Closed Bug 146119 Opened 18 years ago Closed 18 years ago

crash hitting 'back' on xml document (reproducible)


(Core :: XML, defect, critical)

Windows 2000
Not set





(Reporter: fun, Assigned: hjtoi-bugzilla)




(Keywords: crash, stackwanted)


(2 files)

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc3)
BuildID:    2002051606

This xml document reliably crashed Mozilla three times, with talkbacks.

Reproducible: Always
Steps to Reproduce:
1. Start Mozilla and go to the document on the local disk.
2. Go to the document at the above URL.
3. Hit 'back' button.

Actual Results:  Crash.

Expected Results:  Stability.

The server ( is currently misconfigured to serve .xsl as
text/plain. I already emailed the admin about it, so this will probably
be fixed in a few hours.

I will attach a copy of the file to this bug. To simulate what I did
when the server is fixed, you will need (1) a copy of the file on the
local disk (2) a misconfigured Apache server with a copy of the file
and its supporting files (all of which are in the directory on velvet).
But if you hit it straight after I file this bug you should be able to
see it.

Oh, the copy on my local hard disk does NOT have all the supporting
files - just faqs.xsl.

Talkback IDs:


Also, one which may be the same thing: TB6536432Q - just went to the
folder on my local disk in Mozilla, double-clicked on the XML file and
it crashed.
And, before anyone suggests I try a newer build, this is with 2002052106-1.0,
which I fetched just a moment ago:


See the document? That's supposed to become the 1.0 startpage FAQ ... not what
one wants reliably crashing the browser ;-)

We'll see if a correctly-configured server still triggers it, in a few hours.
Keywords: crash, stackwanted
confirming using build 2002052108 on Win2k (trunk), I crashed loading faqs.xml
(using faqs.xsl) on a local Web server.
Couldn't find dupes, marking NEW.
Assignee: Matti → heikki
Component: Browser-General → XML
Ever confirmed: true
QA Contact: imajes-qa → petersen
Is it premature to suggest this is a 1.0 candidate?
grr, stupid mid-airs :-(

I think that this will not be fixed for 1.0....

win2k stack trace from my debug build:
nsXMLContentSink::Observe(nsXMLContentSink * const 0x03a1734c, nsISupports * 
0x04da8888, const char * 0x043890a4, const unsigned short * 0x00000000) line 448 
+ 44 bytes
nsObserverService::NotifyObservers(nsObserverService * const 0x0104f2f8, 
nsISupports * 0x04da8888, const char * 0x043890a4, const unsigned short * 
0x00000000) line 213
XSLTProcessor::SignalTransformEnd() line 2527
XSLTProcessor::TransformDocument(XSLTProcessor * const 0x036f49f8, nsIDOMNode * 
0x03a8826c, nsIDOMNode * 0x038c1bb4, nsIDOMDocument * 0x04df6f8c, nsIObserver * 
0x04f99994) line 2472
nsTransformMediator::TryToTransform() line 113
nsTransformMediator::SetStyleSheetContentModel(nsTransformMediator * const 
0x04d5d280, nsIDOMNode * 0x038c1bb4) line 162
nsXSLContentSink::DidBuildModel(nsXSLContentSink * const 0x04e49b20, int 0) line 
nsExpatDriver::DidBuildModel(nsExpatDriver * const 0x04d27a38, unsigned int 0, 
int 1, nsIParser * 0x04f972e0, nsIContentSink * 0x04e49b20) line 881 + 23 bytes
nsParser::DidBuildModel(unsigned int 0) line 1251 + 41 bytes
nsParser::ResumeParse(int 1, int 1, int 1) line 1796
nsParser::OnStopRequest(nsParser * const 0x04f972e4, nsIRequest * 0x04e093b0, 
nsISupports * 0x00000000, unsigned int 0) line 2417 + 21 bytes
nsFileChannel::OnStopRequest(nsFileChannel * const 0x04e093b8, nsIRequest * 
0x04d648dc, nsISupports * 0x00000000, unsigned int 0) line 519 + 41 bytes
nsOnStopRequestEvent::HandleEvent() line 213
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x02218914) line 116
PL_HandleEvent(PLEvent * 0x02218914) line 596 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x0104f078) line 526 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x001b0130, unsigned int 49384, unsigned int 0, 
long 17100920) line 1077 + 9 bytes
USER32! 77e01b60()
USER32! 77e01cca()
USER32! 77e083f1()
nsAppShellService::Run(nsAppShellService * const 0x010e2a88) line 451
main1(int 2, char * * 0x002830b0, nsISupports * 0x00000000) line 1456 + 32 bytes
main(int 2, char * * 0x002830b0) line 1805 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e7d326()

found a dupe :-)

*** This bug has been marked as a duplicate of 142108 ***
Closed: 18 years ago
Resolution: --- → DUPLICATE
QA Contact: petersen → rakeshmishra
You need to log in before you can comment on or make changes to this bug.