Bug 1382357 - Wait to destroy frames until after we've successfully fetched the binding

Tag #1375

1 files changed, 9 insertions, 7 deletions

diff --git a/dom/xbl/nsXBLService.cpp b/dom/xbl/nsXBLService.cpp
index 1475b1368..3f98eefe0 100644
--- a/dom/xbl/nsXBLService.cpp
+++ b/dom/xbl/nsXBLService.cpp
@@ -115,7 +115,15 @@ public:
     if (!doc)
       return;
 
-    // Destroy the frames for mBoundElement.
+    // Get the binding.
+    bool ready = false;
+    nsXBLService::GetInstance()->BindingReady(mBoundElement, mBindingURI, &ready);
+    if (!ready)
+      return;
+
+    // Destroy the frames for mBoundElement. Do this after getting the binding,
+    // since if the binding fetch fails then we don't want to destroy the
+    // frames.
     nsIContent* destroyedFramesFor = nullptr;
     nsIPresShell* shell = doc->GetShell();
     if (shell) {
@@ -123,12 +131,6 @@ public:
     }
     MOZ_ASSERT(!mBoundElement->GetPrimaryFrame());
 
-    // Get the binding.
-    bool ready = false;
-    nsXBLService::GetInstance()->BindingReady(mBoundElement, mBindingURI, &ready);
-    if (!ready)
-      return;
-
     // If |mBoundElement| is (in addition to having binding |mBinding|)
     // also a descendant of another element with binding |mBinding|,
     // then we might have just constructed it due to the