Re: [xslt] patch - xsltAttrListTemplateProcess

[Daniel Veillard <veillard redhat com>]

On Wed, Sep 29, 2004 at 04:54:41PM -0700, Mark Vakoc wrote:
> 
> Ok, this one is going to be a little hard to explain because I have been unable
> to come up with a simple test case.  xsltApplyOneTemplate was crashing (invalid
> pointer) around line 1837 ( xmlFreeDoc(tmp); ) where it is freeing up the
> tmpRVTs created in that template.
> 
> xmlFreeDoc was eventually dieing while freeing a xmlAttrPtr because the
> xmlAttrPtr->doc pointer was invalid on a .  It actually died in xmlDictOwns
> which accesses xmlAttrPtr->doc->dict which was invalid.
> 
> I traced the problem down th xsltAttrListTemplateProcess.  It creates an
> xmlAttrPtr by calling xsltAttrTemplateProcess.  The new xmlAttrPtr (q) has it's
> parent set to target but the doc set to ctxt->output, which may not be the same
> as the target->doc.  As an attribute's document and the attribute's parent
> element's document would always be the same the patch changes that.  The
> ctxt->output document must not still exist when the tmpRVTs are destroyed in
> this case.
> 
> Sorry I couldn't come up with a regression test case but it's a nasty
> stylesheet that causes this and any attempts to simplify eliminated the crash. 
> Hopefully a good eyeballing will be enough to confirm the patch.

  Yes I understand. I understand also that it may not be trivial at all to
reproduce on an independant test case. One debugging step which may be added
to libxml2 is a tree construct checking debugging, like a non-verbose version
of xmlDebugDumpxxx routines of debugXML.c but with just the PBM: checks and
output parts. Running those checks when doing debugging (for example when
freeing tree parts) might catch such problems. That should be investigated
that can probably be done relatively easilly, and may lead to interesting
results.
   I applied your patch and commited but unfortunately it came just after the
libxslt-1.1.11 release, so it's not included.

    thanks !

Daniel

-- 
Daniel Veillard      | Red Hat Desktop team http://redhat.com/
veillard redhat com  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/