval) = 0;
+
+  /* string canSetProperty (in nsIIDPtr iid, in wstring propertyName); */
+  NS_IMETHOD CanSetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval) = 0;
 };
 
 #endif

layout/xul/base/src/nsBoxObject.cpp

@@ -41,7 +41,7 @@
 // Static member variable initialization
 
 // Implement our nsISupports methods
-NS_IMPL_ISUPPORTS2(nsBoxObject, nsIBoxObject, nsPIBoxObject)
+NS_IMPL_ISUPPORTS3(nsBoxObject, nsIBoxObject, nsPIBoxObject, nsISecurityCheckedComponent)
 
 // Constructors/Destructors
 nsBoxObject::nsBoxObject(void)
@@ -263,6 +263,37 @@ nsBoxObject::GetHeight(PRInt32* aResult)
   return NS_OK;
 }
 
+/* string canCreateWrapper (in nsIIDPtr iid); */
+NS_IMETHODIMP nsBoxObject::CanCreateWrapper(const nsIID * iid, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canCallMethod (in nsIIDPtr iid, in wstring methodName); */
+NS_IMETHODIMP nsBoxObject::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canGetProperty (in nsIIDPtr iid, in wstring propertyName); */
+NS_IMETHODIMP nsBoxObject::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canSetProperty (in nsIIDPtr iid, in wstring propertyName); */
+NS_IMETHODIMP nsBoxObject::CanSetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
 // Creation Routine ///////////////////////////////////////////////////////////////////////
 
 nsresult

layout/xul/base/src/nsBoxObject.h

@@ -34,6 +34,7 @@ class nsBoxObject : public nsIBoxObject, public nsPIBoxObject
 {
   NS_DECL_ISUPPORTS
   NS_DECL_NSIBOXOBJECT
+  NS_DECL_NSISECURITYCHECKEDCOMPONENT
 
 public:
   nsBoxObject();

layout/xul/base/src/nsScrollBoxFrame.cpp

@@ -43,6 +43,7 @@
 #include "nsIBox.h"
 #include "nsBoxLayoutState.h"
 #include "nsIBoxToBlockAdaptor.h"
+#include "nsIScrollbarMediator.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIPresState.h"
 #include "nsButtonBoxFrame.h"
@@ -634,6 +635,14 @@ NS_IMETHODIMP
 nsScrollBoxFrame::SaveState(nsIPresContext* aPresContext,
                               nsIPresState** aState)
 {
+  nsCOMPtr<nsIScrollbarMediator> mediator;
+  nsIFrame* first = mFrames.FirstChild();
+  mediator = do_QueryInterface(first);
+  if (mediator) {
+    // Child manages its own scrolling. Bail.
+    return NS_OK;
+  }
+
   nsresult res = NS_OK;
   PRInt32 x,y;
   nsIScrollableView* scrollingView;

rdf/base/idl/nsIControllers.idl

@@ -20,12 +20,12 @@
  * Contributor(s): 
  */
 
-#include "nsISupports.idl"
+#include "nsISecurityCheckedComponent.idl"
 #include "nsIController.idl"
 interface nsIDOMXULCommandDispatcher;
 
 [scriptable, uuid(A5ED3A01-7CC7-11d3-BF87-00105A1B0627)]
-interface nsIControllers : nsISupports {
+interface nsIControllers : nsISecurityCheckedComponent {
 	attribute nsIDOMXULCommandDispatcher commandDispatcher;
 
 	nsIController getControllerForCommand(in wstring command);

rdf/content/src/nsXULControllers.cpp

@@ -66,7 +66,7 @@ NS_NewXULControllers(nsISupports* aOuter, REFNSIID aIID, void** aResult)
     return rv;
 }
 
-NS_IMPL_ISUPPORTS(nsXULControllers, NS_GET_IID(nsIControllers));
+NS_IMPL_ISUPPORTS2(nsXULControllers, nsIControllers, nsISecurityCheckedComponent);
 
 
 NS_IMETHODIMP
@@ -195,3 +195,35 @@ nsXULControllers::GetControllerCount(PRUint32 *_retval)
     return NS_OK;
 }
 
+
+/* string canCreateWrapper (in nsIIDPtr iid); */
+NS_IMETHODIMP nsXULControllers::CanCreateWrapper(const nsIID * iid, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canCallMethod (in nsIIDPtr iid, in wstring methodName); */
+NS_IMETHODIMP nsXULControllers::CanCallMethod(const nsIID * iid, const PRUnichar *methodName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canGetProperty (in nsIIDPtr iid, in wstring propertyName); */
+NS_IMETHODIMP nsXULControllers::CanGetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}
+
+/* string canSetProperty (in nsIIDPtr iid, in wstring propertyName); */
+NS_IMETHODIMP nsXULControllers::CanSetProperty(const nsIID * iid, const PRUnichar *propertyName, char **_retval)
+{
+  nsCAutoString str("AllAccess");
+  *_retval = str.ToNewCString();
+  return NS_OK;
+}

rdf/content/src/nsXULControllers.h

@@ -47,6 +47,7 @@ public:
 
     NS_DECL_ISUPPORTS
     NS_DECL_NSICONTROLLERS
+    NS_DECL_NSISECURITYCHECKEDCOMPONENT
   
 protected:
     nsXULControllers();

rdf/content/src/nsXULElement.cpp

@@ -4213,16 +4213,7 @@ nsXULElement::RemoveFocus(nsIPresContext* aPresContext)
 NS_IMETHODIMP
 nsXULElement::GetBindingParent(nsIContent** aContent)
 {
-  nsCOMPtr<nsIAtom> tag;
-  GetTag(*getter_AddRefs(tag));
-  if (tag.get() == nsXULAtoms::scrollbar) {
-    if (!mParent) {
-      *aContent = (nsIStyledContent*)this;
-    }
-  }
-  else
   *aContent = mBindingParent;
-  
   NS_IF_ADDREF(*aContent);
   return NS_OK;
 }