215314 - input type="file" from XML through XSLT crashes mozilla/firebird.

Status: RESOLVED DUPLICATE of bug 212793

(Core :: XSLT, defect)

Description

[Frédéric Desmoulins]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4bi; MSIE 6.0; Windows NT 5.1) Gecko/20030613 Mozilla Firebird/0.6
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4bi) Gecko/20030613 Mozilla Firebird/0.6

Producing an input type="file" element using XML+XSLT->XHTML works well the
first time you load the page but will crash mozilla as soon you browse another
web page.

Reproducible: Always

Steps to Reproduce:
1.create an XML that call an XSL stylesheet (2)
2.create an XSL stylsheet that provide an input type="file"
3.browse the XML page (done in (1)) and try to load a new web page (or simply
reload this one).

Actual Results:  
Mozilla crash !

Expected Results:  
Do not crash :)

Comment 1

[Olivier Cahagne]

can you attach (via "create a new attachment) both needed files ? Best if the
XML can reference the XSL once uploaded on bugzilla w/ correct MIME types so
that we can click testcase without having to save everything on local filesystem.

Make sure you crash with latest mozilla nightly build:
http://ftp.mozilla.org/pub/mozilla/latest/nightly-trunk
and provide a Talkback ID for the crash
"mozilla/bin/components/talkback/talkback" (after crashing) or a GDB stack trace
via "mozilla -g".

Comment 2

[Olivier Cahagne]

related: bug 212793 ? (stack will provide more information hopefully)

Comment 3

[Frédéric Desmoulins]

Attachment: the XML file that call XSL stylesheet

Comment 4

[Frédéric Desmoulins]

Attachment: The XSL stylesheet

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Can anyone reproduce this with a 1.4 build?

Comment 6

[Frédéric Desmoulins]

This bug seems to concern only 1.4 (at least, the problem does not happen with 1.3).

Note: The bug happens with a compilation on i686 (gentoo/linux , source from
ftp://ftp.mozilla.org/pub/mozilla/releases/mozilla1.4/src/mozilla-source-1.4.tar.bz2)

Comment 7

[Frédéric Desmoulins]

Hope this will be useful:

$ MozillaFirebird -g

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 6943)]
0x40d0283d in NSGetModule () from /opt/MozillaFirebird/components/libgklayout.so
(gdb) 

Comment 8

[Andrew Schultz]

Attachment: stacktrace

(gdb) frame 4
#4  0x4117616d in nsGenericHTMLElement::GetLayoutHistoryAndKey(nsIHTMLContent*,
nsILayoutHistoryState**, nsACString&) (aContent=0x8735840, aHistory=0xbfffc1c0,
aKey=@0x4138fca0) at nsGenericHTMLElement.cpp:2704
2704	    NS_RELEASE(*aHistory);
(gdb) p aHistory
$1 = (class nsILayoutHistoryState **) 0xbfffc1c0
(gdb) p *aHistory
$2 = (class nsILayoutHistoryState *) 0x0

Comment 9

[Andrew Schultz]

dupe of "crash when following link with a file upload box is on the screen with
XSLT generated content"

*** This bug has been marked as a duplicate of 212793 ***