If an instance fails to load we just keep on trucking. That's wrong. The spec. says: "If the link traversal fails, it is treated as an exception (4.5.2 The xforms-link-exception Event)." [http://www.w3.org/TR/2006/REC-xforms-20060314/slice3.html#structure-model-instance] So, xforms-link-exception and handleFatalError().

This stops processing. I've seen some crashes on trunk, if we do not do this because of some assumptions in other code I think. It still needs to dispatch the events here.

Comment on attachment 216741 [details] [diff] [review] Patch I'm blind. It does dispatch the event.

Why do you need to move --mPendingInstanceCount ? If there is an error, doesn't that mean that mPendingInstanceCount will have a wrong value?

(In reply to comment #4) > Why do you need to move --mPendingInstanceCount ? > If there is an error, doesn't that mean that mPendingInstanceCount will have a > wrong value? Yes, and we will not finish model construction, which is what we need to do, because it is a fatal error.

Comment on attachment 216741 [details] [diff] [review] Patch Ok. Makes sense in this case, I think.

Comment on attachment 216741 [details] [diff] [review] Patch Well, I'd like to discuss this scenario: What if the author decided to handle xforms-link-exceptions and start changing the instance's @src looking for a server that can serve the instance data. Perhaps they work in an environment where they have some flakey servers that go up and down a lot, for example. Do we want to support this scenario? Where if the author does find a good one that the instance will load and the processor will finish its normal load processing? Or once we have a fatal exception, is that it (uncorrectable by script)?

(In reply to comment #7) > (From update of attachment 216741 [details] [diff] [review] [edit]) > Well, I'd like to discuss this scenario: What if the author decided to handle > xforms-link-exceptions and start changing the instance's @src looking for a > server that can serve the instance data. Perhaps they work in an environment > where they have some flakey servers that go up and down a lot, for example. Do > we want to support this scenario? Where if the author does find a good one > that the instance will load and the processor will finish its normal load > processing? Or once we have a fatal exception, is that it (uncorrectable by > script)? That's how I've always interpreted fatal errors: End of story, the processor gives up.

Comment on attachment 216741 [details] [diff] [review] Patch ok, I'm fine with that. nit: maybe add a comment above mPendingInstanceCount pointing out that in an error we are leaving mPendingInstanceCount > 0 on purpose and why we are doing that (to halt load processing). Just so that one of us yahoos doesn't try to change it sometime in the future. with that r=me

Fixed on trunk