In bug 285065 I fixed a bug where createTreeWalker led to a cycle by fixing the caller. Jesse pointed out that we should fix the general problem. This could be fixed using the same approach as bug 241518.
I need to check if anything has treewalker member variables, though.
(FWIW, this approach in general is sort of bad for the C++ API -- it makes it hard for somebody to use TreeWalker from C++ with a NodeFilter implementation written in JS.)
Created attachment 208569 [details] [diff] [review] patch Oops, forgot to change inheritance of nsEventReceiverSH. Still not tested.
I confirmed that this patch also fixes bug 285065.
Comment on attachment 208569 [details] [diff] [review] patch >+ // XXX nsEventReceiverSH::Finalize: clear event handlers in mListener... Uber-nit: Line this up with the leftmost column? r=mrbkap with that.
Comment on attachment 208569 [details] [diff] [review] patch sr=jst
Checked in to trunk.
The addEventListener dependency (bug 241518) isn't going to land on the 1.8.0 branch so this can't either.
Fixed on MOZILLA_1_8_BRANCH by checkin of bug 336791.