Bugzilla@Mozilla – Bug 602115
Crash [@ txExecutionState::popTemplateRule]
Last modified: 2011-05-23 17:56:44 PDT
Summon comment box
Created attachment 481111 [details] testcase (crashes Firefox when loaded)
Created attachment 481112 [details] stack trace
Crash address 0xfffffffffffffff8 is kinda scary.
439 NS_IF_RELEASE(mTemplateRules[mTemplateRuleCount].mModeLocalName); mTemplateRuleCount is -1. The popTemplateRule call is coming from end()... but we never called pushTemplateRule, because we bailed out from init() like so: 169 NS_ENSURE_TRUE(document, NS_ERROR_FAILURE); and the caller in txMozillaXSLTProcessor::TransformToDoc didn't check the rv and pressed on.
Jonas, progress here?
Jonas?
I'll start looking at this today
Created attachment 492934 [details] [review] Patch to fix Our error handling here is way busted. We even ignore errors generated from txExecutionState.init. This patch makes us honor that error, and skips the template rule cleanup when the transformation failed for any reason. Instead template rules are properly owned by an nsTArray which simplifies things a lot.
Comment on attachment 492934 [details] [review] Patch to fix >+ var docType = document.implementation.createDocumentType(undefined, '', ''); >+ var doc = document.implementation.createDocument('', '', null); >+ var xp = new XSLTProcessor; >+ xp.importStylesheet(doc); >+ xp.transformToDocument(docType); >+} >+catch (ex) {} >+ >+try { >+ var docType = document.implementation.createDocumentType(undefined, '', ''); >+ var doc = document.implementation.createDocument('', '', null); >+ var xp = new XSLTProcessor; Don't think you need the |var|s again here. > nsresult This should be void now, it only returns NS_OK. > txExecutionState::pushTemplateRule(txStylesheet::ImportFrame* aFrame,
Checked in http://hg.mozilla.org/mozilla-central/rev/7127fb5bc918
This crashes 3.6.x too
Blocking branch releases, please work up a back-ported patch if necessary
Comment on attachment 492934 [details] [review] Patch to fix >- TemplateRule* mTemplateRules; >- PRInt32 mTemplateRulesBufferSize; >- PRInt32 mTemplateRuleCount; >+ AutoInfallibleTArray<TemplateRule, 10> mTemplateRules; Neither branch has AutoInfallibleTArray. Did this compile in your tree?
No, that was the only change I had to make (which also meant returning OOM as needed)
Created attachment 505007 [details] [review] branch patch
Created attachment 505009 [details] [review] branch patch forgot to refresh
Comment on attachment 505009 [details] [review] branch patch Approved for 1.9.2.14 and 1.9.1.17, a=dveditz
Checked in on branches: http://hg.mozilla.org/releases/mozilla-1.9.1/rev/4693aab773ec http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fc69b66e9a32
Somehow missed part of the patch when moving it to the 1.9.1 branch. Followup landed (this is in the approved patch above): http://hg.mozilla.org/releases/mozilla-1.9.1/rev/7f3448d65808
Verified fixed for 1.9.2 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.14pre) Gecko/20110120 Namoroka/3.6.14pre. Verified crash in 1.9.2.13. Verified fixed for 1.9.1 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.17pre) Gecko/20110120 Shiretoko/3.5.17pre. Verified crash in 1.9.1.16.
Created attachment 507857 [details] [review] 1.8 version
*** Bug 637226 has been marked as a duplicate of this bug. ***