From 8d41dd315b0d2ab9b9282661ae04f9820d6b99e6 Mon Sep 17 00:00:00 2001
From: "peterv%propagandism.org"
 <peterv%propagandism.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 27 Jan 2006 09:58:43 +0000
Subject: [PATCH] Fix for bug 324746 (XPathResult object can crash brower when
 calling iterateNext() or snapshotItem()). r=sicking, sr=jst.

git-svn-id: svn://10.0.0.236/trunk@188329 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/content/xslt/src/xpath/nsXPathResult.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mozilla/content/xslt/src/xpath/nsXPathResult.cpp b/mozilla/content/xslt/src/xpath/nsXPathResult.cpp
index 9d72866acb1..a329e083465 100644
--- a/mozilla/content/xslt/src/xpath/nsXPathResult.cpp
+++ b/mozilla/content/xslt/src/xpath/nsXPathResult.cpp
@@ -248,12 +248,18 @@ nsXPathResult::ContentRemoved(nsIDocument* aDocument,
 nsresult
 nsXPathResult::SetExprResult(txAExprResult* aExprResult, PRUint16 aResultType)
 {
+    mResultType = aResultType;
+
+    if ((isSnapshot() || isIterator() || isNode()) &&
+        aExprResult->getResultType() != txAExprResult::NODESET) {
+        return NS_ERROR_DOM_TYPE_ERR;
+    }
+
     if (mDocument) {
         mDocument->RemoveObserver(this);
         mDocument = nsnull;
     }
  
-    mResultType = aResultType;
     mResult.set(aExprResult);
 
     if (!isIterator()) {