This seems to show up in the top crashes now: http://crash-stats.mozilla.com/report/list?query_search=signature&query_type=contains&signature=nsXPathResult%3A%3AGetStringValue(nsAString_internal%26)&query=nsXPathResult%3A%3AGetStringValue Turns out my alternate approach for bug 402208 (attachment 287113 [details] [diff] [review]) was better. I had a feeling something was wrong, but didn't think much of it. I'll attach a bandaid that fixes the crashes, since people felt attachment 287113 [details] [diff] [review] was too risky for beta.

Turns out attachment 287113 [details] [diff] [review] didn't regress like this :-/, but probably safer to go with this for beta 1.

Comment on attachment 287306 [details] [diff] [review] Bandaid v1 I just went ahead and landed this regression fix to get it in for the upcoming nightlies, but Jonas, please review after the fact here. I'll leave this bug open while waiting for the pending after the fact review.

I had experienced this bug with : Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007110405 Minefield/3.0a9pre (crash-report 19ec979c-8b1b-11dc-9159-001a4bd43ed6) but today, it's gone with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a9pre) Gecko/2007110505 Minefield/3.0a9pre so for me, it seems fixed.

Hmm.. I realized that we probably need to change GetExprResult too, no? I think we should probably simply nuke mResult since it's not going to be safe, or right, once the user starts mutating the DOM.

(In reply to comment #5) > Hmm.. I realized that we probably need to change GetExprResult too, no? Don't think so, it just returns mResult if it has one. SetExprResult sets mResult if it gets a non-nodeset result or an empty nodeset passed in. There's no problem returning those from GetExprResult. If SetExprResult was never called then mResult will be null and mResultNodes will be empty, and GetExprResult will return NS_ERROR_DOM_INVALID_STATE_ERR. If we pass in a non-empty nodeset to SetExprResult then mResult will be set to null and mResultNodes will be filled with the nodes. GetExprResult will then create a txNodeSet with the nodes from mResultNodes. See http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/content/xslt/src/xpath/nsXPathResult.cpp&rev=1.41&mark=394-398,400-402,419-421#387

verified fixed using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9a9pre) Gecko/2007110605 Minefield/3.0a9pre and Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9a9pre) Gecko/2007110604 Minefield/3.0a9pre. I verified using the testcase in the bug.