? .mozconfig_camino
? .mozconfig_ff
? .mozconfig_ff_gtk
? .mozconfig_ff_mem
? .mozconfig_ff_non_debug
? .mozconfig_ff_opt
? .mozconfig_ff_opt_2
? .mozconfig_sb
? .mozconfig_sm
? .mozconfig_sm_gtk1
? .mozconfig_th
? .mozconfig_th_opt
? QI_speed_up.diff
? QI_speed_up_2.diff
? QI_test.diff
? anon_events.diff
? autom4te.cache
? backout.diff
? bo
? c.diff
? cc_tooltip.diff
? contextmenu.log
? diff
? diff.diff
? ed.diff
? err
? ff_build
? ff_build_gtk
? ff_build_non_debug
? ff_build_opt
? ff_build_opt_2
? o.diff
? presshells.diff
? sb_build
? sm_build
? tbfix.diff
? testing.diff
? th_build
? th_build_opt
? tp.diff
? tree_crash.diff
? ttt
? xmlid.temp.diff
? dom/public/coreEvents/orig_nsIDOMEventReceiver.h
? dom/tests/mochitest/bugs/test_bug373998.html
? editor/libeditor/base/.nsEditor.cpp.marks
? extensions/ihminen.tar.gz
? layout/forms/nsTextControlFrame.stack.txt
? layout/generic/nsGfxScrollFrame.cpp.stack.txt
Index: browser/base/content/browser.js
===================================================================
RCS file: /cvsroot/mozilla/browser/base/content/browser.js,v
retrieving revision 1.815
diff -u -8 -p -r1.815 browser.js
--- browser/base/content/browser.js	17 Jul 2007 21:08:25 -0000	1.815
+++ browser/base/content/browser.js	20 Jul 2007 22:40:54 -0000
@@ -1016,16 +1016,17 @@ function delayedStartup()
   PlacesMenuDNDController.init();
 
   initBookmarksToolbar();
   PlacesUtils.bookmarks.addObserver(gBookmarksObserver, false);
 
   // called when we go into full screen, even if it is
   // initiated by a web page script
   window.addEventListener("fullscreen", onFullScreen, true);
+  window.addEventListener("fullscreen", onFullScreen, false);
 
   if (gIsLoadingBlank && gURLBar && isElementVisible(gURLBar))
     focusElement(gURLBar);
   else
     focusElement(content);
 
   SetPageProxyState("invalid");
 
@@ -2216,17 +2217,20 @@ function BrowserImport()
 
 function BrowserFullScreen()
 {
   window.fullScreen = !window.fullScreen;
 }
 
 function onFullScreen()
 {
-  FullScreen.toggle();
+  if (evt.eventPhase == Components.interfaces.nsIDOMEvent.CAPTURING_PHASE ||
+      evt.eventPhase == Components.interfaces.nsIDOMEvent.AT_TARGET) {
+    FullScreen.toggle();
+  }
 }
 
 function getWebNavigation()
 {
   try {
     return gBrowser.webNavigation;
   } catch (e) {
     return null;
Index: browser/components/places/content/demos/time.js
===================================================================
RCS file: /cvsroot/mozilla/browser/components/places/content/demos/time.js,v
retrieving revision 1.1
diff -u -8 -p -r1.1 time.js
--- browser/components/places/content/demos/time.js	26 Apr 2006 17:24:56 -0000	1.1
+++ browser/components/places/content/demos/time.js	20 Jul 2007 22:40:54 -0000
@@ -50,17 +50,17 @@ function BW_startup() {
   var options = BW_historyService.getNewQueryOptions();
   options.sortingMode = options.SORT_BY_DATE_DESCENDING;
   options.resultType = options.RESULTS_AS_VISIT;
   options.maxResults = 200;
   var query = BW_historyService.getNewQuery();
   BW_result = BW_historyService.executeQuery(query, options);
   BW_result.root.containerOpen = true;
 
-  BW_frame.contentWindow.addEventListener("load", BW_fill, true);
+  BW_frame.contentWindow.addEventListener("load", BW_fill, false);
   loadedBretts = true;
   if (loadedIframe && loadedBretts)
     BW_fill();
   //BW_frame.onload = BW_fill;
   //BW_frame.contentDocument.onLoad = BW_fill;
   //BW_fill();
 }
 
Index: browser/components/safebrowsing/content/browser-view.js
===================================================================
RCS file: /cvsroot/mozilla/browser/components/safebrowsing/content/browser-view.js,v
retrieving revision 1.6
diff -u -8 -p -r1.6 browser-view.js
--- browser/components/safebrowsing/content/browser-view.js	18 Jun 2007 17:36:49 -0000	1.6
+++ browser/components/safebrowsing/content/browser-view.js	20 Jul 2007 22:40:54 -0000
@@ -178,17 +178,17 @@ PROT_BrowserView.prototype.isProblemDocu
 
   // We listen for the problematic document being navigated away from
   // so we can remove it from the problem queue
 
   var hideHandler = BindToObject(this.onNavAwayFromProblem_, 
                                  this, 
                                  doc, 
                                  browser);
-  doc.defaultView.addEventListener("pagehide", hideHandler, true);
+  doc.defaultView.addEventListener("pagehide", hideHandler, false);
 
   // More info than we technically need, but it comes in handy for debugging
   var problem = {
     "browser_": browser,
     "doc_": doc,
     "displayer_": displayer,
     "url_": url,
     "hideHandler_": hideHandler,
Index: content/base/src/nsGenericElement.cpp
===================================================================
RCS file: /cvsroot/mozilla/content/base/src/nsGenericElement.cpp,v
retrieving revision 3.582
diff -u -8 -p -r3.582 nsGenericElement.cpp
--- content/base/src/nsGenericElement.cpp	12 Jul 2007 20:05:45 -0000	3.582
+++ content/base/src/nsGenericElement.cpp	20 Jul 2007 22:40:59 -0000
@@ -2206,16 +2206,17 @@ nsGenericElement::doPreHandleEvent(nsICo
     // Don't propagate mutation events which are dispatched somewhere inside
     // native anonymous content.
     if (aVisitor.mEvent->eventStructType == NS_MUTATION_EVENT) {
       aVisitor.mParentTarget = nsnull;
       return NS_OK;
     }
 
     aVisitor.mEventTargetAtParent = parent;
+    aVisitor.mNoCapturePhaseInParent = PR_TRUE;
   } else if (parent) {
     nsCOMPtr<nsIContent> content(do_QueryInterface(aVisitor.mEvent->target));
     if (content && content->GetBindingParent() == parent) {
       aVisitor.mEventTargetAtParent = parent;
     }
   }
 
   // check for an anonymous parent
Index: content/base/test/test_bug367164.html
===================================================================
RCS file: /cvsroot/mozilla/content/base/test/test_bug367164.html,v
retrieving revision 1.1
diff -u -8 -p -r1.1 test_bug367164.html
--- content/base/test/test_bug367164.html	14 Apr 2007 17:46:36 -0000	1.1
+++ content/base/test/test_bug367164.html	20 Jul 2007 22:40:59 -0000
@@ -17,32 +17,26 @@ https://bugzilla.mozilla.org/show_bug.cg
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
 /** Test for Bug 367164 **/
 
 var span = document.createElement("span");
 
-var ins1 = false;
-var ins2 = false;
-var rem1 = false;
-var rem2 = false;
+var ins = false;
+var rem = false;
 
-span.addEventListener("DOMNodeInserted", function() { ins1 = true; }, true);
-span.addEventListener("DOMNodeInserted", function() { ins2 = true; }, false);
-span.addEventListener("DOMNodeRemoved", function() { rem1 = true; }, true);
-span.addEventListener("DOMNodeRemoved", function() { rem2 = true; }, false);
+span.addEventListener("DOMNodeInserted", function() { ins = true; }, false);
+span.addEventListener("DOMNodeRemoved", function() { rem = true; }, false);
 
 $("content").appendChild(span);
 $("content").removeChild(span);
 
-is(ins1, true, "Capturing DOMNodeInserted listener");
-is(ins2, true, "Bubbling DOMNodeInserted listener");
-is(rem1, true, "Capturing DOMNodeRemoved listener");
-is(rem2, true, "Bubbling DOMNodeRemoved listener");
+is(ins, true, "Bubbling DOMNodeInserted listener");
+is(rem, true, "Bubbling DOMNodeRemoved listener");
   
 </script>
 
 </pre>
 </body>
 </html>
 
Index: content/events/public/nsEventDispatcher.h
===================================================================
RCS file: /cvsroot/mozilla/content/events/public/nsEventDispatcher.h,v
retrieving revision 1.4
diff -u -8 -p -r1.4 nsEventDispatcher.h
--- content/events/public/nsEventDispatcher.h	13 May 2007 13:59:00 -0000	1.4
+++ content/events/public/nsEventDispatcher.h	20 Jul 2007 22:40:59 -0000
@@ -127,23 +127,25 @@ public:
 class nsEventChainPreVisitor : public nsEventChainVisitor {
 public:
   nsEventChainPreVisitor(nsPresContext* aPresContext,
                          nsEvent* aEvent,
                          nsIDOMEvent* aDOMEvent,
                          nsEventStatus aEventStatus = nsEventStatus_eIgnore)
   : nsEventChainVisitor(aPresContext, aEvent, aDOMEvent, aEventStatus),
     mCanHandle(PR_TRUE), mForceContentDispatch(PR_FALSE),
-    mRelatedTargetIsInAnon(PR_FALSE) {}
+    mRelatedTargetIsInAnon(PR_FALSE),
+    mNoCapturePhaseInParent(PR_FALSE) {}
 
   void Reset() {
     mItemFlags = 0;
     mItemData = nsnull;
     mCanHandle = PR_TRUE;
     mForceContentDispatch = PR_FALSE;
+    mNoCapturePhaseInParent = PR_FALSE;
     mParentTarget = nsnull;
     mEventTargetAtParent = nsnull;
   }
 
   /**
    * Member that must be set in PreHandleEvent by event targets. If set to false,
    * indicates that this event target will not be handling the event and
    * construction of the event target chain is complete. The target that sets
@@ -160,16 +162,22 @@ public:
 
   /**
    * PR_TRUE if it is known that related target is or is a descendant of an
    * element which is anonymous for events.
    */
   PRPackedBool          mRelatedTargetIsInAnon;
 
   /**
+   * Used by native anonymous content to inform that capture phase shouldn't
+   * be handled in the parent node.
+   */
+  PRPackedBool          mNoCapturePhaseInParent;
+
+  /**
    * Parent item in the event target chain.
    */
   nsCOMPtr<nsISupports> mParentTarget;
 
   /**
    * If the event needs to be retargeted, this is the event target,
    * which should be used when the event is handled at mParentTarget.
    */
Index: content/events/src/nsDOMEvent.cpp
===================================================================
RCS file: /cvsroot/mozilla/content/events/src/nsDOMEvent.cpp,v
retrieving revision 1.235
diff -u -8 -p -r1.235 nsDOMEvent.cpp
--- content/events/src/nsDOMEvent.cpp	8 Jul 2007 07:08:07 -0000	1.235
+++ content/events/src/nsDOMEvent.cpp	20 Jul 2007 22:41:00 -0000
@@ -327,21 +327,18 @@ nsDOMEvent::SetTrusted(PRBool aTrusted)
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMEvent::GetEventPhase(PRUint16* aEventPhase)
 {
-  // Note, remember to check that this works also
-  // if or when Bug 235441 is fixed.
   if (mEvent->currentTarget == mEvent->target ||
-      ((mEvent->flags & NS_EVENT_FLAG_CAPTURE) &&
-       (mEvent->flags & NS_EVENT_FLAG_BUBBLE))) {
+      mEvent->flags & NS_EVENT_FLAG_AT_TARGET) {
     *aEventPhase = nsIDOMEvent::AT_TARGET;
   } else if (mEvent->flags & NS_EVENT_FLAG_CAPTURE) {
     *aEventPhase = nsIDOMEvent::CAPTURING_PHASE;
   } else if (mEvent->flags & NS_EVENT_FLAG_BUBBLE) {
     *aEventPhase = nsIDOMEvent::BUBBLING_PHASE;
   } else {
     *aEventPhase = 0;
   }
Index: content/events/src/nsEventDispatcher.cpp
===================================================================
RCS file: /cvsroot/mozilla/content/events/src/nsEventDispatcher.cpp,v
retrieving revision 1.17
diff -u -8 -p -r1.17 nsEventDispatcher.cpp
--- content/events/src/nsEventDispatcher.cpp	8 Jul 2007 07:08:07 -0000	1.17
+++ content/events/src/nsEventDispatcher.cpp	20 Jul 2007 22:41:00 -0000
@@ -43,16 +43,17 @@
 #include "nsIEventListenerManager.h"
 #include "nsContentUtils.h"
 #include "nsDOMError.h"
 #include "nsMutationEvent.h"
 #include NEW_H
 #include "nsFixedSizeAllocator.h"
 
 #define NS_TARGET_CHAIN_FORCE_CONTENT_DISPATCH (1 << 0)
+#define NS_TARGET_CHAIN_NO_CAPTURE_PHASE       (1 << 1)
 
 // nsEventTargetChainItem represents a single item in the event target chain.
 class nsEventTargetChainItem
 {
 private:
   nsEventTargetChainItem(nsISupports* aTarget,
                          nsEventTargetChainItem* aChild = nsnull);
 
@@ -87,28 +88,44 @@ public:
     return mNewTarget;
   }
 
   void SetNewTarget(nsISupports* aNewTarget)
   {
     mNewTarget = aNewTarget;
   }
 
-  void SetForceContentDispatch(PRBool aForce) {
+  void SetForceContentDispatch(PRBool aForce)
+  {
     if (aForce) {
       mFlags |= NS_TARGET_CHAIN_FORCE_CONTENT_DISPATCH;
     } else {
       mFlags &= ~NS_TARGET_CHAIN_FORCE_CONTENT_DISPATCH;
     }
   }
 
-  PRBool ForceContentDispatch() {
+  PRBool ForceContentDispatch()
+  {
     return !!(mFlags & NS_TARGET_CHAIN_FORCE_CONTENT_DISPATCH);
   }
 
+  
+  void SetNoCapturePhase(PRBool aNoCapture)
+  {
+    if (aNoCapture) {
+      mFlags |= NS_TARGET_CHAIN_NO_CAPTURE_PHASE;
+    } else {
+      mFlags &= ~NS_TARGET_CHAIN_NO_CAPTURE_PHASE;
+    }
+  }
+
+  PRBool NoCapturePhase() {
+    return !!(mFlags & NS_TARGET_CHAIN_NO_CAPTURE_PHASE);
+  }
+
   nsPIDOMEventTarget* CurrentTarget()
   {
     return mTarget;
   }
 
   /**
    * Dispatches event through the event target chain.
    * Handles capture, target and bubble phases both in default
@@ -222,17 +239,18 @@ nsEventTargetChainItem::HandleEventTarge
 
   // Capture
   nsEventTargetChainItem* item = this;
   aVisitor.mEvent->flags |= NS_EVENT_FLAG_CAPTURE;
   aVisitor.mEvent->flags &= ~NS_EVENT_FLAG_BUBBLE;
   while (item->mChild) {
     if ((!(aVisitor.mEvent->flags & NS_EVENT_FLAG_NO_CONTENT_DISPATCH) ||
          item->ForceContentDispatch()) &&
-        !(aVisitor.mEvent->flags & NS_EVENT_FLAG_STOP_DISPATCH)) {
+        !(aVisitor.mEvent->flags & NS_EVENT_FLAG_STOP_DISPATCH) &&
+        !item->NoCapturePhase()) {
       item->HandleEvent(aVisitor, aFlags & NS_EVENT_CAPTURE_MASK);
     }
 
     if (item->GetNewTarget()) {
       // item is at anonymous boundary. Need to retarget for the child items.
       nsEventTargetChainItem* nextTarget = item->mChild;
       while (nextTarget) {
         nsISupports* newTarget = nextTarget->GetNewTarget();
@@ -243,28 +261,27 @@ nsEventTargetChainItem::HandleEventTarge
         nextTarget = nextTarget->mChild;
       }
     }
 
     item = item->mChild;
   }
 
   // Target
+  aVisitor.mEvent->flags |= NS_EVENT_FLAG_AT_TARGET;
   aVisitor.mEvent->flags |= NS_EVENT_FLAG_BUBBLE;
   if (!(aVisitor.mEvent->flags & NS_EVENT_FLAG_STOP_DISPATCH) &&
       (!(aVisitor.mEvent->flags & NS_EVENT_FLAG_NO_CONTENT_DISPATCH) ||
        item->ForceContentDispatch())) {
-    // FIXME Should use aFlags & NS_EVENT_BUBBLE_MASK because capture phase
-    //       event listeners should not be fired. But it breaks at least
-    //       <xul:dialog>'s buttons. Bug 235441.
-    item->HandleEvent(aVisitor, aFlags);
+    item->HandleEvent(aVisitor, aFlags & NS_EVENT_BUBBLE_MASK);
   }
   if (aFlags & NS_EVENT_FLAG_SYSTEM_EVENT) {
     item->PostHandleEvent(aVisitor);
   }
+  aVisitor.mEvent->flags &= ~NS_EVENT_FLAG_AT_TARGET;
 
   // Bubble
   aVisitor.mEvent->flags &= ~NS_EVENT_FLAG_CAPTURE;
   item = item->mParent;
   while (item) {
     nsISupports* newTarget = item->GetNewTarget();
     if (newTarget) {
       // Item is at anonymous boundary. Need to retarget for the current item
@@ -449,16 +466,17 @@ nsEventDispatcher::Dispatch(nsISupports*
 
       // Item needs event retargetting.
       if (preVisitor.mEventTargetAtParent) {
         // Need to set the target of the event
         // so that also the next retargeting works.
         preVisitor.mEvent->target = preVisitor.mEventTargetAtParent;
         parentEtci->SetNewTarget(preVisitor.mEventTargetAtParent);
       }
+      parentEtci->SetNoCapturePhase(preVisitor.mNoCapturePhaseInParent);
 
       parentEtci->PreHandleEvent(preVisitor);
       if (preVisitor.mCanHandle) {
         topEtci = parentEtci;
       } else {
         nsEventTargetChainItem::Destroy(pool.GetPool(), parentEtci);
         parentEtci = nsnull;
         break;
Index: content/xul/content/test/test_bug330705-2.xul
===================================================================
RCS file: /cvsroot/mozilla/content/xul/content/test/test_bug330705-2.xul,v
retrieving revision 1.1
diff -u -8 -p -r1.1 test_bug330705-2.xul
--- content/xul/content/test/test_bug330705-2.xul	19 Feb 2007 14:55:46 -0000	1.1
+++ content/xul/content/test/test_bug330705-2.xul	20 Jul 2007 22:41:00 -0000
@@ -17,18 +17,18 @@ https://bugzilla.mozilla.org/show_bug.cg
     <div id="content" style="display: none">
       <script class="testbody" type="text/javascript">
       <![CDATA[
         SimpleTest.waitForExplicitFinish();
 
         function onLoad() {
           var isFocused = false;
           var box = document.getElementsByTagName('box')[0];
-          box.addEventListener('focus', function() { isFocused = true; }, true);
-          box.addEventListener('blur', function() { isFocused = false;}, true);
+          box.addEventListener('focus', function() { isFocused = true; }, false);
+          box.addEventListener('blur', function() { isFocused = false;}, false);
           box.focus();
           document.getElementsByTagName('box')[1].blur();
           ok(isFocused == true, "The first box element is still focused after blur() has been called on the second box element");
           SimpleTest.finish();
         }
 
         addLoadEvent(onLoad);
       ]]>
Index: editor/ui/dialogs/content/EdImageOverlay.js
===================================================================
RCS file: /cvsroot/mozilla/editor/ui/dialogs/content/EdImageOverlay.js,v
retrieving revision 1.18
diff -u -8 -p -r1.18 EdImageOverlay.js
--- editor/ui/dialogs/content/EdImageOverlay.js	16 Sep 2005 14:48:04 -0000	1.18
+++ editor/ui/dialogs/content/EdImageOverlay.js	20 Jul 2007 22:41:04 -0000
@@ -372,17 +372,17 @@ function LoadPreviewImage()
     gDialog.ImageHolder.removeChild(gDialog.ImageHolder.firstChild);
     
   gDialog.PreviewImage = document.createElementNS("http://www.w3.org/1999/xhtml", "html:img");
   if (gDialog.PreviewImage)
   {
     // set the src before appending to the document -- see bug 198435 for why
     // this is needed.
     // XXXbz that bug is long-since fixed.  Is this still needed?
-    gDialog.PreviewImage.addEventListener("load", PreviewImageLoaded, true);
+    gDialog.PreviewImage.addEventListener("load", PreviewImageLoaded, false);
     gDialog.PreviewImage.src = imageSrc;
     gDialog.ImageHolder.appendChild(gDialog.PreviewImage);
   }
 }
 
 function SetActualSize()
 {
   gDialog.widthInput.value = gActualWidth ? gActualWidth : "";
Index: mail/extensions/smime/content/msgCompSMIMEOverlay.xul
===================================================================
RCS file: /cvsroot/mozilla/mail/extensions/smime/content/msgCompSMIMEOverlay.xul,v
retrieving revision 1.6
diff -u -8 -p -r1.6 msgCompSMIMEOverlay.xul
--- mail/extensions/smime/content/msgCompSMIMEOverlay.xul	10 Mar 2005 04:38:18 -0000	1.6
+++ mail/extensions/smime/content/msgCompSMIMEOverlay.xul	20 Jul 2007 22:41:19 -0000
@@ -41,17 +41,17 @@
 
 <?xml-stylesheet href="chrome://messenger/skin/smime/msgCompSMIMEOverlay.css" type="text/css"?> 
 
 <!DOCTYPE overlay SYSTEM "chrome://messenger-smime/locale/msgCompSMIMEOverlay.dtd">
 
 <overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
   <script type="application/x-javascript" src="chrome://messenger-smime/content/msgCompSMIMEOverlay.js"/>
   <script type="application/x-javascript"><![CDATA[
-    window.addEventListener("load", smimeComposeOnLoad, true);
+    window.addEventListener("load", smimeComposeOnLoad, false);
   ]]></script>
 
   <window id="msgcomposeWindow">
     <broadcaster id="securityStatus" crypto="" signing=""/>
     <observes element="securityStatus" attribute="crypto" />
     <observes element="securityStatus" attribute="signing" />
     <stringbundle id="bundle_comp_smime" src="chrome://messenger-smime/locale/msgCompSMIMEOverlay.properties"/>
     <stringbundle id="bundle_brand" src="chrome://branding/locale/brand.properties"/>
Index: toolkit/components/console/content/console.js
===================================================================
RCS file: /cvsroot/mozilla/toolkit/components/console/content/console.js,v
retrieving revision 1.9
diff -u -8 -p -r1.9 console.js
--- toolkit/components/console/content/console.js	13 May 2007 15:48:43 -0000	1.9
+++ toolkit/components/console/content/console.js	20 Jul 2007 22:41:47 -0000
@@ -45,17 +45,17 @@ window.onload = function()
   gConsole = document.getElementById("ConsoleBox");
   gConsoleBundle = document.getElementById("ConsoleBundle");
   gTextBoxEval = document.getElementById("TextboxEval")  
   
   updateSortCommand(gConsole.sortOrder);
   updateModeCommand(gConsole.mode);
 
   var iframe = document.getElementById("Evaluator");
-  iframe.addEventListener("load", displayResult, true);
+  iframe.addEventListener("load", displayResult, false);
 }
 
 /* :::::::: Console UI Functions ::::::::::::::: */
 
 function changeMode(aMode)
 {
   switch (aMode) {
     case "Errors":
Index: toolkit/components/satchel/src/nsFormFillController.cpp
===================================================================
RCS file: /cvsroot/mozilla/toolkit/components/satchel/src/nsFormFillController.cpp,v
retrieving revision 1.88
diff -u -8 -p -r1.88 nsFormFillController.cpp
--- toolkit/components/satchel/src/nsFormFillController.cpp	8 Jul 2007 07:08:44 -0000	1.88
+++ toolkit/components/satchel/src/nsFormFillController.cpp	20 Jul 2007 22:41:48 -0000
@@ -1062,30 +1062,30 @@ nsFormFillController::AddKeyListener(nsI
 {
   if (!aInput)
     return;
 
     nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(aInput);
 
     target->AddEventListener(NS_LITERAL_STRING("keypress"),
                              static_cast<nsIDOMKeyListener *>(this),
-                             PR_TRUE);
+                             PR_FALSE);
   }
 
 void
 nsFormFillController::RemoveKeyListener()
 {
   if (!mFocusedInput)
     return;
 
     nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(mFocusedInput);
 
     target->RemoveEventListener(NS_LITERAL_STRING("keypress"),
                                 static_cast<nsIDOMKeyListener *>(this),
-                                PR_TRUE);
+                                PR_FALSE);
 }
 
 void
 nsFormFillController::StartControllingInput(nsIDOMHTMLInputElement *aInput)
 {
   // Make sure we're not still attached to an input
   StopControllingInput(); 
 
Index: toolkit/content/inlineSpellCheckUI.js
===================================================================
RCS file: /cvsroot/mozilla/toolkit/content/inlineSpellCheckUI.js,v
retrieving revision 1.10
diff -u -8 -p -r1.10 inlineSpellCheckUI.js
--- toolkit/content/inlineSpellCheckUI.js	11 Oct 2006 23:16:38 -0000	1.10
+++ toolkit/content/inlineSpellCheckUI.js	20 Jul 2007 22:41:48 -0000
@@ -149,17 +149,17 @@ var InlineSpellCheckerUI = {
 
       var item = document.createElement("menuitem");
       this.mSuggestionItems.push(item);
       item.setAttribute("label", suggestion);
       item.setAttribute("value", suggestion);
       // this function thing is necessary to generate a callback with the
       // correct binding of "val" (the index in this loop).
       var callback = function(me, val) { return function(evt) { me.replaceMisspelling(val); } };
-      item.addEventListener("command", callback(this, i), true);
+      item.addEventListener("command", callback(this, i), false);
       item.setAttribute("class", "spell-suggestion");
       menu.insertBefore(item, insertBefore);
     }
     return this.mSpellSuggestions.length;
   },
 
   // undoes the work of addSuggestionsToMenu for the same menu
   // (call from popup hiding)
@@ -224,17 +224,17 @@ var InlineSpellCheckerUI = {
       var item = document.createElement("menuitem");
       item.setAttribute("label", displayName);
       item.setAttribute("type", "checkbox");
       this.mDictionaryItems.push(item);
       if (curlang == list[i]) {
         item.setAttribute("checked", "true");
       } else {
         var callback = function(me, val) { return function(evt) { me.selectDictionary(val); } };
-        item.addEventListener("command", callback(this, i), true);
+        item.addEventListener("command", callback(this, i), false);
       }
       if (insertBefore)
         menu.insertBefore(item, insertBefore);
       else
         menu.appendChild(item);
     }
     return list.length;
   },
Index: toolkit/content/widgets/button.xml
===================================================================
RCS file: /cvsroot/mozilla/toolkit/content/widgets/button.xml,v
retrieving revision 1.19
diff -u -8 -p -r1.19 button.xml
--- toolkit/content/widgets/button.xml	25 Jul 2006 21:34:49 -0000	1.19
+++ toolkit/content/widgets/button.xml	20 Jul 2007 22:41:49 -0000
@@ -237,26 +237,26 @@
           var btn = document.getAnonymousElementByAttribute(this, "anonid", "button");
           if (!btn)
             throw "XBL binding for <button type=\"menu-button\"/> binding must contain an element with anonid=\"button\"";
           
           btn._menubuttonParent = this;
           btn.addEventListener("mouseover", function() { 
             if (!this.disabled)
               this._menubuttonParent.buttonover = true; 
-          }, true);
+          }, false);
           btn.addEventListener("mouseout", function() {
             this._menubuttonParent.buttonover = false;
-           }, true);
+           }, false);
           btn.addEventListener("mousedown", function() {
             if (!this.disabled) {
               this._menubuttonParent.buttondown = true;
               this._menubuttonParent._captureMouseUp();
             }
-          }, true);
+          }, false);
         ]]>
         </body>
       </method>
       
       <property name="buttonover" onget="return this.getAttribute('buttonover');">
         <setter>
         <![CDATA[
           var v = val || val == "true";
Index: toolkit/content/widgets/dialog.xml
===================================================================
RCS file: /cvsroot/mozilla/toolkit/content/widgets/dialog.xml,v
retrieving revision 1.31
diff -u -8 -p -r1.31 dialog.xml
--- toolkit/content/widgets/dialog.xml	24 Oct 2006 15:36:27 -0000	1.31
+++ toolkit/content/widgets/dialog.xml	20 Jul 2007 22:41:49 -0000
@@ -229,17 +229,17 @@
             dlgtype = exBtns[i].getAttribute("dlgtype");
             buttons[dlgtype].hidden = true; // hide the anonymous button
             buttons[dlgtype] = exBtns[i];
           }
 
           // add the label and oncommand handler to each button
           for (dlgtype in buttons) {
             var button = buttons[dlgtype];
-            button.addEventListener("command", this._handleButtonCommand, true);
+            button.addEventListener("command", this._handleButtonCommand, false);
 
             // don't override custom labels with pre-defined labels on explicit buttons
             if (!button.hasAttribute("label")) {
               // dialog attributes override the default labels in dialog.properties
               if (this.hasAttribute("buttonlabel"+dlgtype)) {
                 button.setAttribute("label", this.getAttribute("buttonlabel"+dlgtype));
                 if (this.hasAttribute("buttonaccesskey"+dlgtype))
                   button.setAttribute("accesskey", this.getAttribute("buttonaccesskey"+dlgtype));
Index: toolkit/mozapps/xpinstall/content/xpinstallConfirm.js
===================================================================
RCS file: /cvsroot/mozilla/toolkit/mozapps/xpinstall/content/xpinstallConfirm.js,v
retrieving revision 1.9
diff -u -8 -p -r1.9 xpinstallConfirm.js
--- toolkit/mozapps/xpinstall/content/xpinstallConfirm.js	21 Jun 2006 19:07:44 -0000	1.9
+++ toolkit/mozapps/xpinstall/content/xpinstallConfirm.js	20 Jul 2007 22:41:50 -0000
@@ -102,17 +102,20 @@ XPInstallConfirm.init = function ()
       okButton.label = bundle.getString("installButtonLabel");
       okButton.disabled = false;
       clearInterval(_installCountdownInterval);
     }
     else
       okButton.label = bundle.getFormattedString("installButtonDisabledLabel", [_installCountdown]);
   }
 
-  function myfocus() {
+  function myfocus(evt) {
+    if (evt.target == window) {
+      return;
+    }
     // Clear the timeout if it exists so only the last one will be used.
     if (_timeout)
       clearTimeout(_timeout);
 
     // Use setTimeout since the last focus or blur event to fire is the one we
     // want
     _timeout = setTimeout(setWidgetsAfterFocus, 0);
   }
@@ -122,17 +125,20 @@ XPInstallConfirm.init = function ()
       return;
 
     _installCountdown = _installCountdownLength;
     _installCountdownInterval = setInterval(okButtonCountdown, 500);
     okButton.label = bundle.getFormattedString("installButtonDisabledLabel", [_installCountdown]);
     _focused = true;
   }
 
-  function myblur() {
+  function myblur(evt) {
+    if (evt.target == window) {
+      return;
+    }
     // Clear the timeout if it exists so only the last one will be used.
     if (_timeout)
       clearTimeout(_timeout);
 
     // Use setTimeout since the last focus or blur event to fire is the one we
     // want
     _timeout = setTimeout(setWidgetsAfterBlur, 0);
   }
@@ -146,24 +152,24 @@ XPInstallConfirm.init = function ()
     _installCountdown = _installCountdownLength + 1;
     okButton.label = bundle.getFormattedString("installButtonDisabledLabel", [_installCountdown]);
     okButton.disabled = true;
     clearInterval(_installCountdownInterval);
     _focused = false;
   }
 
   function myUnload() {
-    document.removeEventListener("focus", myfocus, true);
-    document.removeEventListener("blur", myblur, true);
+    window.removeEventListener("focus", myfocus, true);
+    window.removeEventListener("blur", myblur, true);
     window.removeEventListener("unload", myUnload, false);
   }
 
   if (_installCountdownLength > 0) {
-    document.addEventListener("focus", myfocus, true);
-    document.addEventListener("blur", myblur, true);
+    window.addEventListener("focus", myfocus, true);
+    window.addEventListener("blur", myblur, true);
     window.addEventListener("unload", myUnload, false);
 
     okButton.disabled = true;
     setWidgetsAfterFocus();
   }
   else
     okButton.label = bundle.getString("installButtonLabel");
 }
Index: widget/public/nsGUIEvent.h
===================================================================
RCS file: /cvsroot/mozilla/widget/public/nsGUIEvent.h,v
retrieving revision 3.151
diff -u -8 -p -r3.151 nsGUIEvent.h
--- widget/public/nsGUIEvent.h	8 Jul 2007 07:08:47 -0000	3.151
+++ widget/public/nsGUIEvent.h	20 Jul 2007 22:41:53 -0000
@@ -114,17 +114,17 @@ class nsHashKey;
 #define NS_EVENT_FLAG_NO_DEFAULT          0x0010
 #define NS_EVENT_FLAG_CANT_CANCEL         0x0020
 #define NS_EVENT_FLAG_CANT_BUBBLE         0x0040
 #define NS_PRIV_EVENT_FLAG_SCRIPT         0x0080
 #define NS_EVENT_FLAG_NO_CONTENT_DISPATCH 0x0100
 #define NS_EVENT_FLAG_SYSTEM_EVENT        0x0200
 #define NS_EVENT_FLAG_STOP_DISPATCH_IMMEDIATELY 0x0400 // @see nsIDOM3Event::stopImmediatePropagation()
 #define NS_EVENT_FLAG_DISPATCHING         0x0800
-
+#define NS_EVENT_FLAG_AT_TARGET           0x1000
 #define NS_PRIV_EVENT_UNTRUSTED_PERMITTED 0x8000
 
 #define NS_EVENT_CAPTURE_MASK             (~(NS_EVENT_FLAG_BUBBLE | NS_EVENT_FLAG_NO_CONTENT_DISPATCH))
 #define NS_EVENT_BUBBLE_MASK              (~(NS_EVENT_FLAG_CAPTURE | NS_EVENT_FLAG_NO_CONTENT_DISPATCH))
 
 #define NS_EVENT_TYPE_NULL                   0
 
 /**