Bug 10429

Summary: XSLTProcessor.transformToFragment crashes if the owner document is empty
Product: WebKit Reporter: Alexey Proskuryakov <ap>
Component: XMLAssignee: Alexey Proskuryakov <ap>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P1    
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
Attachments:
Description Flags
test case
none
proposed fix eric: review+

Alexey Proskuryakov
Reported 2006-08-16 03:03:59 PDT
XSLTProcessor.transformToFragment crashes if the owner document is empty. var ownerDocument = document.implementation.createDocument("", null, null); processor.transformToFragment(xml, ownerDocument); Stack trace: 0 WebCore::XMLTokenizer::XMLTokenizer[in-charge](WebCore::DocumentFragment*, WebCore::Element*) + 540 1 WebCore::parseXMLDocumentFragment(WebCore::String const&, WebCore::DocumentFragment*, WebCore::Element*) + 48 2 WebCore::XSLTProcessor::transformToFragment(WebCore::Node*, WebCore::Document*) + 560 3 KJS::XSLTProcessorProtoFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 728
Attachments
test case (3.14 KB, application/zip)
2006-08-16 03:04 PDT, Alexey Proskuryakov 		no flags
Details
proposed fix (5.13 KB, patch)
2006-08-17 11:35 PDT, Alexey Proskuryakov 		eric: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2006-08-16 03:04:22 PDT
Created attachment 10050 [details] test case
Alexey Proskuryakov
Comment 2 2006-08-17 11:35:40 PDT
Created attachment 10097 [details] proposed fix
Eric Seidel (no email)
Comment 3 2006-08-18 02:29:59 PDT
Comment on attachment 10097 [details] proposed fix Looks great! r=me
Alexey Proskuryakov
Comment 4 2006-08-21 09:48:33 PDT
Committed revision 15951.
Note You need to log in before you can comment on or make changes to this bug.