1205163 - <xsl:output method="text"/> triggers an assertion in debug builds.

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[Andrea Marchesini [:baku]]

Soon a crashtest to reproduce this issue.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: crash.patch

ASSERTION: Bad readystate: 'mDocument->IsXULDocument() || mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE || (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_UNINITIALIZED && NS_IsAboutBlank(mDocument->GetDocumentURI()))', file /home/baku/Sources/m/sw/src/layout/base/nsDocumentViewer.cpp, line 974

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Does that patch crash, or just assert? I think this might be a dup.

Comment 3

[Andrea Marchesini [:baku]]

It could do a dup, I didn't actually check. The test asserts, and in debug builds it crashes.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Where does it crash? Since if there is a crash, that is something new.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

(the assertion is NS_ASSERTION and that shouldn't crash by default)

Comment 6

[Andrea Marchesini [:baku]]

You are right, it asserts.

Comment 7

[Andrew McCreight [:mccr8]]

How bad is this assertion?

Comment 8

[Peter Van der Beken [:peterv]]

Attachment: v1

Looks like an oversight that this code wasn't added to txMozillaTextOutput (it was added in txMozillaXMLOutput). I looked into sharing code between them but it's not trivial.

Comment 9

[Peter Van der Beken [:peterv]]

And I have no idea if hitting the assertion is bad in this case.

Comment 10

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 8664777 [details] [diff] [review]
v1

Review of attachment 8664777 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing. Feel free to ask bz for review as well if you want though.

Comment 11

[Peter Van der Beken [:peterv]]

So is having the readyState enum be READYSTATE_UNINITIALIZED a security bug?

Comment 12

[Boris Zbarsky [:bzbarsky]]

I don't actually know offhand.  :(  I want to say "no".

Comment 13

[Daniel Veditz [:dveditz]]

Peter: can this patch land? then we don't have to worry whether it's exploitable.

Comment 14

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/407dff8daf62

Comment 15

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/407dff8daf62