Bug#385515: Latest Sarge Mozilla-Browser Freezes On Google Maps

[Alexander Sack - Debian Bugmail]

Attached a patch for this issue. Its the same patch that was needed
for thunderbird.

Can someone bring up a test package for firefox and mozilla with this
patch?

 - Alexander

 p.s. please take care that the bug is listed as To: or CC: when 
      replying to this mail (e.g. /reply-all/). 
-- 
 GPG messages preferred.   |  .''`.  ** Debian GNU/Linux **
 Alexander Sack            | : :' :      The  universal
 asac at debian.org           | `. `'      Operating System
 http://www.asoftsite.org  |   `-    http://www.debian.org/
-------------- next part --------------
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -2794,9 +2794,7 @@ nsGenericElement::doInsertBefore(nsICont
        */
       return NS_ERROR_DOM_NOT_FOUND_ERR;
     }
-  }
 
-  if(aRefChild) {
     refPos = aElement->IndexOf(refContent);
 
     if (refPos < 0) {
@@ -2853,11 +2851,7 @@ nsGenericElement::doInsertBefore(nsICont
 
   nsMutationGuard::DidMutate();
 
-  /*
-   * Check if we're inserting a document fragment. If we are, we need
-   * to remove the children of the document fragment and add them
-   * individually (i.e. we don't add the actual document fragment).
-   */
+
   if (nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
     nsCOMPtr<nsIDocumentFragment> doc_fragment(do_QueryInterface(newContent));
     NS_ENSURE_TRUE(doc_fragment, NS_ERROR_UNEXPECTED);
@@ -2905,7 +2899,8 @@ nsGenericElement::doInsertBefore(nsICont
       if(guard.Mutated(1))
       {
         refPos = aElement->IndexOf(childContent);
-        refPos++;
+        if(++refPos > aElement->GetChildCount())
+          refPos = aElement->GetChildCount();
       }
     }
 
@@ -2943,27 +2938,36 @@ nsGenericElement::doInsertBefore(nsICont
     if (oldParent) {
       nsCOMPtr<nsIDOMNode> tmpNode;
 
-      nsMutationGuard guard;
+      PRUint32 origChildCount = aElement->GetChildCount();
 
       /*
        * We don't care here if the return fails or not.
        */
       oldParent->RemoveChild(aNewChild, getter_AddRefs(tmpNode));
 
+      PRUint32 newChildCount = aElement->GetChildCount();
+
       /*
        * Check if our child count changed during the RemoveChild call, if
        * it did then oldParent is most likely this node. In this case we
        * must check if refPos is still correct (unless it's zero).
        */
-      if (refPos && guard.Mutated(1)) {
+      if (refPos && origChildCount != newChildCount) {
         if (refContent) {
+          /*
+           * If we did get aRefChild we check if that is now at refPos - 1,
+           * this will happend if the new child was one of aRefChilds'
+           * previous siblings.
+           */
+          
+          PRInt32 oldPos = refPos;
           refPos = aElement->IndexOf(refContent);
 
           if (refPos < 0) {
-            return NS_ERROR_DOM_NOT_FOUND_ERR;
+            refPos = newChildCount;
           }
         } else {
-          refPos = aElement->GetChildCount();
+            refPos = newChildCount;
         }
       }
     }
@@ -3085,7 +3089,7 @@ nsGenericElement::doReplaceChild(nsICont
      * the fragment and inserting it into the child list of its
      * new parent.
      */
-    for (i = 0; i < count; ++i) {
+    for (i = 0; i < count && i < newContent->GetChildCount(); ++i) {
       PRInt32 oldPosTemp;
 
       // Always get and remove the first child, since the child indexes