186545 - Runtime Error in XPathEvaluator

Status: RESOLVED DUPLICATE of bug 187437

(Core :: XSLT, defect)

Description

[Laurens van den Oever]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20021222
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3b) Gecko/20021222

The evaluate method in the following sniplet sometimes generates a runtime error. 

var xpe = new XPathEvaluator();
var it = xpe.evaluate(xpath, this, xpe.createNSResolver(this), null, null);

this is an instance of Node. The xpath is "//*[local-name()='include' and
namespace-uri()='http://www.w3.org/1999/XSL/Transform']".  

The error:

---------------------------
Microsoft Visual C++ Runtime Library
---------------------------
Runtime Error!

Program: C:\Program Files\Mozilla 1.3\mozilla.exe

R6025

- pure virtual function call


---------------------------
OK   
---------------------------

Reproducible: Always

Steps to Reproduce:
I can reproduce this with the current version of our software. But i couldn't
reproduce it in a standalone test case.
Actual Results:  
The browser crashes.

Expected Results:  
Evaluate the xpath.

This is new in the last nightly build.

Comment 1

[Martijn Kint]

I can confirm this for build Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.3b) Gecko/20021223 also on Windows 2000 (SP3) and Suse Linux 8.1 with a
build of the same date.

Comment 2

[Olivier Cahagne]

debug build 20021220 on Linux:

###!!! ASSERTION: aNode is neither an nsIContent nor an nsIDocument!: 'Error',
file txURIUtils.cpp, line 355
Break: at file txURIUtils.cpp, line 355
JavaScript error: 
 line 0: uncaught exception: [Exception... "Security error"  code: "1000"
nsresult: "0x805303e8 (NS_ERROR_DOM_SECURITY_ERR)"  location: "javascript: var
it = xpe.evaluate(xpath, this, xpe.createNSResolver(this), null, null); Line: 1"]

Comment 3

[Laurens van den Oever]

Maybe this is related to: http://bugzilla.mozilla.org/show_bug.cgi?id=186538
(Touching the ownerElement of an attribute through XPath generates a security 
error.)

Comment 4

[Laurens van den Oever]

I have been able to trace the following crashes to this bug:

TB15443928Q
TB15443773Q
TB15442830M
TB15442798X
TB15442739X
TB15442209G
TB15442204H
TB15442196E
TB15442139E
TB15442133K
TB15442118M
TB15442106Z
TB15441974G
TB15441680M
TB15441553K
TB15441535E
TB15441499Z
TB15441412H
TB15441374M
TB15441294M
TB15441287Y
TB15441254Y
TB15441243G
TB15441228H
TB15441224G
TB15441138K
TB15441114M
TB15441044K
TB15441033W
TB15441017Z
TB15440994E
TB15440916K
TB15440902K
TB15440853Y
TB15440737K
TB15440730Y
TB15440707W
TB15440527Y
TB15418371Z
TB15418287X
TB15418173Z
TB15416841K
TB15416547W
TB15415957Y
TB15415929X
TB15414180Y
TB15413959W
TB15413947G
TB15413934Z
TB15412845Y
TB15412746Y

BTW The problem seems to be timing related. If i add two or three alerts in 
front of the evaluate line, the browser will not crash.

Comment 5

[Laurens van den Oever]

Reproduced in Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) 
Gecko/20021212

Here i get a silent browser crash instead of the Runtime Error.

Comment 6

[Heikki Toivonen (remove -bugzilla when emailing directly)]

XPath bugs belong in the XSLT component, reassigning.

Comment 7

[Peter Van der Beken [:peterv]]

Can someone provide a testcase please?

Comment 8

[Peter Van der Beken [:peterv]]

Nevermind, I'm going to dupe this one to bug 187437, which is easily reproducable.

*** This bug has been marked as a duplicate of 187437 ***