diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp index ed19220bc6e..a9d382c35b4 100644 --- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp +++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp @@ -1921,7 +1921,6 @@ SinkContext::AddComment(const nsIParserNode& aNode) "SinkContext::AddLeaf", nsHTMLTag(aNode.GetNodeType()), mStackPos, mSink); - FlushTextAndRelease(); if (!mSink) { @@ -1939,6 +1938,11 @@ SinkContext::AddComment(const nsIParserNode& aNode) comment->SetDocument(mSink->mDocument, PR_FALSE, PR_TRUE); + NS_ASSERTION(mStackPos > 0, "stack out of bounds"); + if (mStackPos <= 0) { + return NS_ERROR_FAILURE; + } + nsIHTMLContent* parent; if (!mSink->mBody && !mSink->mFrameset && mSink->mHead) { parent = mSink->mHead; @@ -3495,8 +3499,6 @@ HTMLContentSink::CloseContainer(const eHTMLTags aTag) MOZ_TIMER_DEBUGLOG(("Start: nsHTMLContentSink::CloseContainer()\n")); MOZ_TIMER_START(mWatch); - nsresult rv = NS_OK; - // XXX work around parser bug if (eHTMLTag_frameset == aTag) { MOZ_TIMER_DEBUGLOG(("Stop: nsHTMLContentSink::CloseContainer()\n")); @@ -3504,7 +3506,7 @@ HTMLContentSink::CloseContainer(const eHTMLTags aTag) return CloseFrameset(); } - rv = mCurrentContext->CloseContainer(aTag); + nsresult rv = mCurrentContext->CloseContainer(aTag); MOZ_TIMER_DEBUGLOG(("Stop: nsHTMLContentSink::CloseContainer()\n")); MOZ_TIMER_STOP(mWatch); @@ -4939,6 +4941,16 @@ HTMLContentSink::ProcessLINKTag(const nsIParserNode& aNode) parent = mCurrentContext->mStack[mCurrentContext->mStackPos - 1].mContent; } + // XXX - Hack to fix the crash reported in bug 197015; Once the real + // problem, in CSSLoader, is fixed then this hack could be removed. + // Close the head context, that got opened up by the link tag, because + // our CSSLoader, on loading the linked style sheet, calls the parser's + // ContinueParsing() even if the parser is not blocked and that causes + // the sink, whose current context is head, to go haywire. + // Note: CSS loading is initiated before unwinding off this stack and + // therefore the sink never got the chance to close its head context. + CloseHeadContext(); + if (parent) { // Create content object nsCOMPtr element;