Bug 123899 (document.body.innerHTML is broken). Don't notify the document twice about content modification from script. r=Fabian, sr=jst, a=asa.

content/html/document/src/nsHTMLContentSink.cpp

@@ -4937,7 +4937,7 @@ HTMLContentSink::PreEvaluateScript()
   // to the body (so that they can be seen by scripts) and force reflow.
   SINK_TRACE(SINK_TRACE_CALLS,
              ("HTMLContentSink::PreEvaluateScript: flushing tags before evaluating script"));
-  mCurrentContext->FlushTags(PR_FALSE);
+  FlushPendingNotifications();
   mCurrentContext->SetPreAppend(PR_TRUE);
 
   mInScript++;
@@ -4949,6 +4949,8 @@ HTMLContentSink::PostEvaluateScript()
 {
   mInScript--;
   mCurrentContext->SetPreAppend(PR_FALSE);
+  // Take into account the content that script evaluation might have added.
+  mCurrentContext->UpdateChildCounts();
 }
 
 PRBool