Re: [xslt] BUG? (and abort)

[Justin Fletcher <justin fletcher ntlworld com>]

In message <01093020542804.00444@linuxdaheim>
          Bernhard Zwischenbrugger <bz@datenkueche.com> wrote:

> On Sunday 30 September 2001 18:20, you wrote:
> > In message <01093019400903.00444@linuxdaheim>
> >
> >           Bernhard Zwischenbrugger <bz@datenkueche.com> wrote:
> > > I think this is a bug in xsltproc
> >
> > [snip]
> >
> > > Version
> > > =======
> > >  xsltproc -V
> > > Using libxml 20400 and libxslt 10000
> > > xsltproc was compiled against libxml 20400 and libxslt 10000
> > > libxslt 10000 was compiled against libxml 20400
> >
> > Probably you should try the last released version - 2.4.0/1.0.0 is quite
> > old now and there have been many bugs fixed.
>
> Same result witch 1.0.4
>
> xsltproc -V
> Using libxml 20405, libxslt 10004 and libexslt 400
> xsltproc was compiled against libxml 20405, libxslt 10004 and libexslt 400
> libxslt 10004 was compiled against libxml 20405
> libexslt 400 was compiled against libxml 20405

So it does.

I'll admit this is out of my league, but I was looking into the problem
because it might increase my understanding of both xslt and the
implementation we're using.

I made a minor modification to your stylesheet because I wanted to see
whether using the exslt node-set provided a different answer. This yeilded
the same answer, which implies to me that it's either your understanding
or something that's shared between the two implementations at fault - I
can't say either way, because I don't know much about this...

BUT. In my playing with things, I tried adding a <xml:text>ONE</xml:text> to
the assignment of variable 'one' to see where it was popping up.

xsltproc aborted (Illegal address, equivilent to SIGSEGV) and produced the
following output and backtrace :

--8<--------
*xsltproc -verbose -debug test.xsl two.xml
Added namespace: xsl mapped to http://www.w3.org/1999/XSL/Transform
Added namespace: exslt mapped to http://exslt.org/common
xsltPrecomputeStylesheet: removing ignorable blank node
xsltParseStylesheetProcess : found stylesheet
Registering global variable one
Defining global variable one
Registering global variable two
Defining global variable two
template has 1 inherited namespaces
xsltCompilePattern : parsing '/'
xsltCompilePattern : parsed /, default priority 0.500000
added pattern : '/' priority 0.500000
template has 1 inherited namespaces
xsltParseStylesheetTemplate: mode two
xsltParseTemplateContent: removing text
xsltCompilePattern : parsing '*'
xsltCompilePattern : parsed *, default priority -0.500000
added pattern : '*' mode 'two' priority -0.500000
template has 1 inherited namespaces
xsltParseStylesheetTemplate: mode one
xsltCompilePattern : parsing '*'
xsltCompilePattern : parsed *, default priority -0.500000
added pattern : '*' mode 'one' priority -0.500000
parsed 3 templates
Initializing keys on two.xml
Registered 0 modules
Registering global variables
Registering global variables from test.xsl
Evaluating global variable two
Object is a Node Set :
Set contains 1 nodes:
1   /
Evaluating global variable one
xsltCopyOf: select .
xsltCopyOf: result is a node set
xsltApplyOneTemplate: copy node text
xsltApplyOneTemplate: copy text ONE
xsltCopyText: copy text ONE
Object is an XSLT value tree :
1  ELEMENT two
  ELEMENT xml:text
xsltProcessOneNode: applying template '/' for /
xsltApplyTemplates: select $two
Lookup variable two
found variable two
xsltApplyTemplates: list of 1 nodes
xsltProcessOneNode: no template found for /
xsltProcessOneNode: applying template '*' for two
xsltForEach: select //content
xsltForEach: select evaluates to 3 nodes
xsltApplyTemplates: node: content
xsltApplyTemplates: select exslt:node-set($one)
Lookup variable one

Illegal address (e.g. wildly outside array bounds)

Postmortem requested
  Arg3: 0x000b8040 753728 -> [0x006c6d78 0x3e694c3c 0x40000034 0x00000000]
  Arg2: 0x000b6770 747376 -> [0x00000000 0x00000001 0x000b6760 0x00000000]
  Arg1: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
2f058 in function xmlSearchNs
  Arg4: 0x00000001 1
  Arg3: 0x000b6af0 748272 -> [0x00000000 0x00000001 0x000b7b80 0x000b6a6c]
  Arg2: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg1: 0x000b7d4c 752972 -> [0x00000000 0x00000001 0x000b818c 0x000b7d10]
2dd98 in function xmlStaticCopyNode
  Arg3: 0x000b6af0 748272 -> [0x00000000 0x00000001 0x000b7b80 0x000b6a6c]
  Arg2: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg1: 0x000b7fe0 753632 -> [0x00000000 0x00000001 0x000b81cc 0x000b7fa4]
2df34 in function xmlStaticCopyNodeList
  Arg4: 0x00000001 1
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg1: 0x000b804c 753740 -> [0x00000000 0x00000001 0x000b821c 0x000b7fe0]
2de50 in function xmlStaticCopyNode
  Arg1: 0x000b828c 754316 -> [0x00000009 0x000b801c 0x00000001 0x00000000]
6aa80 in function xmlXPathObjectCopy
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x000b45ec 738796 -> [0x00656e6f 0x3e694c3c 0x4000000c 0x65646f6e]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
8d848 in function xsltXPathVariableLookup
  Arg2: 0x000b45ec 738796 -> [0x00656e6f 0x3e694c3c 0x4000000c 0x65646f6e]
  Arg1: 0x000b959c 759196 -> [0x000b9a34 0x000b992c 0x00000000 0x00000000]
6a23c in function xmlXPathVariableLookup
  Arg2: 0x000b1418 726040 -> [0x0000000d 0xffffffff 0xffffffff 0x00000000]
  Arg1: 0x000b7cac 752812 -> [0x00000000 0x00000000 0x00000000 0x000b959c]
7501c in function xmlXPathCompOpEval
  Arg2: 0x000b1440 726080 -> [0x00000012 0x00000000 0xffffffff 0x00000000]
  Arg1: 0x000b7cac 752812 -> [0x00000000 0x00000000 0x00000000 0x000b959c]
758dc in function xmlXPathCompOpEval
  Arg2: 0x000b1468 726120 -> [0x0000000f 0xffffffff 0x00000001 0x00000000]
  Arg1: 0x000b7cac 752812 -> [0x00000000 0x00000000 0x00000000 0x000b959c]
75288 in function xmlXPathCompOpEval
  Arg2: 0x000b1490 726160 -> [0x0000000e 0x00000002 0xffffffff 0x00000001]
  Arg1: 0x000b7cac 752812 -> [0x00000000 0x00000000 0x00000000 0x000b959c]
750c4 in function xmlXPathCompOpEval
  Arg2: 0x000b14b8 726200 -> [0x00000012 0x00000003 0xffffffff 0x00000000]
  Arg1: 0x000b7cac 752812 -> [0x00000000 0x00000000 0x00000000 0x000b959c]
758dc in function xmlXPathCompOpEval
  Arg2: 0x000b959c 759196 -> [0x000b9a34 0x000b992c 0x00000000 0x00000000]
  Arg1: 0x000b416c 737644 -> [0x00000005 0x0000000a 0x000b1418 0x00000004]
75f3c in function xmlXPathCompiledEval
  Arg4: 0x000b15b0 726448 -> [0x000b17fc 0x0000000d 0x00081a80 0x000b4010]
  Arg3: 0x000b4010 737296 -> [0x000b15b0 0x00000001 0x000b3ff8 0x00000000]
  Arg2: 0x000b992c 760108 -> [0x00000000 0x00000001 0x000b991c 0x000b98e0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
81c60 in function xsltApplyTemplates
  Arg5: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg4: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg3: 0x000b4010 737296 -> [0x000b15b0 0x00000001 0x000b3ff8 0x00000000]
  Arg2: 0x000b992c 760108 -> [0x00000000 0x00000001 0x000b991c 0x000b98e0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7f00c in function xsltApplyOneTemplate
  Arg4: 0x000b17fc 727036 -> [0x000b3080 0x00000010 0x00082a24 0x000b4260]
  Arg3: 0x000b4260 737888 -> [0x000b17fc 0x00000001 0x000b424c 0x000b4010]
  Arg2: 0x000b99d0 760272 -> [0x00000000 0x00000001 0x000b99c4 0x000b9988]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
82e7c in function xsltForEach
  Arg5: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg4: 0x000b3af0 735984 -> [0x000b2ea8 0x000b3cac 0x000b6d40 0xcb3c61bd]
  Arg3: 0x000b4260 737888 -> [0x000b17fc 0x00000001 0x000b424c 0x000b4010]
  Arg2: 0x000b99d0 760272 -> [0x00000000 0x00000001 0x000b99c4 0x000b9988]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7f00c in function xsltApplyOneTemplate
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x000b99d0 760272 -> [0x00000000 0x00000001 0x000b99c4 0x000b9988]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7eca0 in function xsltProcessOneNode
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7e614 in function xsltDefaultProcessOneNode
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7eb3c in function xsltProcessOneNode
  Arg4: 0x000b3080 733312 -> [0x000b32b8 0x0000000d 0x00081a80 0x000b48bc]
  Arg3: 0x000b48bc 739516 -> [0x000b3080 0x00000001 0x000b58d0 0x00000000]
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
82200 in function xsltApplyTemplates
  Arg5: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg4: 0x000b2ea8 732840 -> [0x00000000 0x000b3cac 0x000b473c 0xcb3c61bd]
  Arg3: 0x000b48bc 739516 -> [0x000b3080 0x00000001 0x000b58d0 0x00000000]
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7f00c in function xsltApplyOneTemplate
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b9624 759332 -> [0x000b3cac 0x00000000 0x000b3af0 0x00000002]
7eca0 in function xsltProcessOneNode
  Arg5: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg4: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg3: 0x000a125c 660060 -> [0x00000000 0x00000000 0x00000000 0x00000000]
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b3cac 736428 -> [0x00000000 0x00000000 0x00000000 0x00000000]
832dc in function xsltApplyStylesheetInternal
  Arg3: 0x000a125c 660060 -> [0x00000000 0x00000000 0x00000000 0x00000000]
  Arg2: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
  Arg1: 0x000b3cac 736428 -> [0x00000000 0x00000000 0x00000000 0x00000000]
8355c in function xsltApplyStylesheet
  Arg3: 0x000adc72 711794
  Arg2: 0x000b3cac 736428 -> [0x00000000 0x00000000 0x00000000 0x00000000]
  Arg1: 0x000b9a34 760372 -> [0x00000000 0x00000009 0x00000000 0x000b99d0]
843c in function xsltProcess
  Arg2: 0x000adc30 711728 -> [0x000adc50 0x000adc59 0x000adc62 0x000adc69]
  Arg1: 0x00000005 5
983c in function main
3aa5170 in unknown procedure
9a4c in anonymous function
*
--8<--------

I don't know enough to investigate this problem much further without spending
quite a bit of time on it. However, the /very/ brief look I have had implies
that (from the arguments passed to xmlSearchNs), doc is set to 0. Following
back, it was 0 on entry to xmlStaticCopyNode, xmlStaticCopyNodeList and the
xmlStaticCopyNode that called it.

Well, I've done a little more looking at this and...

xmlSearchNs does the following :

    if ((nameSpace != NULL) &&
	(xmlStrEqual(nameSpace, (const xmlChar *)"xml"))) {
	if (doc->oldNs == NULL) {
	    /*
	     * Allocate a new Namespace and fill the fields.
	     */
	    doc->oldNs = (xmlNsPtr) xmlMalloc(sizeof(xmlNs));

nameSpace /is/ xml, but doc is NULL, so this dereference is probably doing
bad things. More specifically, the assignment /will/ abort, even if the
access didn't under RISC OS.

This xmlSearchNs is accessed from in xmlStaticCopyNode as :

    if (node->ns != NULL) {
        xmlNsPtr ns;

	ns = xmlSearchNs(doc, ret, node->ns->prefix);

At this point node->ns will be a valid pointer (inferred because
node->ns->prefix gives us the 'xml' string), so the path will run to the
xmlSearchNs and abort if doc = NULL.

So there's the 'how' it aborts.

Following back, xmlXPathObjectCopy invokes xmlCopyNode which doesn't appear
in our backtrace because it is a tail-optimised function which merely calls
xmlStaticCopyNode with a couple of parameters set to NULL. One of these
is the document pointer.

So there's the source of our NULL.

As for what to do about it; I leave that to those who are far more
knowledgable than I. It's possible that that section of xslt is just
nonsense, but it probably shouldn't cause an abort.

The files that generated this output are attached.

-- 
Gerph {djf0-.3w6e2w2.226,6q6w2q2,2.3,2m4}
URL: http://www.movspclr.co.uk/
... Eyes to the heavens, screaming at the sky;
    Trying to send you messages, but choking on goodbye.
<?xml version="1.0"?>
<eins>
<content>content of one</content>
</eins>

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                              
xmlns:exslt="http://exslt.org/common">
 
<xsl:output method="xml" indent="yes" encoding="ISO-8859-1"/>
<xsl:variable name="one">
<xsl:copy-of select="."/>
<xml:text>ONE</xml:text>
</xsl:variable>
<xsl:variable name="two" select="document('two.xml')"/>
 
<xsl:template match="/">
        <xsl:apply-templates select="$two" mode="two"/>
</xsl:template>
 
<xsl:template match="*" mode="two">
        <xsl:for-each select="//content">
                <xsl:apply-templates select="exslt:node-set($one)" 
mode="one"/>
                <xsl:text>-----------------</xsl:text>
        </xsl:for-each>
</xsl:template>
 
<xsl:template match="*" mode="one">
        <xsl:for-each select="//content">   
<!-- here is the problem (.//content works well, but I need the key 
function)-->
                <xsl:copy-of select="."/>
        </xsl:for-each>
</xsl:template>
 
</xsl:stylesheet>
<?xml version="1.0"?>
<two>
<content>content of two1</content>
<content>content of two2</content>
<content>content of two3</content>
</two>