1271960 - Firefox crashes every time I use XSL stylesheet having size greater than 2 MB

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[aloha_user604]

Attachment: test.xsl : Dummy test XSL template

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36

Steps to reproduce:

I am using XSL stylesheet to generate XML file with the help of xslt.js plugin.
However, whenever I try to generate XML file, Firefox crashes abruptly. This functionality works perfectly on IE and chrome.


Actual results:

Whenever I try to generate XML file, Firefox crashes abruptly. The XSL template I use is quite large (~90000 lines or approx 7 MB). On reducing the template size, it seems to work properly.
After some tests, I could see that it works only if template size is less than 2 MB.


Expected results:

Firefox should have generated XML file after XSLT transformation.

Comment 1

[aloha_user604]

Attachment: test.xml: XML file used along with XSLT template

Comment 2

[Loic]

What are exactly the STR? Do I need to install the xslt.js add-on to reproduce the crash?

Could you give details about STR, please?

Comment 3

[aloha_user604]

xslt.js is a javascript plugin to transform one form of XML into another. However, I tested it today without xslt.js and the issue is still reproducible.
So, you can follow the link mentioned below and reproduce the issue.

http://www.w3schools.com/xsl/xsl_client.asp

Comment 4

[aloha_user604]

Steps to Reproduce
1. Create HTML page including javascript code for XSL transformation. (code available at http://www.w3schools.com/xsl/xsl_client.asp)
2. Include XSL template having size greater than 2 MB in the code(use test.xsl)
3. Include XML template which will be used by XSL template to get required data(test.xml)
4. Load / Refresh the HTML page in Firefox using web server(apache), the browser crashes always.

Thanks

Comment 5

[aloha_user604]

Attachment: test.html : Sample file to reproduce the issue. Set appropriate directory path for "test.xsl" and "test.xml" and load this file on a web server.

Comment 6

[Loic]

Attachment: test.html

Comment 7

[Loic]

I can't reproduce it by changing the location of:
xml = loadXMLDoc("/test/test.xml");
xsl = loadXMLDoc("/test/test.xsl");
by the URL of the files attached to the bug report.

Firefox displays a failure in the web console after loading the html file. Could you fix your testcase, please.

Comment 8

[aloha_user604]

Hi,

Since the URL you are using is of different domain(bugzilla.mozilla.org), it seems to be the issue with the Cross Origin Resource Sharing (CORS). For this to work, we may need to set "Access-Control-Allow-Origin : domain_name" on both domain servers.(http://dev.housetrip.com/2014/04/17/unleash-your-ajax-requests-with-cors)

Instead, can you please download these files locally and use the URL with same domain as of your web server (http://localhost/file_location) ? Or you can use file path as well. This works perfectly at my end.

Thanks,

Comment 9

[Loic]

It's weird, because in my last attachment test.html (https://bugzilla.mozilla.org/attachment.cgi?id=8751756) I changed the location of both files:
xml = loadXMLDoc("https://bugzilla.mozilla.org/attachment.cgi?id=8751248");
xsl = loadXMLDoc("https://bugzilla.mozilla.org/attachment.cgi?id=8751247");

So CORS should be not an issue.

Comment 10

[Loic]

I got: NS_ERROR_DOM_BAD_URI: Access to restricted URI denied

Comment 11

[aloha_user604]

On accessing the test.html page with
xml = loadXMLDoc("https://bugzilla.mozilla.org/attachment.cgi?id=8751248");
xsl = loadXMLDoc("https://bugzilla.mozilla.org/attachment.cgi?id=8751247");

I got following error:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://bugzilla.mozilla.org/attachment.cgi?id=8751248. (Reason: CORS header 'Access-Control-Allow-Origin' missing).

However, it seems to work when used with same domain in my case.
As for your error,
NS_ERROR_DOM_BAD_URI: Access to restricted URI denied: 
I could find below references
http://stackoverflow.com/questions/6653825/error-access-to-restricted-uri-denied

Can you please try using the URL with same domain as your web server?

Thanks,

Comment 12

[ovidiu boca[:Ovidiu]]

In URL bar type  about:crashes and please provide the ID crash, after you browser crashes.

Comment 13

[ovidiu boca[:Ovidiu]]

Hi Aloha,

Did you manage to provide the ID crashes?

Comment 14

[ovidiu boca[:Ovidiu]]

Hi,
Marking this as Resolved: Incomplete due to the lack of response from Aloha.
If the issue is still reproducible with the latest Firefox version, feel free to reopen the bug with more information.

Comment 15

[Loic]

Attachment: test.html

Comment 16

[Loic]

I'm able to reproduce the crash with the last testcase. It's an issue about freeing memory.

STR:
1) Open test.html https://bugzilla.mozilla.org/attachment.cgi?id=8773695 (loading can take a few sec, youshould see a long table)
2) Close the tab (or even the browser)
3) Wait a few sec

Result: crash.

CR:
https://crash-stats.mozilla.com/report/index/3cb0f0df-5d1f-467b-a17b-844bf2160722
https://crash-stats.mozilla.com/report/index/9471c79a-3f5b-408f-976f-01c292160722
https://crash-stats.mozilla.com/report/index/016c0286-5a88-4fa4-9810-d7a6c2160722

Comment 17

[Loic]

glandium, what do you think about the crash component? Can you retriage the bug if it's not related to memory allocator, maybe in XPCOM.

Comment 18

[Mike Hommey [:glandium]]

Smells like a double free in the XSLT processor. Someone should try to run the test case with an ASAN build.

Comment 19

[Peter Van der Beken [:peterv]]

It's actually a stack overflow due to very deep recursion when releasing a linked list of instructions.

Comment 20

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 21

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 23

[Peter Van der Beken [:peterv]]

Attachment: Bug 1271960 - Better clean up of linked lists. r?mccr8!

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5e7f9f410081
Better clean up of linked lists. r=mccr8

Comment 25

[Iulian Moraru]

Backed out for causing bp-hybrid bustages.

Push with failures

Failure log for when the first line of fail is on txInstructions.h
Failure log for when the first line of fail is on txExecutionState

Backout link

[task 2022-04-21T09:11:24.398Z] 09:11:24     INFO -  gmake[4]: Entering directory '/builds/worker/workspace/obj-build/dom/xslt/xslt'
[task 2022-04-21T09:11:24.401Z] 09:11:24     INFO -  /builds/worker/fetches/sccache/sccache /builds/worker/fetches/clang/bin/clang++ --sysroot /builds/worker/fetches/sysroot-x86_64-linux-gnu -std=gnu++17 -o txExecutionState.o -c  -I/builds/worker/workspace/obj-build/dist/stl_wrappers -I/builds/worker/workspace/obj-build/dist/system_wrappers -include /builds/worker/checkouts/gecko/config/gcc_hidden.h -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fstack-protector-strong -fstack-clash-protection -DNDEBUG=1 -DTRIMMED=1 -DMOZ_HAS_MOZGLUE -DMOZILLA_INTERNAL_API -DIMPL_LIBXUL -DSTATIC_EXPORTABLE_JS_API -I/builds/worker/checkouts/gecko/dom/xslt/xslt -I/builds/worker/workspace/obj-build/dom/xslt/xslt -I/builds/worker/checkouts/gecko/dom/xslt/base -I/builds/worker/checkouts/gecko/dom/xslt/xml -I/builds/worker/checkouts/gecko/dom/xslt/xpath -I/builds/worker/checkouts/gecko/dom/base -I/builds/worker/checkouts/gecko/js/xpconnect/src -I/builds/worker/checkouts/gecko/parser/htmlparser -I/builds/worker/workspace/obj-build/dist/include -I/builds/worker/workspace/obj-build/dist/include/nspr -I/builds/worker/workspace/obj-build/dist/include/nss -DMOZILLA_CLIENT -include /builds/worker/workspace/obj-build/mozilla-config.h -Qunused-arguments -Qunused-arguments -Wall -Wbitfield-enum-conversion -Wdeprecated-this-capture -Wempty-body -Wformat-type-confusion -Wignored-qualifiers -Wpointer-arith -Wshadow-field-in-constructor-modified -Wsign-compare -Wtype-limits -Wno-error=tautological-type-limit-compare -Wunreachable-code -Wunreachable-code-return -Wunused-but-set-parameter -Wno-invalid-offsetof -Wclass-varargs -Wempty-init-stmt -Wfloat-overflow-conversion -Wfloat-zero-conversion -Wloop-analysis -Wno-range-loop-analysis -Wc++2a-compat -Wcomma -Wenum-compare-conditional -Wimplicit-fallthrough -Werror=non-literal-null-conversion -Wstring-conversion -Wno-inline-new-delete -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=backend-plugin -Wno-error=free-nonheap-object -Wno-error=return-std-move -Wno-error=atomic-alignment -Wno-error=deprecated-copy -Wformat -Wformat-security -Wno-gnu-zero-variadic-macro-arguments -Wno-psabi -Wthread-safety -Wno-unknown-warning-option -D_GLIBCXX_USE_CXX11_ABI=0 -fno-sized-deallocation -fno-aligned-new -fcrash-diagnostics-dir=/builds/worker/artifacts -fno-exceptions -fPIC -fno-rtti -ffunction-sections -fdata-sections -fno-exceptions -fno-math-errno -pthread -pipe -gdwarf-4 -Xclang -load -Xclang /builds/worker/workspace/obj-build/build/clang-plugin/libclang-plugin.so -Xclang -add-plugin -Xclang moz-check -O2 -fno-omit-frame-pointer -funwind-tables -Werror -fno-strict-aliasing -ffp-contract=off  -MD -MP -MF .deps/txExecutionState.o.pp   /builds/worker/checkouts/gecko/dom/xslt/xslt/txExecutionState.cpp
[task 2022-04-21T09:11:24.402Z] 09:11:24     INFO -  In file included from /builds/worker/checkouts/gecko/dom/xslt/xslt/txExecutionState.cpp:8:
[task 2022-04-21T09:11:24.402Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:29:29: error: expected ';' after expression
[task 2022-04-21T09:11:24.402Z] 09:11:24     INFO -      UniquePtr<txInstruction> next(std::move(mNext));
[task 2022-04-21T09:11:24.403Z] 09:11:24     INFO -                              ^
[task 2022-04-21T09:11:24.403Z] 09:11:24     INFO -                              ;
[task 2022-04-21T09:11:24.403Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:29:5: error: use of undeclared identifier 'UniquePtr'
[task 2022-04-21T09:11:24.403Z] 09:11:24     INFO -      UniquePtr<txInstruction> next(std::move(mNext));
[task 2022-04-21T09:11:24.403Z] 09:11:24     INFO -      ^
[task 2022-04-21T09:11:24.403Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:29:30: error: use of undeclared identifier 'next'; did you mean 'std::next'?
[task 2022-04-21T09:11:24.404Z] 09:11:24     INFO -      UniquePtr<txInstruction> next(std::move(mNext));
[task 2022-04-21T09:11:24.404Z] 09:11:24     INFO -                               ^~~~
[task 2022-04-21T09:11:24.404Z] 09:11:24     INFO -                               std::next
[task 2022-04-21T09:11:24.404Z] 09:11:24     INFO -  /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_iterator_base_funcs.h:208:5: note: 'std::next' declared here
[task 2022-04-21T09:11:24.405Z] 09:11:24     INFO -      next(_ForwardIterator __x, typename
[task 2022-04-21T09:11:24.405Z] 09:11:24     INFO -      ^
[task 2022-04-21T09:11:24.405Z] 09:11:24     INFO -  In file included from /builds/worker/checkouts/gecko/dom/xslt/xslt/txExecutionState.cpp:8:
[task 2022-04-21T09:11:24.405Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:29:30: error: no matching function for call to 'next'
[task 2022-04-21T09:11:24.405Z] 09:11:24     INFO -      UniquePtr<txInstruction> next(std::move(mNext));
[task 2022-04-21T09:11:24.405Z] 09:11:24     INFO -                               ^~~~
[task 2022-04-21T09:11:24.406Z] 09:11:24     INFO -  /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_iterator_base_funcs.h:208:5: note: candidate template ignored: substitution failure [with _ForwardIterator = mozilla::UniquePtr<txInstruction>]: no type named 'difference_type' in 'std::iterator_traits<mozilla::UniquePtr<txInstruction>>'
[task 2022-04-21T09:11:24.406Z] 09:11:24     INFO -      next(_ForwardIterator __x, typename
[task 2022-04-21T09:11:24.406Z] 09:11:24     INFO -      ^
[task 2022-04-21T09:11:24.406Z] 09:11:24     INFO -  In file included from /builds/worker/checkouts/gecko/dom/xslt/xslt/txExecutionState.cpp:8:
[task 2022-04-21T09:11:24.407Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:30:12: error: use of undeclared identifier 'next'; did you mean 'std::next'?
[task 2022-04-21T09:11:24.407Z] 09:11:24     INFO -      while (next) {
[task 2022-04-21T09:11:24.407Z] 09:11:24     INFO -             ^~~~
[task 2022-04-21T09:11:24.407Z] 09:11:24     INFO -             std::next
[task 2022-04-21T09:11:24.407Z] 09:11:24     INFO -  /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_iterator_base_funcs.h:208:5: note: 'std::next' declared here
[task 2022-04-21T09:11:24.407Z] 09:11:24     INFO -      next(_ForwardIterator __x, typename
[task 2022-04-21T09:11:24.408Z] 09:11:24     INFO -      ^
[task 2022-04-21T09:11:24.408Z] 09:11:24     INFO -  In file included from /builds/worker/checkouts/gecko/dom/xslt/xslt/txExecutionState.cpp:8:
[task 2022-04-21T09:11:24.408Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:30:12: error: reference to overloaded function could not be resolved; did you mean to call it?
[task 2022-04-21T09:11:24.408Z] 09:11:24     INFO -      while (next) {
[task 2022-04-21T09:11:24.408Z] 09:11:24     INFO -             ^~~~
[task 2022-04-21T09:11:24.409Z] 09:11:24     INFO -  /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_iterator_base_funcs.h:208:5: note: possible target for call
[task 2022-04-21T09:11:24.409Z] 09:11:24     INFO -      next(_ForwardIterator __x, typename
[task 2022-04-21T09:11:24.409Z] 09:11:24     INFO -      ^
[task 2022-04-21T09:11:24.409Z] 09:11:24     INFO -  In file included from /builds/worker/checkouts/gecko/dom/xslt/xslt/txExecutionState.cpp:8:
[task 2022-04-21T09:11:24.409Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:31:31: error: expected ';' after expression
[task 2022-04-21T09:11:24.409Z] 09:11:24     INFO -        UniquePtr<txInstruction> destroy(std::move(next));
[task 2022-04-21T09:11:24.410Z] 09:11:24     INFO -                                ^
[task 2022-04-21T09:11:24.410Z] 09:11:24     INFO -                                ;
[task 2022-04-21T09:11:24.410Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:31:7: error: use of undeclared identifier 'UniquePtr'
[task 2022-04-21T09:11:24.410Z] 09:11:24     INFO -        UniquePtr<txInstruction> destroy(std::move(next));
[task 2022-04-21T09:11:24.410Z] 09:11:24     INFO -        ^
[task 2022-04-21T09:11:24.411Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:31:50: error: use of undeclared identifier 'next'
[task 2022-04-21T09:11:24.411Z] 09:11:24     INFO -        UniquePtr<txInstruction> destroy(std::move(next));
[task 2022-04-21T09:11:24.411Z] 09:11:24     INFO -                                                   ^
[task 2022-04-21T09:11:24.411Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:32:7: error: use of undeclared identifier 'next'
[task 2022-04-21T09:11:24.411Z] 09:11:24     INFO -        next = std::move(destroy->mNext);
[task 2022-04-21T09:11:24.411Z] 09:11:24     INFO -        ^
[task 2022-04-21T09:11:24.412Z] 09:11:24    ERROR -  /builds/worker/checkouts/gecko/dom/xslt/xslt/txInstructions.h:32:24: error: use of undeclared identifier 'destroy'
[task 2022-04-21T09:11:24.412Z] 09:11:24     INFO -        next = std::move(destroy->mNext);
[task 2022-04-21T09:11:24.412Z] 09:11:24     INFO -                         ^
[task 2022-04-21T09:11:24.412Z] 09:11:24     INFO -  11 errors generated.
[task 2022-04-21T09:11:24.412Z] 09:11:24    ERROR -  gmake[4]: *** [/builds/worker/checkouts/gecko/config/rules.mk:658: txExecutionState.o] Error 1
[task 2022-04-21T09:11:24.412Z] 09:11:24     INFO -  gmake[4]: Leaving directory '/builds/worker/workspace/obj-build/dom/xslt/xslt'
[task 2022-04-21T09:11:24.413Z] 09:11:24    ERROR -  gmake[3]: *** [/builds/worker/checkouts/gecko/config/recurse.mk:72: dom/xslt/xslt/target-objects] Error 2
[task 2022-04-21T09:11:24.413Z] 09:11:24     INFO -  gmake[3]: *** Waiting for unfinished jobs....
[task 2022-04-21T09:11:24.413Z] 09:11:24     INFO -  gmake[4]: Entering directory '/builds/worker/workspace/obj-build/extensions/pref/autoconfig/src'

Comment 26

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a77800f561dc
Better clean up of linked lists. r=mccr8

Comment 27

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/a77800f561dc

Comment 29

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.