diff options
Diffstat (limited to 'dom/base/nsINode.cpp')
| -rw-r--r-- | dom/base/nsINode.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/dom/base/nsINode.cpp b/dom/base/nsINode.cpp index 3a649a61d0..715ca93eab 100644 --- a/dom/base/nsINode.cpp +++ b/dom/base/nsINode.cpp @@ -1907,6 +1907,10 @@ void nsINode::doRemoveChildAt(uint32_t aIndex, bool aNotify, nsIContent* aKid, nsAttrAndChildArray& aChildArray) { + // NOTE: This function must not trigger any calls to + // nsIDocument::GetRootElement() calls until *after* it has removed aKid from + // aChildArray. Any calls before then could potentially restore a stale + // value for our cached root element, per note in nsDocument::RemoveChildAt(). NS_PRECONDITION(aKid && aKid->GetParentNode() == this && aKid == GetChildAt(aIndex) && IndexOf(aKid) == (int32_t)aIndex, "Bogus aKid"); |