Bug 10429 - XSLTProcessor.transformToFragment crashes if the owner document is empty
Summary: XSLTProcessor.transformToFragment crashes if the owner document is empty
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: XML (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Alexey Proskuryakov
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-08-16 03:03 PDT by Alexey Proskuryakov
Modified: 2006-08-21 09:48 PDT (History)
0 users

See Also:

Attachments
test case (3.14 KB, application/zip)
2006-08-16 03:04 PDT, Alexey Proskuryakov 		no flags Details
proposed fix (5.13 KB, patch)
2006-08-17 11:35 PDT, Alexey Proskuryakov 		eric: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2006-08-16 03:03:59 PDT 
XSLTProcessor.transformToFragment crashes if the owner document is empty.

var ownerDocument = document.implementation.createDocument("", null, null);
processor.transformToFragment(xml, ownerDocument);

Stack trace:

0    WebCore::XMLTokenizer::XMLTokenizer[in-charge](WebCore::DocumentFragment*, WebCore::Element*) + 540
1    WebCore::parseXMLDocumentFragment(WebCore::String const&, WebCore::DocumentFragment*, WebCore::Element*) + 48
2    WebCore::XSLTProcessor::transformToFragment(WebCore::Node*, WebCore::Document*) + 560
3    KJS::XSLTProcessorProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 728
Comment 1 Alexey Proskuryakov 2006-08-16 03:04:22 PDT 
Created attachment 10050 [details]
test case
Comment 2 Alexey Proskuryakov 2006-08-17 11:35:40 PDT 
Created attachment 10097 [details]
proposed fix
Comment 3 Eric Seidel (no email) 2006-08-18 02:29:59 PDT 
Comment on attachment 10097 [details]
proposed fix

Looks great! r=me
Comment 4 Alexey Proskuryakov 2006-08-21 09:48:33 PDT 
Committed revision 15951.