163476 - Crash (reproducible) on loading this XML+XSLT; have stack trace

Status: RESOLVED DUPLICATE of bug 138183

(Core :: XSLT, defect)

Description

[Ken Harris]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.1b) Gecko/20020818
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.1b) Gecko/20020818

I was playing around with XML and XSLT (never used XSLT before, I'm a complete
rookie with it), and when I added 2 more (simple) <xsl:template>'s to my XSL
file, Mozilla crashed when trying to load it, every time.

Reproducible: Always

Steps to Reproduce:
1. Start Mozilla
2. Load this XML file
Actual Results:  
Mozilla crashes

Expected Results:  
(...)

I'll attach the stacktrace -- it's always in the same place.

I'll try to get a smaller case that also crashes Mozilla (the XML file is
2000+ lines).

Comment 1

[Ken Harris]

Attachment: Stack trace from Console

Comment 2

[Ken Harris]

Attachment: Short (35-line) version of my XSL file

I managed to get it down to a 20-line XML file and a 35-line XSLT file
that still crashes Mozilla.  Here's the XSLT, XML to follow.

Comment 3

[Ken Harris]

Attachment: Short (20-line) version of XML file (careful, crashes Moz!)

A 20-line version of my XML file that still crashes Mozilla.  I pointed it
at the previous attachment, so viewing it here directly should crash Mozilla...

Comment 4

[Olivier Cahagne]

confirming crash using build 2002081904 on Win2k and 2002081905 Linux (trunk).
OS -> All.
didn't find dupes, marking NEW.

Comment 5

[Olivier Cahagne]

Attachment: Stack trace from Linux 20020811 (trunk)

Talkback ID from Win2k 2002081904 (trunk), in case needed: TB9562166E. I submit
it because the Linux stack trace is a bit different from the MacOSX stack
trace.

Comment 6

[Peter Van der Beken [:peterv]]

I bet the problem is this line:

<xsl:apply-templates select="."/>

What exactly are you trying to achieve? This recursively calls the same template
until we blow up. This should probably be duped against bug 138183.

Comment 7

[Ken Harris]

Hmm...  Ok, it looks like a dupe of that, good call.

Reading the comments over there: normally I'd agree that something as simple as
counting isn't strictly correct, but I think something simple like that might
be the right thing to do.  Yeah, it'd reject legit uses of 501-deeply-nested
translations, but those are (1) probably very rare, and (2) at some point near
there they'd crash Mozilla anyway, so telling the user "This XSL is trying to
recurse over 500 times, and Mozilla would probably run out of memory if it
tried to do all that" is far preferable to just crashing.

Even better, instead of using a fixed value (500), could Mozilla watch and see
when it's going to run out of memory?  Is this as simple as adding an extra
check?

Comment 8

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

dupping, unfortunatly I don't know of any way to check for out-of-stackspace.
You can't just check for out-of-memory since that checks a different memoryarea,
where there in fact is memory available.

*** This bug has been marked as a duplicate of 138183 ***