Fix for bug 324746 (XPathResult object can crash brower when calling iterateNext() or snapshotItem()). r=sicking, sr=jst.

git-svn-id: svn://10.0.0.236/trunk@188329 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/xslt/src/xpath/nsXPathResult.cpp

@@ -248,12 +248,18 @@ nsXPathResult::ContentRemoved(nsIDocument* aDocument,
 nsresult
 nsXPathResult::SetExprResult(txAExprResult* aExprResult, PRUint16 aResultType)
 {
+    mResultType = aResultType;
+
+    if ((isSnapshot() || isIterator() || isNode()) &&
+        aExprResult->getResultType() != txAExprResult::NODESET) {
+        return NS_ERROR_DOM_TYPE_ERR;
+    }
+
     if (mDocument) {
         mDocument->RemoveObserver(this);
         mDocument = nsnull;
     }
  
-    mResultType = aResultType;
     mResult.set(aExprResult);
 
     if (!isIterator()) {