From 1247b9a400a6938706551fc771bf8fa391cd5410 Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu"
 <bzbarsky%mit.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 10 Nov 2005 15:46:32 +0000
Subject: [PATCH] Throw if someone sets .tFoot to something that's not a
 <tfoot>, and similar with .tHead.  Bug 301685, r+sr=peterv

git-svn-id: svn://10.0.0.236/trunk@184395 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../html/content/src/nsHTMLTableElement.cpp        | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/mozilla/content/html/content/src/nsHTMLTableElement.cpp b/mozilla/content/html/content/src/nsHTMLTableElement.cpp
index 459a42cfc39..5bd6409778d 100644
--- a/mozilla/content/html/content/src/nsHTMLTableElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLTableElement.cpp
@@ -422,6 +422,13 @@ nsHTMLTableElement::GetTHead(nsIDOMHTMLTableSectionElement** aValue)
 NS_IMETHODIMP
 nsHTMLTableElement::SetTHead(nsIDOMHTMLTableSectionElement* aValue)
 {
+  nsCOMPtr<nsIContent> content(do_QueryInterface(aValue));
+  NS_ENSURE_TRUE(content, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
+
+  if (!content->NodeInfo()->Equals(nsHTMLAtoms::thead)) {
+    return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
+  }
+  
   nsresult rv = DeleteTHead();
   if (NS_FAILED(rv)) {
     return rv;
@@ -452,6 +459,13 @@ nsHTMLTableElement::GetTFoot(nsIDOMHTMLTableSectionElement** aValue)
 NS_IMETHODIMP
 nsHTMLTableElement::SetTFoot(nsIDOMHTMLTableSectionElement* aValue)
 {
+  nsCOMPtr<nsIContent> content(do_QueryInterface(aValue));
+  NS_ENSURE_TRUE(content, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
+
+  if (!content->NodeInfo()->Equals(nsHTMLAtoms::tfoot)) {
+    return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
+  }
+  
   nsresult rv = DeleteTFoot();
   if (NS_SUCCEEDED(rv)) {
     if (aValue) {