578056 - Firefox 4.0b1 Crash [@ LocationStep::fromDescendants(txXPathNode const&, txIMatchContext*, txNodeSet*) ]

Status: RESOLVED WONTFIX

(Core :: XSLT, defect)

Description

[Carsten Book [:Tomcat]]

Windows only Crash http://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2010-07-12%2006%3A00%3A00&signature=LocationStep%3A%3AfromDescendants%28txXPathNode%20const%26%2C%20txIMatchContext*%2C%20txNodeSet*%29&version=Firefox%3A4.0b1

some crashes seems to be startup crashes, some not.

Comment 1

[chris hofmann]

top of the stack is new code in

http://hg.mozilla.org/mozilla-central/annotate/65c30e4ee631/content/xslt/src/xpath/txLocationStep.cpp#l247

Comment 2

[Boris Zbarsky [:bzbarsky]]

Jonas, Peter, any ideas?

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

The only thing I can think of is if a DOM tree is so deep that iterating it recursively runs out of stack space, but looking at the stacks that doesn't seem to be what is happening.

Other than that, I unfortunately have no idea. The only thing I can think of off the top of my head is if we've somehow ended up with a corrupted DOM somehow. We're not doing any hokey stuff during this iteration.

We should rewrite this code to use the new child iteration APIs, but that is unlikely to affect anything here.

Comment 4

[Peter Van der Beken [:peterv]]

(In reply to comment #1)
> top of the stack is new code in

New code? The line you point to is at least 3 years old.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.