Due to changes introduces in bug 650493, the step of inserting the DocumentFragment into the DOM in insertAdjacentHTML asserts about node removal mutation events: http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsContentUtils.cpp#3314 The asserting method ends up returning early: http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsContentUtils.cpp#3325 There's no harm, because the DocumentFragment comes fresh from parsing and cannot have had mutation listeners set on it. Therefore, it's OK to suppress the assertion.
Created attachment 549785 [details] [diff] [review] Suppress the assertion
Comment on attachment 549785 [details] [diff] [review] Suppress the assertion nsAutoScriptBlockerSuppressNodeRemoved should be after mozAutoDocUpdate, I think, so that script blockers are removed after removing nsAutoScriptBlockerSuppressNodeRemoved from stack. Make sure that you get DOMNodeRemoved events if you modify DOM in the DOMNodeInserted listeners.
Another strategy here would be to just make the update batch span the parsing, then you can insert the fragment outside the batch without worrying about any scriptblockers causing assertions. Though I'm fine with the approach in the patch too, but please add a comment describing this alternative strategy as ideally nsAutoScriptBlockerSuppressNodeRemoved should never be needed.
Created attachment 551014 [details] [diff] [review] Move the update batch Fix using the approach Jonas suggested.