--- a/jdk/src/share/classes/javax/swing/text/html/FormView.java	Fri Feb 15 14:24:42 2013 +0400
+++ b/jdk/src/share/classes/javax/swing/text/html/FormView.java	Fri Feb 15 15:05:58 2013 +0400
@@ -159,6 +159,10 @@
             attr.getAttribute(StyleConstants.NameAttribute);
         JComponent c = null;
         Object model = attr.getAttribute(StyleConstants.ModelAttribute);
+
+        // Remove listeners previously registered in shared model
+        // when a new UI component is replaced.  See bug 7189299.
+        removeStaleListenerForModel(model);
         if (t == HTML.Tag.INPUT) {
             c = createInputComponent(attr, model);
         } else if (t == HTML.Tag.SELECT) {
@@ -310,6 +314,63 @@
         return c;
     }
 
+    private void removeStaleListenerForModel(Object model) {
+        if (model instanceof DefaultButtonModel) {
+            // case of JButton whose model is DefaultButtonModel
+            // Need to remove stale ActionListener, ChangeListener and
+            // ItemListener that are instance of AbstractButton$Handler.
+            DefaultButtonModel buttonModel = (DefaultButtonModel) model;
+            String listenerClass = "javax.swing.AbstractButton$Handler";
+            for (ActionListener listener : buttonModel.getActionListeners()) {
+                if (listenerClass.equals(listener.getClass().getName())) {
+                    buttonModel.removeActionListener(listener);
+                }
+            }
+            for (ChangeListener listener : buttonModel.getChangeListeners()) {
+                if (listenerClass.equals(listener.getClass().getName())) {
+                    buttonModel.removeChangeListener(listener);
+                }
+            }
+            for (ItemListener listener : buttonModel.getItemListeners()) {
+                if (listenerClass.equals(listener.getClass().getName())) {
+                    buttonModel.removeItemListener(listener);
+                }
+            }
+        } else if (model instanceof AbstractListModel) {
+            // case of JComboBox and JList
+            // For JList, the stale ListDataListener is instance
+            // BasicListUI$Handler.
+            // For JComboBox, there are 2 stale ListDataListeners, which are
+            // BasicListUI$Handler and BasicComboBoxUI$Handler.
+            AbstractListModel listModel = (AbstractListModel) model;
+            String listenerClass1 =
+                    "javax.swing.plaf.basic.BasicListUI$Handler";
+            String listenerClass2 =
+                    "javax.swing.plaf.basic.BasicComboBoxUI$Handler";
+            for (ListDataListener listener : listModel.getListDataListeners()) {
+                if (listenerClass1.equals(listener.getClass().getName())
+                        || listenerClass2.equals(listener.getClass().getName()))
+                {
+                    listModel.removeListDataListener(listener);
+                }
+            }
+        } else if (model instanceof AbstractDocument) {
+            // case of JPasswordField, JTextField and JTextArea
+            // All have 2 stale DocumentListeners.
+            String listenerClass1 =
+                    "javax.swing.plaf.basic.BasicTextUI$UpdateHandler";
+            String listenerClass2 =
+                    "javax.swing.text.DefaultCaret$Handler";
+            AbstractDocument docModel = (AbstractDocument) model;
+            for (DocumentListener listener : docModel.getDocumentListeners()) {
+                if (listenerClass1.equals(listener.getClass().getName())
+                        || listenerClass2.equals(listener.getClass().getName()))
+                {
+                    docModel.removeDocumentListener(listener);
+                }
+            }
+        }
+    }
 
     /**
      * Determines the maximum span for this view along an
@@ -347,7 +408,7 @@
 
 
     /**
-     * Responsible for processeing the ActionEvent.
+     * Responsible for processing the ActionEvent.
      * If the element associated with the FormView,
      * has a type of "submit", "reset", "text" or "password"
      * then the action is processed.  In the case of a "submit"

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/jdk/test/javax/swing/text/html/7189299/bug7189299.java	Fri Feb 15 15:05:58 2013 +0400
@@ -0,0 +1,138 @@
+/*
+ * Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * Portions Copyright (c) 2013 IBM Corporation
+ */
+import java.awt.BorderLayout;
+import java.awt.Toolkit;
+
+import java.awt.event.ActionListener;
+import javax.swing.DefaultButtonModel;
+import javax.swing.JEditorPane;
+import javax.swing.JFrame;
+import javax.swing.SwingUtilities;
+import javax.swing.text.StyleConstants;
+import javax.swing.text.StyleContext;
+import javax.swing.text.html.HTMLEditorKit;
+import sun.awt.SunToolkit;
+
+
+/*
+ * @test
+ * @bug 8008289
+ * @summary Shared ButtonModel instance should deregister previous listeners.
+ * @author Frank Ding
+ */
+public class bug7189299 {
+
+    private static JEditorPane html;
+    private static JFrame frame;
+
+    private static void setup() {
+        /**
+         * Note the input type is not restricted to "submit". Types "image",
+         * "checkbox", "radio" have the same problem.
+         */
+        html = new JEditorPane("text/html",
+                "<html><body><form action=\"http://localhost.cgi\">"
+                        + "<input type=submit name=submit value=\"submit\"/>"
+                        + "</form></body></html>");
+        frame = new JFrame();
+        frame.setLayout(new BorderLayout());
+        frame.add(html, BorderLayout.CENTER);
+        frame.setSize(200, 100);
+        frame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
+        frame.setVisible(true);
+    }
+
+    private static void doTest() {
+        /*
+         * Calling updateComponentTreeUI creates a new FormView instance with
+         * its own associated JButton instance. The same DefaultButtonModel
+         * instance is used for both FormView's.
+         *
+         * The action listeners associated with (the JButton for) the first
+         * FormView should be unregistered from this common DefaultButtonModel,
+         * such that only those for the new FormView remain.
+         */
+        SwingUtilities.updateComponentTreeUI(html);
+    }
+
+    private static void verifySingleDefaultButtonModelListener() {
+        HTMLEditorKit htmlEditorKit = (HTMLEditorKit) html.getEditorKit();
+        StyleContext.NamedStyle style = ((StyleContext.NamedStyle) htmlEditorKit
+                .getInputAttributes());
+        DefaultButtonModel model = ((DefaultButtonModel) style
+                .getAttribute(StyleConstants.ModelAttribute));
+        ActionListener[] listeners = model.getActionListeners();
+        int actionListenerNum = listeners.length;
+        if (actionListenerNum != 1) {
+            throw new RuntimeException(
+                    "Expected single ActionListener object registered with "
+                    + "DefaultButtonModel; found " + actionListenerNum
+                    + " listeners registered.");
+        }
+
+        int changeListenerNum = model.getChangeListeners().length;
+        if (changeListenerNum != 1) {
+            throw new RuntimeException(
+                    "Expected at most one ChangeListener object registered "
+                    + "with DefaultButtonModel; found " + changeListenerNum
+                    + " listeners registered.");
+        }
+        int itemListenerNum = model.getItemListeners().length;
+        if (itemListenerNum != 1) {
+            throw new RuntimeException(
+                    "Expected at most one ItemListener object registered "
+                    + "with DefaultButtonModel; found " + itemListenerNum
+                    + " listeners registered.");
+        }
+    }
+
+    public static void main(String[] args) throws Exception {
+        final SunToolkit toolkit = ((SunToolkit) Toolkit.getDefaultToolkit());
+
+        SwingUtilities.invokeAndWait(new Runnable() {
+
+            @Override
+            public void run() {
+                setup();
+            }
+        });
+        toolkit.realSync();
+        SwingUtilities.invokeAndWait(new Runnable() {
+
+            @Override
+            public void run() {
+                try {
+                    verifySingleDefaultButtonModelListener();
+                    doTest();
+                    verifySingleDefaultButtonModelListener();
+                } finally {
+                    frame.dispose();
+                }
+            }
+        });
+    }
+}