Go into an error state if we get a handler with a command in non-chrome XBL.

Bug 362716, r+sr=sicking

content/xbl/src/nsXBLContentSink.cpp

@@ -644,10 +644,19 @@ nsXBLContentSink::ConstructHandler(const PRUnichar **aAtts, PRUint32 aLineNumber
       allowuntrusted = aAtts[1];
   }
 
-  if (command && !mIsChromeOrResource)
+  if (command && !mIsChromeOrResource) {
     // Make sure the XBL doc is chrome or resource if we have a command
     // shorthand syntax.
+    mState = eXBL_Error;
+    nsContentUtils::ReportToConsole(nsContentUtils::eXBL_PROPERTIES,
+                                    "CommandNotInChrome", nsnull, 0,
+                                    mDocumentURI,
+                                    EmptyString() /* source line */,
+                                    aLineNumber, 0 /* column number */,
+                                    nsIScriptError::errorFlag,
+                                    "XBL Content Sink");
     return; // Don't even make this handler.
+  }
 
   // All of our pointers are now filled in. Construct our handler with all of
   // these parameters.
@@ -672,6 +681,8 @@ nsXBLContentSink::ConstructHandler(const PRUnichar **aAtts, PRUint32 aLineNumber
     // Adjust our mHandler pointer to point to the new last handler in the
     // chain.
     mHandler = newHandler;
+  } else {
+    mState = eXBL_Error;
   }
 }
 

dom/locales/en-US/chrome/layout/xbl.properties

@@ -39,3 +39,5 @@ GTK2Conflict=Key event not available on GTK2: key="%S" modifiers="%S"
 WinConflict=Key event not available on some keyboard layouts: key="%S" modifiers="%S"
 RecursiveBinding=The XBL binding "%S" is already used by an ancestor element
 CircularExtendsBinding=Extending the XBL binding "%S" with "%S" would lead to it extending itself
+# LOCALIZATION NOTE: do not localize <handler command="...">
+CommandNotInChrome=Use of <handler command="..."> not allowed outside chrome.