146119 - crash hitting 'back' on xml document (reproducible)

Status: RESOLVED DUPLICATE of bug 142108

(Core :: XML, defect)

Description

[David Gerard]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc3)
Gecko/20020516
BuildID:    2002051606

This xml document reliably crashed Mozilla three times, with talkbacks.

Reproducible: Always
Steps to Reproduce:
1. Start Mozilla and go to the document on the local disk.
2. Go to the document at the above URL.
3. Hit 'back' button.

Actual Results:  Crash.

Expected Results:  Stability.

The server (velvet.net) is currently misconfigured to serve .xsl as
text/plain. I already emailed the admin about it, so this will probably
be fixed in a few hours.

I will attach a copy of the file to this bug. To simulate what I did
when the server is fixed, you will need (1) a copy of the file on the
local disk (2) a misconfigured Apache server with a copy of the file
and its supporting files (all of which are in the directory on velvet).
But if you hit it straight after I file this bug you should be able to
see it.

Oh, the copy on my local hard disk does NOT have all the supporting
files - just faqs.xsl.

Talkback IDs:

TB6536878Z
TB6536888Y
TB6536948E

Also, one which may be the same thing: TB6536432Q - just went to the
folder on my local disk in Mozilla, double-clicked on the XML file and
it crashed.

Comment 1

[David Gerard]

Attachment: XML document I was trying to view

Comment 2

[David Gerard]

Attachment: XSL for above XML document

Comment 3

[David Gerard]

And, before anyone suggests I try a newer build, this is with 2002052106-1.0,
which I fetched just a moment ago:

TB6537364Z
TB6537399Q

See the document? That's supposed to become the 1.0 startpage FAQ ... not what
one wants reliably crashing the browser ;-)

We'll see if a correctly-configured server still triggers it, in a few hours.

Comment 4

[Olivier Cahagne]

confirming using build 2002052108 on Win2k (trunk), I crashed loading faqs.xml
(using faqs.xsl) on a local Web server.
Couldn't find dupes, marking NEW.

Comment 5

[David Gerard]

Is it premature to suggest this is a 1.0 candidate?

Comment 6

[Matthias Versen [:Matti]]

grr, stupid mid-airs :-(

I think that this will not be fixed for 1.0....


win2k stack trace from my debug build:
nsXMLContentSink::Observe(nsXMLContentSink * const 0x03a1734c, nsISupports * 
0x04da8888, const char * 0x043890a4, const unsigned short * 0x00000000) line 448 
+ 44 bytes
nsObserverService::NotifyObservers(nsObserverService * const 0x0104f2f8, 
nsISupports * 0x04da8888, const char * 0x043890a4, const unsigned short * 
0x00000000) line 213
XSLTProcessor::SignalTransformEnd() line 2527
XSLTProcessor::TransformDocument(XSLTProcessor * const 0x036f49f8, nsIDOMNode * 
0x03a8826c, nsIDOMNode * 0x038c1bb4, nsIDOMDocument * 0x04df6f8c, nsIObserver * 
0x04f99994) line 2472
nsTransformMediator::TryToTransform() line 113
nsTransformMediator::SetStyleSheetContentModel(nsTransformMediator * const 
0x04d5d280, nsIDOMNode * 0x038c1bb4) line 162
nsXSLContentSink::DidBuildModel(nsXSLContentSink * const 0x04e49b20, int 0) line 
147
nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x04d27a38, unsigned int 0, 
int 1, nsIParser * 0x04f972e0, nsIContentSink * 0x04e49b20) line 881 + 23 bytes
nsParser::DidBuildModel(unsigned int 0) line 1251 + 41 bytes
nsParser::ResumeParse(int 1, int 1, int 1) line 1796
nsParser::OnStopRequest(nsParser * const 0x04f972e4, nsIRequest * 0x04e093b0, 
nsISupports * 0x00000000, unsigned int 0) line 2417 + 21 bytes
nsFileChannel::OnStopRequest(nsFileChannel * const 0x04e093b8, nsIRequest * 
0x04d648dc, nsISupports * 0x00000000, unsigned int 0) line 519 + 41 bytes
nsOnStopRequestEvent::HandleEvent() line 213
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x02218914) line 116
PL_HandleEvent(PLEvent * 0x02218914) line 596 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0104f078) line 526 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001b0130, unsigned int 49384, unsigned int 0, 
long 17100920) line 1077 + 9 bytes
USER32! 77e01b60()
USER32! 77e01cca()
USER32! 77e083f1()
nsAppShellService::Run(nsAppShellService * const 0x010e2a88) line 451
main1(int 2, char * * 0x002830b0, nsISupports * 0x00000000) line 1456 + 32 bytes
main(int 2, char * * 0x002830b0) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e7d326()


found a dupe :-)


*** This bug has been marked as a duplicate of 142108 ***