Fix for bug 828180 (crash in nsIContent::IsHTML). r=bz.

--HG--
extra : rebase_source : 677b29a45cb1d19b8e793b4dc4e4bb9f7006fafa

content/html/content/crashtests/828180.html

@@ -0,0 +1,5 @@
+<script>
+var table = document.createElement("table");
+table.tHead = null;
+table.tFoot = null;
+</script>

content/html/content/crashtests/crashtests.list

@@ -44,3 +44,4 @@ load 795221-5.xml
 load 798802-1.html
 load 811226.html
 load 819745.html
+load 828180.html

content/html/content/src/HTMLTableElement.h

@@ -62,7 +62,7 @@ public:
   }
   void SetTHead(HTMLTableSectionElement* aTHead, ErrorResult& aError)
   {
-    if (!aTHead->IsHTML(nsGkAtoms::thead)) {
+    if (aTHead && !aTHead->IsHTML(nsGkAtoms::thead)) {
       aError.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
       return;
     }
@@ -80,7 +80,7 @@ public:
   }
   void SetTFoot(HTMLTableSectionElement* aTFoot, ErrorResult& aError)
   {
-    if (!aTFoot->IsHTML(nsGkAtoms::tfoot)) {
+    if (aTFoot && !aTFoot->IsHTML(nsGkAtoms::tfoot)) {
       aError.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
       return;
     }