306809 - oom mlk in txVariable::Convert

Status: RESOLVED FIXED

(Core :: XSLT, defect, P1)

Description

[timeless]

first the easy mlk:
1108                                   txXPathNode *xpathNode =
1109                                       txXPathNativeNode::createXPathNode(node);
1110                                   if (!xpathNode) {
1111                                       return NS_ERROR_FAILURE;
1112 peterv   1.39                     }
1113               
1114                                   nodeSet->add(*xpathNode);
add returns nsresult (NS_ERROR_OUT_OF_MEMORY). you leak xpathNode;

this also happens near 1202.

i think there's a more fun crash case that could happen involving spidermonkey,
but i'm not sure about the rules for js dependent strings (if i'm right, you
could try to construct a dependentstring from a null pointer or a fmr length).

Comment 1

[Peter Van der Beken [:peterv]]

Attachment: v1

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 194673 [details] [diff] [review]
v1

I'm assuming add() just copies the data in the node and doesn't hold a ptr to
it, right?

Comment 3

[Peter Van der Beken [:peterv]]

Yes. We're going to clean up the whole txXPathNativeNode mess at some point so
that we won't run into these leaks anymore.

Comment 4

[Peter Van der Beken [:peterv]]

Comment on attachment 194673 [details] [diff] [review]
v1

Trivial leak fix.

Comment 5

[Asa Dotzler [:asa]]

Time is short for 1.8b4. If this isn't landed today, it's not going to make the
train.

Comment 6

[Boris Zbarsky [:bzbarsky]]

peterv landed this on branch on the 4th.