From a2c2c1f13bc56294f8c66c875fbb83c38f4c2bee Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu" <bzbarsky%mit.edu>
Date: Tue, 5 Apr 2005 03:40:36 +0000
Subject: [PATCH] Fix content teardown in ReportError to also get rid of our
 buffered-up text content.  Bug 288674, r=mrbkap, sr=jst

---
 content/xml/document/src/nsXMLContentSink.cpp         | 11 ++++++++---
 content/xml/document/src/nsXMLFragmentContentSink.cpp |  8 +++++++-
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp
index 3d5c9d2fb46..9cb30383e71 100644
--- a/content/xml/document/src/nsXMLContentSink.cpp
+++ b/content/xml/document/src/nsXMLContentSink.cpp
@@ -233,7 +233,7 @@ nsXMLContentSink::MaybePrettyPrint()
 NS_IMETHODIMP
 nsXMLContentSink::DidBuildModel()
 {
-  if (mDocument->GetDocumentTitle().IsVoid()) {
+  if (mDocument && mDocument->GetDocumentTitle().IsVoid()) {
     nsCOMPtr<nsIDOMNSDocument> dom_doc(do_QueryInterface(mDocument));
     dom_doc->SetTitle(EmptyString());
   }
@@ -444,7 +444,7 @@ nsXMLContentSink::CreateElement(const PRUnichar** aAtts, PRUint32 aAttsCount,
   }
 
   if (aNodeInfo->Equals(nsHTMLAtoms::title, kNameSpaceID_XHTML)) {
-    if (mDocument->GetDocumentTitle().IsVoid()) {
+    if (mDocument && mDocument->GetDocumentTitle().IsVoid()) {
       mInTitle = PR_TRUE; // The first title wins
     }
   }
@@ -525,7 +525,8 @@ nsXMLContentSink::CloseElement(nsIContent* aContent, PRBool* aAppendContent)
   }
   
   if (nodeInfo->Equals(nsHTMLAtoms::title, kNameSpaceID_XHTML) &&
-           mInTitle) {
+      mInTitle) {
+    NS_ASSERTION(mDocument, "How did mInTitle get to be true if mDocument is null?");
     // The first title wins
     nsCOMPtr<nsIDOMNSDocument> dom_doc(do_QueryInterface(mDocument));
     mTitleText.CompressWhitespace();
@@ -1233,6 +1234,10 @@ nsXMLContentSink::ReportError(const PRUnichar* aErrorText,
   }
   NS_IF_RELEASE(mDocElement); 
 
+  // Clear any buffered-up text we have
+  mText = nsnull;
+  mTextLength = 0;
+
   if (mXSLTProcessor) {
     // Get rid of the XSLT processor.
     mXSLTProcessor->CancelLoads();
diff --git a/content/xml/document/src/nsXMLFragmentContentSink.cpp b/content/xml/document/src/nsXMLFragmentContentSink.cpp
index 627e49876cf..13670ba8d92 100644
--- a/content/xml/document/src/nsXMLFragmentContentSink.cpp
+++ b/content/xml/document/src/nsXMLFragmentContentSink.cpp
@@ -331,6 +331,10 @@ nsXMLFragmentContentSink::ReportError(const PRUnichar* aErrorText,
     }
   }
 
+  // Clear any buffered-up text we have
+  mText = nsnull;
+  mTextLength = 0;
+
   return NS_OK; 
 }
 
@@ -405,7 +409,9 @@ nsXMLFragmentContentSink::DidBuildContent()
   if (!mAllContent) {
     // Note: we need to FlushText() here because if we don't, we might not get
     // an end element to do it for us, so make sure.
-    FlushText();
+    if (!mParseError) {
+      FlushText();
+    }
     PopContent();
   }