When the DOM is used to acquire a nodelist (for example, a list of P nodes obtained via getElementByTagName()) and appendChild() is used to append those nodes into another node, they are not removed from the original nodelist (or at least, the nodelist.length property does not reflect this), and any loops that make use of this will loop infinitely.
Created attachment 4600 [details] Reduced testcase for Shipley Beachball bug Reduced testcase for the bug; beachballs ToT as of November 4th.
*** Bug 5718 has been marked as a duplicate of this bug. ***
appendChild (w3.org): Adds the node newChild to the end of the list of children of this node. If the newChild is already in the tree, it is first removed.
Here's the problem: when the node is removed from the tree, its parent doesn't get the subtreeModifiedEvent from removeChild() since event dispatch is forbidden by appendChild() until it's done. Subsequently, the old parent's nodelists aren't notified of the change. Still no idea how to fix this.
Created attachment 4715 [details] Dispatch old parent's subtree modified event from appendChild()
Comment on attachment 4715 [details] Dispatch old parent's subtree modified event from appendChild() Good catch.
Comment on attachment 4715 [details] Dispatch old parent's subtree modified event from appendChild() Actually, there is more to it than this. Am coming up with a new patch.
Created attachment 4726 [details] Allow dispatch in more places Attached patch enables event dispatch when calling removeChild() in loops. That it was disabled previously was wrong because the DOM is not fragile at that point. This makes the event dispatch forbidding a debug-only check (yay).
Comment on attachment 4726 [details] Allow dispatch in more places r=Darin
Committed.