diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp index 3e8c57147dee..6b56cd33e450 100644 --- a/content/html/content/src/nsGenericHTMLElement.cpp +++ b/content/html/content/src/nsGenericHTMLElement.cpp @@ -1231,11 +1231,17 @@ nsGenericHTMLElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent) already_AddRefed nsGenericHTMLElement::FindForm(nsIForm* aCurrentForm) { + // Make sure we don't end up finding a form that's anonymous from + // our point of view. + nsIContent* bindingParent = GetBindingParent(); + nsIContent* content = this; - while (content) { + while (content != bindingParent && content) { // If the current ancestor is a form, return it as our form if (content->Tag() == nsGkAtoms::form && content->IsNodeOfType(nsINode::eHTML)) { + NS_ASSERTION(nsContentUtils::IsInSameAnonymousTree(this, content), + "Walked too far?"); nsIDOMHTMLFormElement* form; CallQueryInterface(content, &form); @@ -1267,18 +1273,6 @@ nsGenericHTMLElement::FindForm(nsIForm* aCurrentForm) } } while (iter); } - - if (content) { - PRInt32 i = content->IndexOf(prevContent); - - if (i < 0) { - // This means 'prevContent' is anonymous content, form controls in - // anonymous content can't refer to the real form, if they do - // they end up in form.elements n' such, and that's wrong... - - return nsnull; - } - } } return nsnull;