602115 - Crash [@ txExecutionState::popTemplateRule]

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jesse Ruderman]

Crash address 0xfffffffffffffff8 is kinda scary.

Comment 3

[Boris Zbarsky [:bzbarsky]]

439         NS_IF_RELEASE(mTemplateRules[mTemplateRuleCount].mModeLocalName);

mTemplateRuleCount is -1.

The popTemplateRule call is coming from end()... but we never called pushTemplateRule, because we bailed out from init() like so:

169     NS_ENSURE_TRUE(document, NS_ERROR_FAILURE);

and the caller in txMozillaXSLTProcessor::TransformToDoc didn't check the rv and pressed on.

Comment 4

[Damon Sicore (:damons)]

Jonas, progress here?

Comment 5

[Johnny Stenback (:jst)]

Jonas?

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I'll start looking at this today

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: Patch to fix

Our error handling here is way busted. We even ignore errors generated from txExecutionState.init.

This patch makes us honor that error, and skips the template rule cleanup when the transformation failed for any reason. Instead template rules are properly owned by an nsTArray which simplifies things a lot.

Comment 8

[Peter Van der Beken [:peterv]]

Comment on attachment 492934 [details] [diff] [review]
Patch to fix

>+  var docType = document.implementation.createDocumentType(undefined, '', '');
>+  var doc = document.implementation.createDocument('', '', null);
>+  var xp = new XSLTProcessor;
>+  xp.importStylesheet(doc);
>+  xp.transformToDocument(docType);
>+}
>+catch (ex) {}
>+
>+try {
>+  var docType = document.implementation.createDocumentType(undefined, '', '');
>+  var doc = document.implementation.createDocument('', '', null);
>+  var xp = new XSLTProcessor;

Don't think you need the |var|s again here.

> nsresult

This should be void now, it only returns NS_OK.

> txExecutionState::pushTemplateRule(txStylesheet::ImportFrame* aFrame,

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Checked in http://hg.mozilla.org/mozilla-central/rev/7127fb5bc918

Comment 10

[Daniel Veditz [:dveditz]]

This crashes 3.6.x too

Comment 11

[Daniel Veditz [:dveditz]]

Blocking branch releases, please work up a back-ported patch if necessary

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 492934 [details] [diff] [review]
Patch to fix

>-    TemplateRule* mTemplateRules;
>-    PRInt32 mTemplateRulesBufferSize;
>-    PRInt32 mTemplateRuleCount;
>+    AutoInfallibleTArray<TemplateRule, 10> mTemplateRules;

Neither branch has AutoInfallibleTArray. Did this compile in your tree?

Comment 13

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

No, that was the only change I had to make (which also meant returning OOM as needed)

Comment 14

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: branch patch

Comment 15

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Attachment: branch patch

forgot to refresh

Comment 16

[Daniel Veditz [:dveditz]]

Comment on attachment 505009 [details] [diff] [review]
branch patch

Approved for 1.9.2.14 and 1.9.1.17, a=dveditz

Comment 17

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Checked in on branches:

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/4693aab773ec
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fc69b66e9a32

Comment 18

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Somehow missed part of the patch when moving it to the 1.9.1 branch. Followup landed (this is in the approved patch above):

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/7f3448d65808

Comment 19

[Al Billings [:abillings - ex-MoCo]]

Verified fixed for 1.9.2 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.14pre) Gecko/20110120 Namoroka/3.6.14pre. Verified crash in 1.9.2.13.

Verified fixed for 1.9.1 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.17pre) Gecko/20110120 Shiretoko/3.5.17pre. Verified crash in 1.9.1.16.

Comment 20

[Martin Stránský [:stransky] (ni? me)]

Attachment: 1.8 version