Bugzilla@Mozilla – Bug 626262
"ASSERTION: ownerDocument changed again after adopting!" with mutation event
Last modified: 2011-07-12 08:29:37 PDT
Summon comment box
Created attachment 504299 [details] testcase ###!!! ASSERTION: ownerDocument changed again after adopting!: 'HasSameOwnerDoc(newContent) && doc == GetOwnerDoc()', file content/base/src/nsGenericElement.cpp, line 4066
Created attachment 504300 [details] stack trace
Peter?
Closing this. Having a node in one document with a different ownerDocument might lead to cross-origin information leaks?
Created attachment 513082 [details] [review] v1 Needs some more testing.
Created attachment 517440 [details] [review] v1.1
Comment on attachment 517440 [details] [review] v1.1 r=me
http://hg.mozilla.org/mozilla-central/rev/12ea0bd80e2e
Comment on attachment 517440 [details] [review] v1.1 Is this patch really going to work on the branches as-is?
Need an answer to comment 8 before we can approve.
Created attachment 533336 [details] [review] v1.1 (branch) Here's the patch merged to the 1.9.2 branch.
Comment on attachment 533336 [details] [review] v1.1 (branch) Approved for 1.9.2.18 and 1.9.1.20, a=dveditz for release-drivers
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/b86d93d36a78
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/5eb1fd50c7ad