620289 - crash [@ txXSLTNumber::createNumber] if !counterIter.hasNext()

Status: VERIFIED INVALID

(Core :: XSLT, defect)

Description

[timeless]

48 nsresult txXSLTNumber::createNumber(Expr* aValueExpr, txPattern* aCountPattern,

84     txFormattedCounter* counter = 0;
85     while ((value = NS_PTR_TO_INT32(valueIter.previous()))) {
86         if (counterIter.hasNext()) {
87             counter = (txFormattedCounter*)counterIter.next();
88         }
89 
90         if (!first) {
91             aResult.Append(counter->mSeparator);
92         }
93 
94         counter->appendNumber(value, aResult);
95         first = MB_FALSE;
96     }

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

That would only happens if there are no counters, no? In which case we should have bailed earlier.

Please reopen if I'm reading the code wrong.