Fix for bug 347523 (nsXBLBinding should use importNode instead of cloneNode). r/sr=sicking.

content/xbl/src/nsXBLBinding.cpp

@@ -380,11 +380,16 @@ RealizeDefaultContent(nsHashKey* aKey, void* aData, void* aClosure)
         // We need to take this template and use it to realize the
         // actual default content (through cloning).
         // Clone this insertion point element.
+        nsCOMPtr<nsIContent> insParent = currPoint->GetInsertionParent();
+        nsCOMPtr<nsIDOMDocument> document =
+          do_QueryInterface(insParent->GetOwnerDoc());
+        if (!document) {
+          return NS_ERROR_FAILURE;
+        }
+
         nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(defContent));
         nsCOMPtr<nsIDOMNode> clonedNode;
-        elt->CloneNode(PR_TRUE, getter_AddRefs(clonedNode));
-
-        nsCOMPtr<nsIContent> insParent = currPoint->GetInsertionParent();
+        document->ImportNode(elt, PR_TRUE, getter_AddRefs(clonedNode));
 
         // Now that we have the cloned content, install the default content as
         // if it were additional anonymous content.
@@ -506,9 +511,15 @@ nsXBLBinding::GenerateAnonymousContent()
     if (hasContent || hasInsertionPoints) {
       nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(content));
 
+      nsCOMPtr<nsIDOMDocument> document =
+        do_QueryInterface(mBoundElement->GetOwnerDoc());
+      if (!document) {
+        return;
+      }
+
       nsCOMPtr<nsIDOMNode> clonedNode;
-      domElement->CloneNode(PR_TRUE, getter_AddRefs(clonedNode));
-  
+      document->ImportNode(domElement, PR_TRUE, getter_AddRefs(clonedNode));
+
       mContent = do_QueryInterface(clonedNode);
       InstallAnonymousContent(mContent, mBoundElement);