Re: [xslt] Segmentation fault with an infinite loop

[Mike Hommey <mh glandium org>]

William M. Brack wrote:
> John Fleck said:
>
> > On Mon, 2004-07-05 at 08:13, Mike Hommey wrote:
> >
> > > Hi
> > >
> > > I triggered a segmentation fault with an infinite loop.
> > > Just use attached files with the following command line:
> > > $ xsltproc html.xsl menu.xml
> > >
> > > Mike
> > >
> > > ______________________________________________________________________
> >
> > I can't duplicate this with the most recent version (well, it was
> > the
> > version that was most recent when you sent the email, anyway - tough
> > to
> > keep up with Daniel :-)
> >
> > [jfleck localhost hommey]$ xsltproc --version
> > Using libxml 20610, libxslt 10107 and libexslt 805
> > xsltproc was compiled against libxml 20610, libxslt 10107 and
> > libexslt
> > 805
> > libxslt 10107 was compiled against libxml 20610
> > libexslt 805 was compiled against libxml 20610
> >
> > Can you provide details about your environment?
> >
> > Cheers,
> > John
>
>
> Assuming your attached file toto.xml really should have been
> menu.xml, with the "Very Latest" software under Linux (compiled with
> debug features) I get:

Woops, yes rename toto.xml to menu.xml before launching all.

I still have the crash with latest versions :

mh vaio:/tmp$ xsltproc --version
Using libxml 20611, libxslt 10108 and libexslt 806
xsltproc was compiled against libxml 20611, libxslt 10108 and libexslt 806
libxslt 10108 was compiled against libxml 20611
libexslt 806 was compiled against libxml 20611
mh vaio:/tmp$ xsltproc html.xsl menu.xml
Segmentation fault

But interestingly, it works through valgrind:

mh vaio:/tmp$ valgrind xsltproc html.xsl menu.xml
==7087== Memcheck, a memory error detector for x86-linux.
==7087== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward.
==7087== Using valgrind-2.1.1, a program supervision framework for 
x86-linux.
==7087== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward.
==7087== For more details, rerun with: -v
==7087==
runtime error: file html.xsl line 7 element variable
xsltApplyOneTemplate: loop found ???
try increasing xsltMaxDepth (--maxdepth)
Templates:
#0 name menu
#1 name menu
#2 name menu
#3 name menu
#4 name menu
#5 name menu
#6 name menu
#7 name menu
#8 name menu
#9 name menu
#10 name menu
#11 name menu
#12 name menu
#13 name menu
#14 name menu
Variables:
#0
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#1
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#2
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#3
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#4
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#5
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#6
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#7
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#8
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#9
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#10
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#11
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#12
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#13
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

#14
var test   Object is a Node Set :
Set contains 1 nodes:
  1     /

no result for menu.xml
==7087==
==7087== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 31 from 1)
==7087== malloc/free: in use at exit: 216 bytes in 2 blocks.
==7087== malloc/free: 145592 allocs, 145590 frees, 4270388 bytes allocated.
==7087== For a detailed leak analysis,  rerun with: --leak-check=yes
==7087== For counts of detected errors, rerun with: -v

And with gdb:
mh vaio:/tmp$ gdb xsltproc
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...(no debugging symbols 
found)...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) run html.xsl menu.xml
Starting program: /usr/bin/xsltproc html.xsl menu.xml
(no debugging symbols found)...(no debugging symbols found)...(no 
debugging symbols found)...(no debugging symbols found)...(no debugging 
symbols found)...(no debugging symbols found)...(no debugging symbols 
found)...[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 11439)]
(no debugging symbols found)...(no debugging symbols found)...(no 
debugging symbols found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 11439)]
0x40129e7a in xmlXPathIsNodeType () from /usr/lib/libxml2.so.2
(gdb) bt full
#0  0x40129e7a in xmlXPathIsNodeType () from /usr/lib/libxml2.so.2
No symbol table info available.
#1  0x4012a8bb in xmlXPathIsNodeType () from /usr/lib/libxml2.so.2
No symbol table info available.
#2  0x4012b173 in xmlXPathIsNodeType () from /usr/lib/libxml2.so.2
No symbol table info available.
#3  0x4012b618 in xmlXPathIsNodeType () from /usr/lib/libxml2.so.2
No symbol table info available.
#4  0x4012b9af in xmlXPathCompiledEval () from /usr/lib/libxml2.so.2
No symbol table info available.
#5  0x400898a3 in xsltAddStackElemList () from /usr/lib/libxslt.so.1
No symbol table info available.
#6  0x4008a7ea in xsltQuoteOneUserParam () from /usr/lib/libxslt.so.1
No symbol table info available.
#7  0x4008a923 in xsltQuoteOneUserParam () from /usr/lib/libxslt.so.1
No symbol table info available.
#8  0x4008af99 in xsltParseStylesheetVariable () from /usr/lib/libxslt.so.1
No symbol table info available.
#9  0x4009a2d9 in xsltApplyOneTemplate () from /usr/lib/libxslt.so.1
No symbol table info available.
#10 0x40099761 in xsltProcessOneNode () from /usr/lib/libxslt.so.1
No symbol table info available.
#11 0x40099350 in xsltCopyTree () from /usr/lib/libxslt.so.1

I'll recompile libxml2/libxslt with debugging symbols and will get back 
with more info.

Mike