XSLT crashes with multi-word internal entity delcarations. See attached test case. Crashes WebKit every time. This is also in radar: <rdar://problem/4271835> CRASH: Safari crashes when processing XSL containing ENTITY values
Created attachment 4516 [details] Patch containing reduced test case.
Crash is due to code using the IS_XSLT_ELEM macro on a node that's actually an entity declaration. Perhaps it's a bug that IS_XSLT_ELEM doesn't work properly in that case, but more likely there's some subtle rule about when you can use that macro. Apparently, many XML nodes don't have any of the fields in the xmlNode structure past the "common part", so it's strange that xmlNode includes these fields and strange that IS_XSLT_ELEM looks at the "ns" field without first checking the element type. Fix is presumably to check the element type before calling IS_XSLT_ELEM. Perhaps also libxslt should have that macro fixed so it works on any node.
Created attachment 5046 [details] add node type checks
Comment on attachment 5046 [details] add node type checks Looks good. r=me. (Thanks for fixing this, btw.)