88472 - xml-stylesheet directive (in XUL) with bogus href causes crash

Status: RESOLVED DUPLICATE of bug 75633

(Core :: XUL, defect)

Description

[druidsquirrel]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2) Gecko/20010628
BuildID:    2001062823

The browser crashes when attempting to load any XUL file that contains an
xml-stylesheet directive pointing to a sufficiently long, nonexistent path. For
example:
<?xml-stylesheet href="chrome://foo/bar/baz.css"/>
Note that two levels of directory nesting are needed to cause the crash, i.e.
removing the substring "/bar" from the above example will prevent the crash and,
I believe, reduce to bug 82022.

Reproducible: Always
Steps to Reproduce:
1. Create a XUL file that begins with the following two lines:
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://foo/bar/baz.css"?>
2. Make sure there is no such directory as foo in your chrome. If there is, pick
a new name.
3. Attempt to load the page.
4. Browser crashes

Actual Results:  Browser crashes when you try to load the page.

Expected Results:  Browser definitely should not crash, and should probably
simply ignore the unknown css file.

Here's an entire XUL file that always crashes my browser when I load it:

<?xml version="1.0"?>
<?xml-stylesheet href="chrome://foo/bar/baz.css"?>
<window/>

The above can be un-simplified by adding back namespace directives,  other
stylesheets, nested elements, or anything else, but none of that seems to matter.

Comment 1

[doctor__j]

I can reproduce the crash on Win32 build 2001062806.

Comment 2

[Mike Pinkerton (not reading bugmail)]

--> hyatt for 1.0

Comment 3

[John Morrison]

Largely the same bug as bug 75633, with the same crash stack (modulo the more
current line numbers). 

I'm gonna dupe this one, but note on the other bug the testcase that you 
laid out here. Thanks!

0x031e4370 
nsProxyObjectManager::GetProxyForObject 
[d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyObjectManager.cpp, line 
202] 
nsStreamLoader::Init 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamLoader.cpp, line 59] 
NS_NewStreamLoader [..\..\..\dist\include\nsNetUtil.h, line 380] 
CSSLoaderImpl::LoadSheet 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 1221] 
CSSLoaderImpl::LoadStyleLink 
[d:\builds\seamonkey\mozilla\content\html\style\src\nsCSSLoader.cpp, line 1399] 
XULContentSinkImpl::ProcessStyleLink 
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULContentSink.cpp, 
line 869] 
XULContentSinkImpl::AddProcessingInstruction 
[d:\builds\seamonkey\mozilla\content\xul\document\src\nsXULContentSink.cpp, 
line 943] 
CWellFormedDTD::HandleProcessingInstructionToken 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 607] 
CWellFormedDTD::HandleToken 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 523] 
CWellFormedDTD::BuildModel 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsWellFormedDTD.cpp, line 262] 
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 2186] 
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 2055] 
nsParser::OnDataAvailable 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 2521] 
nsDocumentOpenInfo::OnDataAvailable 
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 238] 
nsFileChannel::OnDataAvailable 
[d:\builds\seamonkey\mozilla\netwerk\protocol\file\src\nsFileChannel.cpp, line 
503] 
nsOnDataAvailableEvent::HandleEvent 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerProxy.cpp, line 
185] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1072] 
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 419] 
netscp6.exe + 0x16ca (0x004016ca) 
netscp6.exe + 0x11b8 (0x004011b8) 
netscp6.exe + 0x2eb9 (0x00402eb9) 
KERNEL32.DLL + 0x7903 (0x77e87903) 

*** This bug has been marked as a duplicate of 75633 ***