Crash address 0xfffffffffffffff8 is kinda scary.

439 NS_IF_RELEASE(mTemplateRules[mTemplateRuleCount].mModeLocalName); mTemplateRuleCount is -1. The popTemplateRule call is coming from end()... but we never called pushTemplateRule, because we bailed out from init() like so: 169 NS_ENSURE_TRUE(document, NS_ERROR_FAILURE); and the caller in txMozillaXSLTProcessor::TransformToDoc didn't check the rv and pressed on.

Jonas, progress here?

Jonas?

I'll start looking at this today

Our error handling here is way busted. We even ignore errors generated from txExecutionState.init. This patch makes us honor that error, and skips the template rule cleanup when the transformation failed for any reason. Instead template rules are properly owned by an nsTArray which simplifies things a lot.

Comment on attachment 492934 [details] [diff] [review] Patch to fix >+ var docType = document.implementation.createDocumentType(undefined, '', ''); >+ var doc = document.implementation.createDocument('', '', null); >+ var xp = new XSLTProcessor; >+ xp.importStylesheet(doc); >+ xp.transformToDocument(docType); >+} >+catch (ex) {} >+ >+try { >+ var docType = document.implementation.createDocumentType(undefined, '', ''); >+ var doc = document.implementation.createDocument('', '', null); >+ var xp = new XSLTProcessor; Don't think you need the |var|s again here. > nsresult This should be void now, it only returns NS_OK. > txExecutionState::pushTemplateRule(txStylesheet::ImportFrame* aFrame,

Checked in http://hg.mozilla.org/mozilla-central/rev/7127fb5bc918

This crashes 3.6.x too

Blocking branch releases, please work up a back-ported patch if necessary

Comment on attachment 492934 [details] [diff] [review] Patch to fix >- TemplateRule* mTemplateRules; >- PRInt32 mTemplateRulesBufferSize; >- PRInt32 mTemplateRuleCount; >+ AutoInfallibleTArray<TemplateRule, 10> mTemplateRules; Neither branch has AutoInfallibleTArray. Did this compile in your tree?

No, that was the only change I had to make (which also meant returning OOM as needed)

forgot to refresh

Comment on attachment 505009 [details] [diff] [review] branch patch Approved for 1.9.2.14 and 1.9.1.17, a=dveditz

Checked in on branches: http://hg.mozilla.org/releases/mozilla-1.9.1/rev/4693aab773ec http://hg.mozilla.org/releases/mozilla-1.9.2/rev/fc69b66e9a32

Somehow missed part of the patch when moving it to the 1.9.1 branch. Followup landed (this is in the approved patch above): http://hg.mozilla.org/releases/mozilla-1.9.1/rev/7f3448d65808

Verified fixed for 1.9.2 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.14pre) Gecko/20110120 Namoroka/3.6.14pre. Verified crash in 1.9.2.13. Verified fixed for 1.9.1 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.17pre) Gecko/20110120 Shiretoko/3.5.17pre. Verified crash in 1.9.1.16.