Bug 54462 – XSLT with output method HTML and images crashes in debug mode

• Component: XML
• Status: RESOLVED FIXED

[Vsevolod Vlasov]

If 

1) XML file links to XSLT
2) XSLT has output method set to html
3) Resulting HTML has images

then

Webkit crashes on assertion in debug mode (DocumentParser:56).

ASSERTION FAILED: m_state == ParsingState
.../webkit/Source/WebCore/dom/DocumentParser.cpp(56) : virtual void WebCore::DocumentParser::prepareToStopParsing()
 -> WebCore::DocumentParser::prepareToStopParsing()
 -> WebCore::HTMLDocumentParser::prepareToStopParsing()
 -> WebCore::HTMLDocumentParser::attemptToEnd()
 -> WebCore::HTMLDocumentParser::finish()
 -> WebCore::Document::finishParsing()
 -> WebCore::DocumentWriter::endIfNotLoadingMainResource()
 -> WebCore::Document::explicitClose()
 -> WebCore::Document::setContent(WTF::String const&)
 -> WebCore::XSLTProcessor::createDocumentFromSource(WTF::String const&, WTF::String const&, WTF::String const&, WebCore::Node*, WebCore::Frame*)
 -> WebCore::Document::applyXSLTransform(WebCore::ProcessingInstruction*)
 -> WebCore::Document::recalcStyleSelector()
 -> WebCore::Document::styleSelectorChanged(WebCore::StyleSelectorUpdateFlag)
 -> WebCore::Document::removePendingSheet()
 -> WebCore::ProcessingInstruction::sheetLoaded()
 -> WebCore::XSLStyleSheet::checkLoaded()
 -> WebCore::ProcessingInstruction::parseStyleSheet(WTF::String const&)
 -> WebCore::ProcessingInstruction::setXSLStyleSheet(WTF::String const&, WebCore::KURL const&, WTF::String const&)
 -> WebCore::CachedXSLStyleSheet::checkNotify()
 -> WebCore::CachedXSLStyleSheet::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool)
 -> WebCore::CachedResourceRequest::didFinishLoading(WebCore::SubresourceLoader*)
 -> WebCore::SubresourceLoader::didFinishLoading(double)
 -> WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double)
 -> -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
 -> _NSURLConnectionDidFinishLoading
 -> URLConnectionClient::_clientDidFinishLoading(URLConnectionClient::ClientConnectionEventQueue*)
 -> URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long)
 -> URLConnectionClient::processEvents()
 -> MultiplexerSource::perform()
 -> __CFRunLoopDoSources0
 -> __CFRunLoopRun
 -> CFRunLoopRunSpecific

[Vsevolod Vlasov]

Created attachment 82458 [details]
Failing XML example

[Vsevolod Vlasov]

Created attachment 82459 [details]
Failing XSL example

[Vsevolod Vlasov]

see https://bugs.webkit.org/show_bug.cgi?id=50253

[Pavel Feldman]

*** This bug has been marked as a duplicate of bug 50253 ***

[Adam Barth]

This is not a duplicate of Bug 50253.  Testing a patch now.

[Adam Barth]

This is a regression caused by http://trac.webkit.org/changeset/75577

[Adam Barth]

Created attachment 82548 [details]
Patch

[Darin Adler]

Comment on attachment 82548 [details]
Patch

Is this single test case enough coverage?

[Adam Barth]

> Is this single test case enough coverage?

We more or less would like test coverage for each code path touched in http://trac.webkit.org/changeset/75577.

1) DOMParser::parseFromString <-- We have tests for this one.
2) WebCore/xml/XMLHttpRequest.cpp <-- We have lots of test for this one.  :)
3) WebCore/xml/XSLTProcessor.cpp <-- Added in this patch.
4) CachedFont.cpp <-- This is for SVG fonts.  I don't know whether this is covered.

[Adam Barth]

Committed r78644: <http://trac.webkit.org/changeset/78644>

[Eric Seidel (no email)]

Comment on attachment 82548 [details]
Patch

LGTM too thanks.

[Adam Barth]

*** Bug 52929 has been marked as a duplicate of this bug. ***