Bug 586607 BuildContentLists should allocate contentList after getting parent

r=neil

content/xbl/src/nsXBLBinding.cpp

@@ -456,14 +456,6 @@ BuildContentLists(nsISupports* aKey,
   if (count == 0)
     return PL_DHASH_NEXT;
 
-  // XXX Could this array just be altered in place and passed directly to
-  // SetContentListFor?  We'd save space if we could pull this off.
-  nsInsertionPointList* contentList = new nsInsertionPointList;
-  if (!contentList) {
-    data->mRv = NS_ERROR_OUT_OF_MEMORY;
-    return PL_DHASH_STOP;
-  }
-
   // Figure out the relevant content node.
   nsXBLInsertionPoint* currPoint = aData->ElementAt(0);
   nsCOMPtr<nsIContent> parent = currPoint->GetInsertionParent();
@@ -473,6 +465,14 @@ BuildContentLists(nsISupports* aKey,
   }
   PRInt32 currIndex = currPoint->GetInsertionIndex();
 
+  // XXX Could this array just be altered in place and passed directly to
+  // SetContentListFor?  We'd save space if we could pull this off.
+  nsInsertionPointList* contentList = new nsInsertionPointList;
+  if (!contentList) {
+    data->mRv = NS_ERROR_OUT_OF_MEMORY;
+    return PL_DHASH_STOP;
+  }
+
   nsCOMPtr<nsIDOMNodeList> nodeList;
   if (parent == boundElement) {
     // We are altering anonymous nodes to accommodate insertion points.