Bug 1338277 - Deal better with failed matching for variables, r=erahm.

--HG--
extra : rebase_source : f91e3884a55d4f667187e8538106bccbc117d3e5
extra : intermediate-source : 421407ec02c07437ced56c950b03c74e6faea56b
extra : source : 5669c2511dec853fecd42dbdc8b1fdfea64c362d

dom/xslt/crashtests/1338277.html

@@ -0,0 +1,21 @@
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xb></xb>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:transform version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="xb[$v1]"></xsl:template>
+  <xsl:variable name="v1">
+    <xsl:attribute name="a1" namespace="z">
+      <xsl:variable name="v2" select="$v2"></xsl:variable>
+    </xsl:attribute>
+  </xsl:variable>
+</xsl:transform>
+</script>
+<script>
+addEventListener("DOMContentLoaded", function(){
+  let doc = new DOMParser();
+  let xsltPrs = new XSLTProcessor();
+  xsltPrs.importStylesheet(doc.parseFromString(o_xslt.textContent, "text/xml"));
+  xsltPrs.transformToDocument(doc.parseFromString(o_xml.textContent, "text/xml"));
+});
+</script>

dom/xslt/crashtests/crashtests.list

@@ -18,3 +18,4 @@ load 667315.xml
 load 1089049.html
 load 1205163.xml
 load 1243337.xml
+asserts(1) load 1338277.html

dom/xslt/xslt/txExecutionState.cpp

@@ -529,7 +529,9 @@ txExecutionState::bindVariable(const txExpandedName& aName,
 void
 txExecutionState::removeVariable(const txExpandedName& aName)
 {
-    mLocalVariables->removeVariable(aName);
+    if (mLocalVariables) {
+      mLocalVariables->removeVariable(aName);
+    }
 }
 
 nsresult