119044 - Prevent a crash when trying to append/insert the current element or one of its ancestors into itself. Throw the correct exception in this case per the DOM spec.

Thanks to Neil Deakin <ndeakin@sympatico.ca> for pinpointing this and providing a patch.
r=bryner/caillon sr=jst


git-svn-id: svn://10.0.0.236/trunk@127522 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/xul/content/src/nsXULElement.cpp

@@ -993,6 +993,11 @@ nsXULElement::InsertBefore(nsIDOMNode* aNewChild, nsIDOMNode* aRefChild,
     if (NS_FAILED(rv))
         return rv;
 
+    // We can't insert an ancestor or ourself.
+    if (IsAncestor(aNewChild, this)) {
+        return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
+    }
+
     nsCOMPtr<nsIContent> newcontent = do_QueryInterface(aNewChild);
     NS_ASSERTION(newcontent != nsnull, "not an nsIContent");
     if (! newcontent)