39330 - Loading XML with content type "text/plain" crashes browser

Status: VERIFIED DUPLICATE of bug 40121

(Core :: XML, defect, P3)

Description

[Allen Tom]

Hi Nisheeth, 

     I'm having problems loading XML using HTTP. If I change load.js to be: 
       

     function documentLoaded(e) { 
     s = xmlDoc.getElementsByTagName("test")[0].firstChild.data; 
     alert(s); 
     } 

     var xmlDoc = document.implementation.createDocument("", "", null); 
     xmlDoc.addEventListener("load", documentLoaded, false); 
     xmlDoc.load("http://duckman.mcom.com/shopping_sites.xml", "text/xml"); 

     I get a Dr. Watson error. 

NOTE: This example doesn't quite work anymore since I changed the content type 
for *.xml on duckman to be "text/xml"

Comment 1

[leger]

Putting "crash" in keyword field.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Empty text/plain file (one LF)

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: testcase showing crash

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Confirming bug.  I generally need to reload the testcase once before I see the
crash.  Stack trace:

#0  0x4161bab1 in nsContentList::PopulateWith (this=0x87b6fc8, aContent=0x0, 
    aIncludeRoot=1) at nsContentList.cpp:463
#1  0x4161bba2 in nsContentList::PopulateSelf (this=0x87b6fc8)
    at nsContentList.cpp:483
#2  0x4161ac55 in nsContentList::Init (this=0x87b6fc8, aDocument=0x87e72d8)
    at nsContentList.cpp:103
#3  0x4161ab0b in nsContentList::nsContentList (this=0x87b6fc8, 
    aDocument=0x87e72d8, aMatchAtom=0x8771e30, aMatchNameSpaceId=-1, 
    aRootContent=0x0) at nsContentList.cpp:68
#4  0x41621d65 in nsDocument::GetElementsByTagName (this=0x87e72d8, 
    aTagname=@0xbfffddf4, aReturn=0xbfffde8c) at nsDocument.cpp:2010
#5  0x403d0bad in DocumentGetElementsByTagName (cx=0x86ddae8, obj=0x8692e80, 
    argc=1, argv=0x87dd634, rval=0xbfffdf40) at nsJSDocument.cpp:699
#6  0x401c6496 in js_Invoke (cx=0x86ddae8, argc=1, flags=0) at jsinterp.c:686
#7  0x401d755b in js_Interpret (cx=0x86ddae8, result=0xbfffe90c)
    at jsinterp.c:2485
#8  0x401c64f5 in js_Invoke (cx=0x86ddae8, argc=1, flags=2) at jsinterp.c:702
#9  0x401c682c in js_InternalInvoke (cx=0x86ddae8, obj=0x8692e80, 
    fval=141110472, flags=0, argc=1, argv=0xbfffeaf8, rval=0xbfffea84)
    at jsinterp.c:775
#10 0x40199b07 in JS_CallFunctionValue (cx=0x86ddae8, obj=0x8692e80, 
    fval=141110472, argc=1, argv=0xbfffeaf8, rval=0xbfffea84) at jsapi.c:2766
#11 0x4039a0b7 in nsJSContext::CallEventHandler (this=0x86cf030, 
    aTarget=0x8692e80, aHandler=0x8692cc8, argc=1, argv=0xbfffeaf8, 
    aBoolResult=0xbfffeae8, aReverseReturnResult=0) at nsJSEnvironment.cpp:790
#12 0x403e58b0 in nsJSDOMEventListener::HandleEvent (this=0x8715d68, 
    aEvent=0x8756214) at nsJSDOMEventListener.cpp:94
#13 0x4134cf3c in nsEventListenerManager::HandleEventSubType (this=0x8772e40, 
    aListenerStruct=0x8715d88, aDOMEvent=0x8756214, aCurrentTarget=0x8717160, 
    aSubType=1, aPhaseFlags=7) at nsEventListenerManager.cpp:746
#14 0x4134eaa5 in nsEventListenerManager::HandleEvent (this=0x8772e40, 
    aPresContext=0x0, aEvent=0xbfffefb4, aDOMEvent=0xbfffef80, 
    aCurrentTarget=0x8717160, aFlags=7, aEventStatus=0xbfffeff4)
    at nsEventListenerManager.cpp:1315
#15 0x41623ad7 in nsDocument::HandleDOMEvent (this=0x8717138, 
    aPresContext=0x0, aEvent=0xbfffefb4, aDOMEvent=0xbfffef80, aFlags=1, 
    aEventStatus=0xbfffeff4) at nsDocument.cpp:2664
#16 0x415b625d in nsXMLDocument::EndLoad (this=0x8717138)
    at nsXMLDocument.cpp:588
#17 0x415af104 in nsXMLContentSink::StartLayoutProcess (this=0x871a1b0)
    at nsXMLContentSink.cpp:326
#18 0x415af089 in nsXMLContentSink::DidBuildModel (this=0x871a1b0, 
    aQualityLevel=0) at nsXMLContentSink.cpp:298
...

Comment 5

[Nisheeth Ranjan]

Marking nsbeta2 for PDT approval.  Setting target milestone to M17...

Comment 6

[Chris Hubick]

Attachment: Simple XHTML file which also causes a crash for me.

Comment 7

[Chris Hubick]

I don't know if this should be a separate bug or not.  Mozilla crashes for me 
while attempting to display any XHTML page with an html extension/mime type.  
Removing the <?xml version="1.0"?> declaration at the top of the file allows it 
to load fine.

Comment 8

[Johnny Stenback (:jst)]

Adding nsbeta2 keyword, Nisheeth, you said above that you'd nominate this for
beta2 but I don't see the keyword, this is a crasher and it should IMO be fixed
for beta2 (looks like it's simply a null pointer reference in
nsContentList::PopulateWith()).

Comment 9

[Johnny Stenback (:jst)]

*** Bug 39269 has been marked as a duplicate of this bug. ***

Comment 10

[leger]

Putting on [nsbeta2-] radar.  Need to fix the crash by rtm though.  
Putting on nsbeta3 keyword radar.

atom....don't do this for now.

Comment 11

[Nisheeth Ranjan]

This bug is invalid because the content type parameter on the load method on 
the XML document is shortly going to be removed by vidur.  Only XML documents 
with the "text/xml" content type are meant to be loaded with the load method.

Comment 12

[Christine Hoffman]

Verified bug invalid per engineer comments.

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening.  Crashes are not invalid.  However, this may be a duplicate of bug 40121.

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This is fixed by the patch on bug 40121.

*** This bug has been marked as a duplicate of 40121 ***

Comment 15

[Nick Bebout]

v