361399 - Crash [@ LocationStep::getAxisIdentifier] at Yahoo! Mail Beta on trunk

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[Martijn Wargers (dead)]

These talkback reports are mentioning that the new Yahoo Mail Beta is crashing on trunk:
http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stacksig&match=contains&searchfor=txXPathOptimizer::optimizePath&vendor=MozillaOrg&product=FirefoxTrunk&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid

I can reproduce this in my debug build:
First 3 lines of backtrace in my debug build:
#0  0x03f0487e in LocationStep::getAxisIdentifier (this=0x14f7efe4)
    at c:/mozilla/mozilla/content/xslt/src/xpath/txExpr.h:635
#1  0x03ce26f5 in txXPathOptimizer::optimizePath (this=0x22d897,
    aInExpr=0x14f7eff8, aOutExpr=0x22d8b4)
    at c:/mozilla/mozilla/content/xslt/src/xpath/txXPathOptimizer.cpp:136
#2  0x03ce23b5 in txXPathOptimizer::optimize (this=0x22d897,
    aInExpr=0x14f7eff8, aOutExpr=0x22d8b4)
    at c:/mozilla/mozilla/content/xslt/src/xpath/txXPathOptimizer.cpp:73
#3  0x03cd5c81 in txExprParser::createExprInternal (aExpression=@0x22d94c,
    aSubStringPos=0, aContext=0x22d96c, aExpr=0x22d98c)
    at c:/mozilla/mozilla/content/xslt/src/xpath/txExprParser.cpp:212

Getting a minimised testcase is probably very difficult.
I'll try to come up with a regression range later today.
If anyone wants to have my login data, please ask me, and I'll provide them.

Comment 1

[Martijn Wargers (dead)]

Attachment: complete backtrace of debug build

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

No need for regression window, i know what's wrong here.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: Patch to fix

Oops

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Checked in.