147244 - Listbox embedded in XML crashes

Status: RESOLVED WORKSFORME

(Core :: XUL, defect, P4)

Description

[Håkan Waara]

I don't know in what component to file this, but it happens when I try to use 
my XSLT file to produce some XUL. Here's the talkback stack:

nsCSSFrameConstructor::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 8764]
StyleSetImpl::ContentInserted 
[d:\builds\seamonkey\mozilla\content\base\src\nsStyleSet.cpp, line 1525]
PresShell::ContentInserted 
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5189]
nsXBLBindingRequest::DocumentLoaded 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp, line 163]
nsXBLStreamListener::Load 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp, line 427]
nsEventListenerManager::HandleEvent 
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, 
line 1859]
nsDocument::HandleDOMEvent 
[d:\builds\seamonkey\mozilla\content\base\src\nsDocument.cpp, line 3290]
nsXMLDocument::EndLoad 
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLDocument.cpp, line 
725]
nsXMLContentSink::DidBuildModel 
[d:\builds\seamonkey\mozilla\content\xml\document\src\nsXMLContentSink.cpp, 
line 393]
nsExpatDriver::DidBuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsExpatDriver.cpp, line 938]
nsParser::DidBuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1253]
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1790]
nsParser::OnStopRequest 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2419]
nsXBLStreamListener::OnStopRequest 
[d:\builds\seamonkey\mozilla\content\xbl\src\nsXBLService.cpp, line 309]
nsJARChannel::OnStopRequest 
[d:\builds\seamonkey\mozilla\netwerk\protocol\jar\src\nsJARChannel.cpp, line 
609]
nsOnStopRequestEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 
213]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 530]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1078]
USER32.dll + 0x3c076 (0x77d6c076)
USER32.dll + 0x3c076 (0x77d6c076)
_except_handler3()
kernel32.dll + 0x3bb86 (0x77e9bb86)

Comment 1

[Håkan Waara]

Attachment: rss-stylesheet.xsl

Save this file to your HD as rss-stylesheet.xsl

Comment 2

[Håkan Waara]

Attachment: testfeed.xml

Save this file as testfeed.xml and then run it in Mozilla. You will crash!

Comment 3

[Håkan Waara]

A FYI to Pike: this bug started happening when I converted my XSLT to use XUL 
instead of HTML.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: testcase that links to attached version of stylesheet

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Doesn't crash for me, when attached to bugzilla.

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Hrm, so it does crash for me, locally.

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

In any case, I don't think this is my bug.  Part of the problem may be that XUL
content nodes depend on the XUL content sink rather than the XML content sink. 
But assigning to XSLT for initial investigation.

(nsCSSFrameConstructor does not imply Style System.  It's really more layout
than anything else, but just because the crash is there doesn't mean that it's
the fault of that code.  It also helps to know what the build date is for the
talkback stack, since nsCSSFrameConstructor.cpp changes often, so it's hard to
match up line numbers without knowing which build the stack is from.)

Comment 8

[Peter Van der Beken [:peterv]]

Oh, this is totally unsupported right now. No idea when/if we'll get it to work.
I'll look if I can avoid the crash first.

Comment 9

[Håkan Waara]

The build I used to report the talkback stack with was Mozilla RC3.

Comment 10

[Axel Hecht]

Attachment: result of the transformation

This is the result of the transformation. This crashes if saved as result.xml
and succeeds when saved as result.xul.
So this is not a XSLT issue, but a "embed XUL into XML".

Comment 11

[Axel Hecht]

XSLT just triggers this, but this is a crasher independent of XSLT.
Moving to XP Toolkit/Widgets, as that seems to be the home of listbox.

Comment 12

[Håkan Waara]

I don't see listbox in the stack though.  Shaver and peterv said this has
something to do with XML/XUL content sinks...

Comment 13

[jag (Peter Annema)]

-> xul, for now

Comment 14

[Jeff Walden [:Waldo]]

This is WFM in 1.7b.

Comment 15

[Asa Dotzler [:asa]]

unable to reproduce crashers locally or remotely with 1.7 Beta and latest
firefox nightly build on Windows XP.