Bug 787493, be more strict with refChild handling, r=bz

This commit is contained in:
Olli Pettay 2012-09-20 19:13:09 +03:00
parent 87fb623851
commit bea60843d2

View File

@ -1575,6 +1575,10 @@ nsINode::ReplaceOrInsertBefore(bool aReplace, nsINode* aNewChild,
if (nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
static_cast<nsGenericElement*>(aNewChild)->FireNodeRemovedForChildren();
}
// Verify that our aRefChild is still sensible
if (aRefChild && aRefChild->GetNodeParent() != this) {
return NS_ERROR_DOM_NOT_FOUND_ERR;
}
}
nsIDocument* doc = OwnerDoc();