695969 - "ASSERTION: Don't pass invalid prefixes to nsDocument::CreateElem, check caller"

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Jesse Ruderman]

Attachment: testcase

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Boris Zbarsky [:bzbarsky]]

So the key part seems to be that we make the CheckQName call in nsDocument::CreateElement and pass it aTagName, which contains the single char U+10BD GEORGIAN CAPITAL LETTER CHAR.

Then we lowercase the string and call CreateElem with the result.  After lowercasing, the string contains a single U+2D1D GEORGIAN SMALL LETTER CHAR.

This is passed to MOZ_XMLCheckQName which operates on _bytes_.  It examines the first byte, which is decides is of type NONASCII (which it is!) and then nmstart is true but IS_NMSTRT_CHAR_MINBPC is false so it errors out.

Peter, are some of expat's tables off here?

Comment 3

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.