Bug 583230 - Crash [@ nsINode::GetCurrentDoc] with resultBindingChanged on deleted nsIXULTemplateBuilder. r=sicking

content/xul/document/crashtests/583230.xul

@@ -0,0 +1,24 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window class="reftest-wait" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<richlistbox id="a" datasources="" template="d"/>
+<script><![CDATA[    
+function doe() {
+var node = document.getElementById('a');
+var b = node.builder;
+document.removeChild(document.documentElement);
+b.addResult({}, node);
+b.removeResult({});
+b.replaceResult({}, {}, node);
+b.resultBindingChanged({});
+try { b.addResult(null, null); } catch(ex) { }
+try { b.removeResult(null); } catch(ex) { }
+try { b.replaceResult(null, null, null); } catch(ex) { }
+try { b.resultBindingChanged(null); } catch(ex) { }
+try { b.getResultForId("empty"); } catch(ex) { }
+try { b.getResultForContent(node); } catch(ex) { }
+try { b.hasGeneratedContent(null, null); } catch(ex) { }
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 0);
+]]></script>
+</window>

content/xul/document/crashtests/crashtests.list

@@ -6,3 +6,4 @@ load 468211-1.xul
 load 468211-2.xul
 load 468211-3.xul
 load 495635-1.xul
+load 583230.xul

content/xul/templates/src/nsXULTemplateBuilder.cpp

@@ -528,6 +528,9 @@ nsXULTemplateBuilder::UpdateResult(nsIXULTemplateResult* aOldResult,
            ("nsXULTemplateBuilder::UpdateResult %p %p %p",
            aOldResult, aNewResult, aQueryNode));
 
+    if (!mRoot || !mQueriesCompiled)
+      return NS_OK;
+
     // get the containers where content may be inserted. If
     // GetInsertionLocations returns false, no container has generated
     // any content yet so new content should not be generated either. This
@@ -1024,6 +1027,9 @@ nsXULTemplateBuilder::ResultBindingChanged(nsIXULTemplateResult* aResult)
     // The new result will have the new values.
     NS_ENSURE_ARG_POINTER(aResult);
 
+    if (!mRoot || !mQueriesCompiled)
+      return NS_OK;
+
     return SynchronizeResult(aResult);
 }