Partial fix for bug 20645. Rather than just assert on error state, bail out with an error code. Real fix still due from the parser guys, but we don't crash anymore. a=chofmann r=rickg

content/html/document/src/nsHTMLContentSink.cpp

@@ -1180,6 +1180,9 @@ SinkContext::OpenContainer(const nsIParserNode& aNode)
 
   if (mPreAppend) {
     NS_ASSERTION(mStackPos > 0, "container w/o parent");
+    if (mStackPos <= 0) {
+      return NS_ERROR_FAILURE;
+    }
     nsIHTMLContent* parent = mStack[mStackPos-1].mContent;
     if (mStack[mStackPos-1].mInsertionPoint != -1) {
       parent->InsertChildAt(content, 
@@ -1253,6 +1256,9 @@ SinkContext::CloseContainer(const nsIParserNode& aNode)
   // Add container to its parent if we haven't already done it
   if (0 == (mStack[mStackPos].mFlags & APPENDED)) {
     NS_ASSERTION(mStackPos > 0, "container w/o parent");
+    if (mStackPos <= 0) {
+      return NS_ERROR_FAILURE;
+    }
     nsIHTMLContent* parent = mStack[mStackPos-1].mContent;
     // If the parent has an insertion point, insert rather than
     // append.
@@ -1564,6 +1570,9 @@ nsresult
 SinkContext::AddLeaf(nsIHTMLContent* aContent)
 {
   NS_ASSERTION(mStackPos > 0, "leaf w/o container");
+  if (mStackPos <= 0) {
+    return NS_ERROR_FAILURE;
+  }
   nsIHTMLContent* parent = mStack[mStackPos-1].mContent;
   // If the parent has an insertion point, insert rather than
   // append.
@@ -1866,6 +1875,9 @@ SinkContext::FlushText(PRBool* aDidFlush, PRBool aReleaseLast)
 
         // Add text to its parent
         NS_ASSERTION(mStackPos > 0, "leaf w/o container");
+        if (mStackPos <= 0) {
+          return NS_ERROR_FAILURE;
+        }
         nsIHTMLContent* parent = mStack[mStackPos - 1].mContent;
         if (mStack[mStackPos-1].mInsertionPoint != -1) {
           parent->InsertChildAt(content, 
@@ -2300,7 +2312,9 @@ HTMLContentSink::BeginContext(PRInt32 aPosition)
   }
    
   NS_ASSERTION(mCurrentContext != nsnull," Non-existing context");
-  
+  if (mCurrentContext == nsnull) {
+    return NS_ERROR_FAILURE;
+  }
   // Flush everything in the current context so that we don't have
   // to worry about insertions resulting in inconsistent frame creation.
   mCurrentContext->FlushTags();
@@ -3916,6 +3930,9 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
 
   // Create content object
   NS_ASSERTION(mCurrentContext->mStackPos > 0, "leaf w/o container");
+  if (mCurrentContext->mStackPos <= 0) {
+    return NS_ERROR_FAILURE;
+  }
   nsIHTMLContent* parent = mCurrentContext->mStack[mCurrentContext->mStackPos-1].mContent;
   nsAutoString tag("SCRIPT");
   nsIHTMLContent* element = nsnull;

layout/html/document/src/nsHTMLContentSink.cpp

@@ -1180,6 +1180,9 @@ SinkContext::OpenContainer(const nsIParserNode& aNode)
 
   if (mPreAppend) {
     NS_ASSERTION(mStackPos > 0, "container w/o parent");
+    if (mStackPos <= 0) {
+      return NS_ERROR_FAILURE;
+    }
     nsIHTMLContent* parent = mStack[mStackPos-1].mContent;
     if (mStack[mStackPos-1].mInsertionPoint != -1) {
       parent->InsertChildAt(content, 
@@ -1253,6 +1256,9 @@ SinkContext::CloseContainer(const nsIParserNode& aNode)
   // Add container to its parent if we haven't already done it
   if (0 == (mStack[mStackPos].mFlags & APPENDED)) {
     NS_ASSERTION(mStackPos > 0, "container w/o parent");
+    if (mStackPos <= 0) {
+      return NS_ERROR_FAILURE;
+    }
     nsIHTMLContent* parent = mStack[mStackPos-1].mContent;
     // If the parent has an insertion point, insert rather than
     // append.
@@ -1564,6 +1570,9 @@ nsresult
 SinkContext::AddLeaf(nsIHTMLContent* aContent)
 {
   NS_ASSERTION(mStackPos > 0, "leaf w/o container");
+  if (mStackPos <= 0) {
+    return NS_ERROR_FAILURE;
+  }
   nsIHTMLContent* parent = mStack[mStackPos-1].mContent;
   // If the parent has an insertion point, insert rather than
   // append.
@@ -1866,6 +1875,9 @@ SinkContext::FlushText(PRBool* aDidFlush, PRBool aReleaseLast)
 
         // Add text to its parent
         NS_ASSERTION(mStackPos > 0, "leaf w/o container");
+        if (mStackPos <= 0) {
+          return NS_ERROR_FAILURE;
+        }
         nsIHTMLContent* parent = mStack[mStackPos - 1].mContent;
         if (mStack[mStackPos-1].mInsertionPoint != -1) {
           parent->InsertChildAt(content, 
@@ -2300,7 +2312,9 @@ HTMLContentSink::BeginContext(PRInt32 aPosition)
   }
    
   NS_ASSERTION(mCurrentContext != nsnull," Non-existing context");
-  
+  if (mCurrentContext == nsnull) {
+    return NS_ERROR_FAILURE;
+  }
   // Flush everything in the current context so that we don't have
   // to worry about insertions resulting in inconsistent frame creation.
   mCurrentContext->FlushTags();
@@ -3916,6 +3930,9 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode)
 
   // Create content object
   NS_ASSERTION(mCurrentContext->mStackPos > 0, "leaf w/o container");
+  if (mCurrentContext->mStackPos <= 0) {
+    return NS_ERROR_FAILURE;
+  }
   nsIHTMLContent* parent = mCurrentContext->mStack[mCurrentContext->mStackPos-1].mContent;
   nsAutoString tag("SCRIPT");
   nsIHTMLContent* element = nsnull;