Fix content teardown in ReportError to also get rid of our buffered-up text

content.  Bug 288674, r=mrbkap, sr=jst

content/xml/document/src/nsXMLContentSink.cpp

@@ -233,7 +233,7 @@ nsXMLContentSink::MaybePrettyPrint()
 NS_IMETHODIMP
 nsXMLContentSink::DidBuildModel()
 {
-  if (mDocument->GetDocumentTitle().IsVoid()) {
+  if (mDocument && mDocument->GetDocumentTitle().IsVoid()) {
     nsCOMPtr<nsIDOMNSDocument> dom_doc(do_QueryInterface(mDocument));
     dom_doc->SetTitle(EmptyString());
   }
@@ -444,7 +444,7 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
   }
 
   if (aNodeInfo->Equals(nsHTMLAtoms::title, kNameSpaceID_XHTML)) {
-    if (mDocument->GetDocumentTitle().IsVoid()) {
+    if (mDocument && mDocument->GetDocumentTitle().IsVoid()) {
       mInTitle = PR_TRUE; // The first title wins
     }
   }
@@ -525,7 +525,8 @@ nsXMLContentSink::CloseElement(nsIContent* aContent, PRBool* aAppendContent)
   }
   
   if (nodeInfo->Equals(nsHTMLAtoms::title, kNameSpaceID_XHTML) &&
-           mInTitle) {
+      mInTitle) {
+    NS_ASSERTION(mDocument, "How did mInTitle get to be true if mDocument is null?");
     // The first title wins
     nsCOMPtr<nsIDOMNSDocument> dom_doc(do_QueryInterface(mDocument));
     mTitleText.CompressWhitespace();
@@ -1233,6 +1234,10 @@ nsXMLContentSink::ReportError(const PRUnichar* aErrorText,
   }
   NS_IF_RELEASE(mDocElement); 
 
+  // Clear any buffered-up text we have
+  mText = nsnull;
+  mTextLength = 0;
+
   if (mXSLTProcessor) {
     // Get rid of the XSLT processor.
     mXSLTProcessor->CancelLoads();

content/xml/document/src/nsXMLFragmentContentSink.cpp

@@ -331,6 +331,10 @@ nsXMLFragmentContentSink::ReportError(const PRUnichar* aErrorText,
     }
   }
 
+  // Clear any buffered-up text we have
+  mText = nsnull;
+  mTextLength = 0;
+
   return NS_OK; 
 }
 
@@ -405,7 +409,9 @@ nsXMLFragmentContentSink::DidBuildContent()
   if (!mAllContent) {
     // Note: we need to FlushText() here because if we don't, we might not get
     // an end element to do it for us, so make sure.
-    FlushText();
+    if (!mParseError) {
+      FlushText();
+    }
     PopContent();
   }