[parser] Associate image elements with form only if the form and the intended parent are in the same tree.

parser/html/nsHtml5TreeOperation.cpp

@@ -690,6 +690,9 @@ nsHtml5TreeOperation::CreateMathMLElement(nsIAtom* aName,
 void
 nsHtml5TreeOperation::SetFormElement(nsIContent* aNode, nsIContent* aParent)
 {
+  if (aNode->SubtreeRoot() != aParent->SubtreeRoot()) {
+    return;
+  }
   nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(aNode));
   nsCOMPtr<nsIDOMHTMLImageElement> domImageElement = do_QueryInterface(aNode);
   // NS_ASSERTION(formControl, "Form-associated element did not implement nsIFormControl.");