*aReturn = nsnull;  if (!aNewChild || !aOldChild) { return NS_ERROR_NULL_POINTER; }  nsresult res = NS_OK; PRInt32 oldPos = 0;  nsCOMPtr<nsIContent> oldContent = do_QueryInterface(aOldChild);    oldPos = IndexOf(oldContent); if (oldPos < 0) { return NS_ERROR_DOM_NOT_FOUND_ERR; }  nsCOMPtr<nsIContent> replacedChild = GetChildAt(oldPos);  PRUint16 nodeType = 0;  res = aNewChild->GetNodeType(&nodeType);  if (NS_FAILED(res)) { return res; }  switch (nodeType) { case nsIDOMNode::ELEMENT_NODE : case nsIDOMNode::TEXT_NODE : case nsIDOMNode::CDATA_SECTION_NODE : case nsIDOMNode::ENTITY_REFERENCE_NODE : case nsIDOMNode::PROCESSING_INSTRUCTION_NODE : case nsIDOMNode::COMMENT_NODE : case nsIDOMNode::DOCUMENT_FRAGMENT_NODE : break; default:   return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR; }  nsCOMPtr<nsIContent> newContent(do_QueryInterface(aNewChild, &res));  if (NS_FAILED(res)) { return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR; }  nsIDocument* elemDoc = GetDocument();  nsCOMPtr<nsIDocument> old_doc = newContent->GetDocument(); if (old_doc && old_doc != elemDoc && !nsContentUtils::CanCallerAccess(aNewChild)) { return NS_ERROR_DOM_SECURITY_ERR; }   if (isSelfOrAncestor(this, newContent)) { return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR; }   mozAutoDocUpdate updateBatch(elemDoc, UPDATE_CONTENT_MODEL, PR_TRUE);   if (nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) { nsCOMPtr<nsIContent> childContent; PRUint32 i, count = newContent->GetChildCount(); res = RemoveChildAt(oldPos, PR_TRUE); NS_ENSURE_SUCCESS(res, res);   for (i = 0; i < count; ++i) {   childContent = newContent->GetChildAt(0); res = newContent->RemoveChildAt(0, PR_FALSE); NS_ENSURE_SUCCESS(res, res);   res = InsertChildAt(childContent, oldPos++, PR_TRUE); NS_ENSURE_SUCCESS(res, res); } } else { nsCOMPtr<nsIDOMNode> oldParent; res = aNewChild->GetParentNode(getter_AddRefs(oldParent)); NS_ENSURE_SUCCESS(res, res);   if (oldParent) { PRUint32 origChildCount = GetChildCount();   nsCOMPtr<nsIDOMNode> tmpNode; oldParent->RemoveChild(aNewChild, getter_AddRefs(tmpNode));  PRUint32 newChildCount = GetChildCount();   if (oldPos && origChildCount != newChildCount) {  nsIContent *tmpContent = GetChildAt(oldPos - 1);  if (oldContent == tmpContent) { oldPos--; } } }  if (!newContent->IsContentOfType(eXUL)) { nsContentUtils::ReparentContentWrapper(newContent, this, GetDocument(), old_doc); }    if (aNewChild != aOldChild) { res = RemoveChildAt(oldPos, PR_TRUE); NS_ENSURE_SUCCESS(res, res); }  res = InsertChildAt(newContent, oldPos, PR_TRUE); NS_ENSURE_SUCCESS(res, res); }  return CallQueryInterface(replacedChild, aReturn); }
nsGenericElement::ReplaceChild(nsIDOMNode* aNewChild, nsIDOMNode* aOldChild,                               nsIDOMNode** aReturn){  if (!aReturn) {    return NS_ERROR_NULL_POINTER;  }  *aReturn = nsnull;  if (!aNewChild || !aOldChild) {    return NS_ERROR_NULL_POINTER;  }  nsresult res = NS_OK;  PRInt32 oldPos = 0;  nsCOMPtr<nsIContent> oldContent = do_QueryInterface(aOldChild);  // if oldContent is null IndexOf will return < 0, which is what we want  // since aOldChild couldn't be a child.  oldPos = IndexOf(oldContent);  if (oldPos < 0) {    return NS_ERROR_DOM_NOT_FOUND_ERR;  }  nsCOMPtr<nsIContent> replacedChild = GetChildAt(oldPos);  PRUint16 nodeType = 0;  res = aNewChild->GetNodeType(&nodeType);  if (NS_FAILED(res)) {    return res;  }  switch (nodeType) {  case nsIDOMNode::ELEMENT_NODE :  case nsIDOMNode::TEXT_NODE :  case nsIDOMNode::CDATA_SECTION_NODE :  case nsIDOMNode::ENTITY_REFERENCE_NODE :  case nsIDOMNode::PROCESSING_INSTRUCTION_NODE :  case nsIDOMNode::COMMENT_NODE :  case nsIDOMNode::DOCUMENT_FRAGMENT_NODE :    break;  default:    /*     * aNewChild is of invalid type.     */    return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;  }  nsCOMPtr<nsIContent> newContent(do_QueryInterface(aNewChild, &res));  if (NS_FAILED(res)) {    return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;  }  nsIDocument* elemDoc = GetDocument();  nsCOMPtr<nsIDocument> old_doc = newContent->GetDocument();  if (old_doc && old_doc != elemDoc &&      !nsContentUtils::CanCallerAccess(aNewChild)) {    return NS_ERROR_DOM_SECURITY_ERR;  }  /*   * Make sure the new child is not "this" node or one of this nodes   * ancestors. Doing this check here should be safe even if newContent   * is a document fragment.   */  if (isSelfOrAncestor(this, newContent)) {    return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;  }  // We're ready to start inserting children, so let's start a batch  mozAutoDocUpdate updateBatch(elemDoc, UPDATE_CONTENT_MODEL, PR_TRUE);  /*   * Check if this is a document fragment. If it is, we need   * to remove the children of the document fragment and add them   * individually (i.e. we don't add the actual document fragment).   */  if (nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {    nsCOMPtr<nsIContent> childContent;    PRUint32 i, count = newContent->GetChildCount();    res = RemoveChildAt(oldPos, PR_TRUE);    NS_ENSURE_SUCCESS(res, res);    /*     * Iterate through the fragments children, removing each from     * the fragment and inserting it into the child list of its     * new parent.     */    for (i = 0; i < count; ++i) {      // Always get and remove the first child, since the child indexes      // change as we go along.      childContent = newContent->GetChildAt(0);      res = newContent->RemoveChildAt(0, PR_FALSE);      NS_ENSURE_SUCCESS(res, res);      // Insert the child and increment the insertion position      res = InsertChildAt(childContent, oldPos++, PR_TRUE);      NS_ENSURE_SUCCESS(res, res);    }  }  else {    nsCOMPtr<nsIDOMNode> oldParent;    res = aNewChild->GetParentNode(getter_AddRefs(oldParent));    NS_ENSURE_SUCCESS(res, res);    /*     * Remove the element from the old parent if one exists, since oldParent     * is a nsIDOMNode this will do the right thing even if the parent of     * aNewChild is a document. This code also handles the case where the     * new child is alleady a child of this node-- jst@citec.fi     */    if (oldParent) {      PRUint32 origChildCount = GetChildCount();      /*       * We don't care here if the return fails or not.       */      nsCOMPtr<nsIDOMNode> tmpNode;      oldParent->RemoveChild(aNewChild, getter_AddRefs(tmpNode));      PRUint32 newChildCount = GetChildCount();      /*       * Check if our child count changed during the RemoveChild call, if       * it did then oldParent is most likely this node. In this case we       * must check if oldPos is still correct (unless it's zero).       */      if (oldPos && origChildCount != newChildCount) {        /*         * Check if aOldChild is now at oldPos - 1, this will happend if         * the new child was one of aOldChilds' previous siblings.         */        nsIContent *tmpContent = GetChildAt(oldPos - 1);        if (oldContent == tmpContent) {          oldPos--;        }      }    }    if (!newContent->IsContentOfType(eXUL)) {      nsContentUtils::ReparentContentWrapper(newContent, this, GetDocument(),                                             old_doc);    }    // If we're replacing a child with itself the child    // has already been removed from this element once we get here.    if (aNewChild != aOldChild) {      res = RemoveChildAt(oldPos, PR_TRUE);      NS_ENSURE_SUCCESS(res, res);    }    res = InsertChildAt(newContent, oldPos, PR_TRUE);    NS_ENSURE_SUCCESS(res, res);  }  return CallQueryInterface(replacedChild, aReturn);}