From 894e0ed85d74f65a2a8668e551c445e4520f405e Mon Sep 17 00:00:00 2001
From: "peterv%propagandism.org" <peterv%propagandism.org>
Date: Thu, 17 Mar 2005 20:41:27 +0000
Subject: [PATCH] Fix for bug 285166: createElement crashes [@
 NS_NewHTMLElement] [@

---
 content/html/document/src/nsHTMLContentSink.cpp | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
index ab01666fe79a..f0868c2915ca 100644
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -971,6 +971,12 @@ NS_NewHTMLElement(nsIContent** aResult, nsINodeInfo *aNodeInfo)
     // Find tag in tag table
     parserService->HTMLCaseSensitiveAtomTagToId(name, &id);
 
+    // XXX Temporary fix for
+    //     https://bugzilla.mozilla.org/show_bug.cgi?id=285166
+    if (id > NS_HTML_TAG_MAX) {
+        id = eHTMLTag_userdefined;
+    }
+
     result = MakeContentObject(nsHTMLTag(id), aNodeInfo, nsnull,
                                PR_FALSE, PR_FALSE);
   }
@@ -978,7 +984,13 @@ NS_NewHTMLElement(nsIContent** aResult, nsINodeInfo *aNodeInfo)
     // Find tag in tag table
     parserService->HTMLAtomTagToId(name, &id);
 
-    // Revese map id to name to get the correct character case in
+    // XXX Temporary fix for
+    //     https://bugzilla.mozilla.org/show_bug.cgi?id=285166
+    if (id > NS_HTML_TAG_MAX) {
+        id = eHTMLTag_userdefined;
+    }
+
+    // Reverse map id to name to get the correct character case in
     // the tag name.
 
     nsCOMPtr<nsINodeInfo> kungFuDeathGrip;