Don't call SelectorMatches on document fragments. (Bug 437170) r+sr=bzbarsky

layout/style/nsCSSRuleProcessor.cpp

@@ -1741,7 +1741,9 @@ static PRBool SelectorMatchesTree(RuleProcessorData& aPrevData,
       data = prevdata->mParentData;
       if (!data) {
         nsIContent *content = prevdata->mContent->GetParent();
-        if (content) {
+        // GetParent could return a document fragment; we only want
+        // element parents.
+        if (content && content->IsNodeOfType(nsINode::eELEMENT)) {
           data = new (prevdata->mPresContext)
                       RuleProcessorData(prevdata->mPresContext, content,
                                         prevdata->mRuleWalker,