Bug 328885, r+sr=bz

content/base/src/nsGenericElement.cpp

@@ -1886,6 +1886,13 @@ nsGenericElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
   aVisitor.mCanHandle = PR_TRUE;
   nsCOMPtr<nsIContent> parent = GetParent();
   if (IsNativeAnonymous()) {
+    // Don't propagate mutation events which are dispatched somewhere inside
+    // native anonymous content.
+    if (aVisitor.mEvent->eventStructType == NS_MUTATION_EVENT) {
+      aVisitor.mParentTarget = nsnull;
+      return NS_OK;
+    }
+
     aVisitor.mEventTargetAtParent = parent;
   } else if (parent) {
     nsCOMPtr<nsIContent> content(do_QueryInterface(aVisitor.mEvent->target));

content/html/content/src/nsHTMLInputElement.cpp

@@ -1281,13 +1281,6 @@ nsHTMLInputElement::PreHandleEvent(nsEventChainPreVisitor& aVisitor)
     }
   }
 
-  // Don't allow mutation events which are targeted somewhere inside
-  // <input>, except if they are dispatched to the element itself.
-  if (aVisitor.mEvent->eventStructType == NS_MUTATION_EVENT &&
-      aVisitor.mEvent->originalTarget != NS_STATIC_CAST(nsIContent*, this)) {
-    return NS_OK;
-  }
-
   //
   // Web pages expect the value of a radio button or checkbox to be set
   // *before* onclick and DOMActivate fire, and they expect that if they set