crash when using the results of ORDERED_NODE_SNAPSHOT_TYPE

RESOLVED FIXED

Status

()

Core
XSLT
--
critical
RESOLVED FIXED
11 years ago
11 years ago

People

(Reporter: Chris Shoemaker, Assigned: sicking)

Tracking

Trunk
x86
Linux
Points:
---
Bug Flags:
blocking1.9 +
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

11 years ago
I realize that the results of an ORDERED_NODE_SNAPSHOT_TYPE may not remain valid
through document mutations.  However, this script crashes minefield hard.  Perhaps the crash is a separate bug, but my impression is that the snapshot is using a
rather fragile way of referencing attribute nodes, e.g. by some index rather than by name.

When the first line in crash() is commented out, it no longer crashes, but it still end up removing attributes that don't belong in the snapshot.  I don't know the spec well enough to assert that this is a violation, but it certainly feels like it defeats the entire purpose of using ORDERED_NODE_SNAPSHOT_TYPE.
(Reporter)

Comment 1

11 years ago
Created attachment 283364 [details]
crashing testcase
Flags: blocking1.9?
Yeah, this is looking bad. We should simply keep an nsCOMArray<> of all the nodes in the snapshot.
Assignee: nobody → jonas
Flags: blocking1.9? → blocking1.9+
This should be fixed by the patch in bug 402208
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.