From 675dce947209afa61950777a7e13016604b3fdb1 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Fri, 17 Apr 2020 06:11:43 -0400 Subject: Bug 1382357 - Wait to destroy frames until after we've successfully fetched the binding Tag #1375 --- dom/xbl/nsXBLService.cpp | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/dom/xbl/nsXBLService.cpp b/dom/xbl/nsXBLService.cpp index 1475b1368..3f98eefe0 100644 --- a/dom/xbl/nsXBLService.cpp +++ b/dom/xbl/nsXBLService.cpp @@ -115,7 +115,15 @@ public: if (!doc) return; - // Destroy the frames for mBoundElement. + // Get the binding. + bool ready = false; + nsXBLService::GetInstance()->BindingReady(mBoundElement, mBindingURI, &ready); + if (!ready) + return; + + // Destroy the frames for mBoundElement. Do this after getting the binding, + // since if the binding fetch fails then we don't want to destroy the + // frames. nsIContent* destroyedFramesFor = nullptr; nsIPresShell* shell = doc->GetShell(); if (shell) { @@ -123,12 +131,6 @@ public: } MOZ_ASSERT(!mBoundElement->GetPrimaryFrame()); - // Get the binding. - bool ready = false; - nsXBLService::GetInstance()->BindingReady(mBoundElement, mBindingURI, &ready); - if (!ready) - return; - // If |mBoundElement| is (in addition to having binding |mBinding|) // also a descendant of another element with binding |mBinding|, // then we might have just constructed it due to the -- cgit v1.2.3