401946 - [FIX]Nothing shows up in this case, the previous page stays visible

Status: VERIFIED FIXED

(Core :: XML, defect, P5)

Description

[Martijn Wargers (dead)]

Attachment: testcase

See testcase, when loading that testcase, it seems that nothing is happening and you stay on the previous page like you didn't load that page.

This seems to have regressed between 2007-01-30 and 2007-01-31, which would make it a regression of bug 18333, I guess.
I find this behavior really bizar, so I'm marking it security sensitive for now.

I'm also seeing this assertion appearing in current trunk build:
###!!! ASSERTION: tag in XUL doc epilog: 'mState != eInEpilog', file c:/mozilla-build/mozilla/content/xul/document/src/nsXULContentSink.cpp, line 512
Maybe that has something to do with it?

Comment 1

[Martijn Wargers (dead)]

Currently, the testcase is getting an xml parsing error, that was filed as bug 404866.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I think expat is somehow getting confused with its parser-blocking...  taking out the single <script> makes life happy again.

Then again, I can take out a good bit of the testcase and have the problem still be there.  Martijn, would you be willing to minimize this a bit?

And yes, I can see the XUL epilog assert leading to not rendering....

Comment 3

[Martijn Wargers (dead)]

Attachment: testcase2

Ok, this still asserts for me in my debug build.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Hmm.  I don't get an assert with that last testcase, just a parse error (as expected)...

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Two things this patch is fixing:

Minor: <script> with a present but whitespace-only type attribute was leading to a parse error instead of just being treated like any script of unknown (don't know how to run it) type.  The change right after the GetParameter call fixes that.

Major: When we hit a <script> of unknown type, we returned without pushing anything on the context stack.  Then we ended up popping "too much" (since we did pop when we closed the <script>).  So we put nodes into the wrong child lists, and ended up in the epilog state at the point when the root element was still open.  The change to push the prototype element on the stack if OpenScript succeeded but didn't put us in script mode fixes that.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Checked in, with a reftest.

Comment 7

[Martijn Wargers (dead)]

Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b2pre) Gecko/2007120405 Minefield/3.0b2pre
The contents of the first testcase show up fine now.