270658 - freeze XSLT if xhtml namespace in script element

Status: RESOLVED WORKSFORME

(Core :: XML, defect)

Description

[Pascal S. de Kloe]

User-Agent:       Mozilla/5.0 (X11; U; Linux alpha; en-GB; rv:1.7.3) Gecko/20040919
Build Identifier: 

The 3 attachemens are ment as a proof of concept.
If you remove the namespace in script.xml Firefox won't crash.

Reproducible: Always
Steps to Reproduce:
1) download the 3 files in a single directory
2) open a.xml
3) FREEZE

Comment 1

[Pascal S. de Kloe]

Attachment: a.xml

Comment 2

[Pascal S. de Kloe]

Attachment: a.xsl

Comment 3

[Pascal S. de Kloe]

Attachment: script.xml

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Actually, I don't think this is xslt related. It's probably because we're unable
to deal with having <script> elements in the root of the document.

nsHTMLScriptElement::MaybeProcessScript just bails if GetParent() returns null,
which means that we'll never call ProcessScriptElement and no
ScriptAvailable/ScriptEvaluated notification will go out to unblock the parser.

We should probably change !GetParent() to

!(GetParent() || GetCurrentDoc()->GetRootContent() == this)

same thing in nsSVGScriptElement.

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

cc'ing some people that might have time to look at this

Comment 6

[Boris Zbarsky [:bzbarsky]]

Note the patch in bug 88309 -- this has some content sink changes too, though I
can't tell why they're needed, exactly.

Comment 7

[Pascal S. de Kloe]

For some reason a.xml is no longer available...

Comment 8

[Pascal S. de Kloe]

Attachment: a.xml

Comment 9

[Pascal S. de Kloe]

Firefox 1.0.6 still freezes...

Comment 10

[Pascal S. de Kloe]

Firefox 2.0 still freezes...

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Pascal - there's nothing in this bug to indicate that it would have been fixed, so please follow the etiquette guidelines prior to posting in the future.
https://bugzilla.mozilla.org/page.cgi?id=etiquette.html

Also, none of the testcases above freeze me using a current win32 trunk build, so this is either Linux-only or fixed for Fx3. Can any Linux trunk users confirm?

Comment 12

[Pascal S. de Kloe]

Hello Ryan VanderMeulen,

The Firefox shipped with both the latest Ubuntu and the latest OpenSUSE freeze. I just checked 2.0 RC3 to be sure and the results are the same.

Is there something I can do to provide more information?

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Like I said, try testing with a current trunk build (what's leading up to Fx3).

Comment 14

[Pascal S. de Kloe]

Ah, so Fx3 means Firefox 3. Those abbrevations always drive me nuts.

Yes it is Fixed in "2007-02-04-04-trunk"! :)

Thank you for the help.