67004 - Infinite loop caused by malformed XPath expression

Status: VERIFIED FIXED

(Core :: XSLT, defect)

Description

[Sean Chitwood]

I'll attach a test case, but in ExprParser::createUnionExpr(ExprLexer& lexer)
the expression '<apply-templates match="testvalue@testattrib=Test"/>' causes an
infinite loop.

The code seems to be stuck on the '='.

Comment 1

[Sean Chitwood]

Attachment: Test Case XML file

Comment 2

[Sean Chitwood]

Attachment: Test Case XSL file

Comment 3

[Keith Visco]

Your Xpath expression is invalid. I'll look into the infinite loop because we 
shouldn't be entering an infinite loop even on badly formed XPath expressions.

You are missing a "/" between testvalue and @.

--Keith

Comment 4

[Keyser Sose]

Reporter did the above suggestion fix the problem?

Comment 5

[Sean Chitwood]

Yes that did fix my problem, but the underlying bug (Infinite Loop on Malformed
XPath rather than complex) is still there.

Comment 6

[Keyser Sose]

Marking NEW as per comments.

Comment 7

[Keith Visco]

Changing subject line to something more meaningful.

Comment 8

[Axel Hecht]

*** Bug 67349 has been marked as a duplicate of this bug. ***

Comment 9

[Keith Visco]

67349 is not really a duplicate. It's similiar because we don't throw an XPath 
error, but there is no infinate loop caused by "test@attr". The infinite loop 
occurs for something like this "test@attr=foo". In both cases we need to report 
an error within the expression however.

--Keith

Comment 10

[Keith Visco]

OK...I know where to fix it, the only problem is how to report the error! :-(

How should we handle errors within Mozilla? 

--Keith

Comment 11

[Keith Visco]

Attaching a patch which at least prints out an error and prevents the infinite
loop. 
We still need to come up with a proper way to report errors.

Comment 12

[Axel Hecht]

Error reporting should be done by generating a result document describing the
error. This seems to say, report the error from XPath to XSLT somehow, right?
Perhaps we should add a error code and string to XPath, this should go into
the XPathProcessor, too.
Peter?

Axel

Comment 13

[Keith Visco]

Attachment: patch to resolve infinite loop and report error to console

Comment 14

[Keyser Sose]

Adding patch, review keyword

Comment 15

[Axel Hecht]

Keith has checkin perms, no patch keyword. This is for unprivileged contributors
only.

Axel

Comment 16

[Axel Hecht]

r=me, looks good. no new bugs, will file the old ones ;-)

Comment 17

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Fixed with the lexer/parser rewrite

Comment 18

[Axel Hecht]

bitching buttons, verfication spam