Created attachment 596386 [details] testcase ###!!! ASSERTION: unexpected disconnected nodes: 'aDisconnected', file content/base/src/nsContentUtils.cpp, line 1716 nsRange::SetEnd [content/base/src/nsRange.cpp:1004] nsRange::SetEnd [content/base/src/nsRange.cpp:987] nsIDOMRange_SetEnd [obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:17981] js::CallJSNative [js/src/jscntxtinlines.h:311] ...
Created attachment 596406 [details] [diff] [review] fix I don't think we want to run script before we have inserted the new node. There's a similar case in nsINode::Normalize() nsTextNode::AppendTextForNormalize SetTextInternal RemoveChildAt where Normalize() use mozAutoDocUpdate to batch those events. This patch makes SplitData have the same setup.
Would adding a scriptblocker work?
> What if there is no current document? mozAutoDocUpdate deals with that: http://mxr.mozilla.org/mozilla-central/source/content/base/src/mozAutoDocUpdate.h#51 > Would adding a scriptblocker work? Well, we are modifying the DOM so wrapping the changes in BeginUpdate/EndUpdate seems prudent. I don't much about the nsIDocumentObserver protocol though...
It's ... been changing. I do think doing the update here is the prudent thing.
Comment on attachment 596406 [details] [diff] [review] fix Ok
Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/0c1fdf386ac1 since I wasn't sure which reftest failures and which crashtest assertion count failures went with which cset in the push.