Bug 5538 – XSLT crashes with multi-word internal entity declarations

• Component: XML
• Status: RESOLVED FIXED

[Eric Seidel (no email)]

XSLT crashes with multi-word internal entity delcarations.

See attached test case.  Crashes WebKit every time.

This is also in radar:
<rdar://problem/4271835> CRASH: Safari crashes when processing XSL containing ENTITY values

[Eric Seidel (no email)]

Created attachment 4516 [details]
Patch containing reduced test case.

[Darin Adler]

Crash is due to code using the IS_XSLT_ELEM macro on a node that's actually an entity declaration.

Perhaps it's a bug that IS_XSLT_ELEM doesn't work properly in that case, but more likely there's some 
subtle rule about when you can use that macro. Apparently, many XML nodes don't have any of the fields 
in the xmlNode structure past the "common part", so it's strange that xmlNode includes these fields and 
strange that IS_XSLT_ELEM looks at the "ns" field without first checking the element type.

Fix is presumably to check the element type before calling IS_XSLT_ELEM. Perhaps also libxslt should have 
that macro fixed so it works on any node.

[Darin Adler]

Created attachment 5046 [details]
add node type checks

[Eric Seidel (no email)]

Comment on attachment 5046 [details]
add node type checks

Looks good.  r=me.  (Thanks for fixing this, btw.)