Created attachment 531169 [details] testcase ###!!! ASSERTION: Want to fire DOMNodeRemoved event, but it's not safe: 'aChild->IsNodeOfType(nsINode::eCONTENT) && static_cast<nsIContent*>(aChild)-> IsInNativeAnonymousSubtree() || IsSafeToRunScript() || sDOMNodeRemovedSuppressCount', file content/base/src/nsContentUtils.cpp, line 3751 This is a recent regression, most likely from bug 650493.
We should move this code over to using RemoveChildAt and simply not fire mutation events. Parser doesn't in other cases anyway.
My fuzzer hits this assertion a lot, which slows it down somewhat.
You need to log in before you can comment on or make changes to this bug.