Fix XBL error-handling to not close tags that shouldn't be closed yet (and thus

crash when a PR_Assert in the XML content sink is hit).  Bug 265184, r=bryner,
sr=jst

content/xbl/src/nsXBLContentSink.cpp

@@ -304,7 +304,17 @@ nsXBLContentSink::HandleEndElement(const PRUnichar *aName)
 
     PRInt32 nameSpaceID = GetNameSpaceId(nameSpacePrefix);
     if (nameSpaceID == kNameSpaceID_XBL) {
-      if (mState == eXBL_InHandlers) {
+      if (mState == eXBL_Error) {
+        // Check whether we've opened this tag before; we may not have if
+        // it was a real XBL tag before the error occured.
+        if (!GetCurrentContent()->GetNodeInfo()->Equals(tagAtom,
+                                                        nameSpaceID)) {
+          // OK, this tag was never opened as far as the XML sink is
+          // concerned.  Just drop the HandleEndElement
+          return NS_OK;
+        }
+      }
+      else if (mState == eXBL_InHandlers) {
         if (tagAtom == nsXBLAtoms::handlers) {
           mState = eXBL_InBinding;
           mHandler = nsnull;

content/xml/document/src/nsXMLContentSink.cpp

@@ -1105,6 +1105,15 @@ nsXMLContentSink::HandleEndElement(const PRUnichar *aName)
 
   nsCOMPtr<nsIContent> content = PopContent();
   NS_ASSERTION(content, "failed to pop content");
+#ifdef DEBUG
+  // Check that we're closing the right thing
+  nsCOMPtr<nsIAtom> debugNameSpacePrefix, debugTagAtom;
+  SplitXMLName(nsDependentString(aName), getter_AddRefs(debugNameSpacePrefix),
+               getter_AddRefs(debugTagAtom));
+  PRInt32 debugNameSpaceID = GetNameSpaceId(debugNameSpacePrefix);
+  NS_ASSERTION(content->GetNodeInfo()->Equals(debugTagAtom, debugNameSpaceID),
+               "Wrong element being closed");
+#endif  
 
   result = CloseElement(content, &appendContent);