[xml/sgml-pkgs] Bug#398327: libxslt1.1: 1.1.18-1 sometimes segfaults, sometimes pegs CPU

Mon Nov 13 06:55:11 UTC 2006

Package: libxslt1.1
Version: 1.1.18-1
Severity: important

When building libxcb, xsltproc 1.1.18-1 segfaults on some of our XML
sources and hangs chewing 100% of the CPU on other sources. I believe
1.1.17-5 was fine. I've heard reports that non-Debian folks building our
code recently starting having this problem too.

The stylesheet we're using is here:
http://gitweb.freedesktop.org/?p=xcb/libxcb.git;a=blob_plain;f=src/c-client.xsl
And the XML documents we're transforming can be found here:
http://xcb.freedesktop.org/dist/xcb-proto-0.9.93.tar.bz2
All of our XML triggers either a hang or a segfault.

You can run the transformation with arguments like these, if you're in
the src directory of the above tarball:

xsltproc --stringparam mode header --stringparam base-path ./ \
         c-client.xsl xproto.xml 

Processing 'bigreq.xml' illustrates a case where it hangs consuming 100%
of the CPU. From a little fiddling in gdb, I think it's infinite-looping
in xsltReleaseLocalRVTs from transform.c, but I haven't looked at the
source to see if that makes sense.

The cases that segfault have the following stack trace. I can regenerate
it with full debugging information if needed. I'm hoping that Josh
Triplett can help if more than this is needed to debug the problem,
since this XSLT is his code. :-)

(gdb) bt
#0  0x40271909 in free () from /lib/tls/libc.so.6
#1  0x4009f1bc in xsltFreeDocumentKeys (idoc=0x81625a8) at keys.c:154
#2  0x4009d6c1 in xsltReleaseRVT (ctxt=0x80e1d20, RVT=0x81607d8) at variables.c:365
#3  0x400ae781 in xsltApplyXSLTTemplate (ctxt=0x80e1d20, contextNode=0x80889b8, list=0x80704c8, templ=0x8061920, withParams=0x0) at transform.c:3031
#4  0x400aef1b in xsltProcessOneNode (ctxt=0x80e1d20, contextNode=0x80889b8, withParams=0x0) at transform.c:2024
#5  0x400afb78 in xsltApplyTemplates (ctxt=0x80e1d20, node=0x8089f30, inst=0x805c128, castedComp=0x8067270) at transform.c:4977
#6  0x400ad264 in xsltApplySequenceConstructor (ctxt=0x80e1d20, contextNode=0x8089f30, list=0x805b9b0, templ=0x809fb00) at transform.c:2560
#7  0x400ae74e in xsltApplyXSLTTemplate (ctxt=0x80e1d20, contextNode=0x8089f30, list=0x805b9b0, templ=0x809fb00, withParams=0x0) at transform.c:3008
#8  0x400aef1b in xsltProcessOneNode (ctxt=0x80e1d20, contextNode=0x8089f30, withParams=0x0) at transform.c:2024
#9  0x400af3bd in xsltProcessOneNode (ctxt=0x80e1d20, contextNode=0x8083c58, withParams=0x0) at transform.c:1854
#10 0x400afb78 in xsltApplyTemplates (ctxt=0x80e1d20, node=0x8083c58, inst=0x805b4a0, castedComp=0x8066740) at transform.c:4977
#11 0x400ad264 in xsltApplySequenceConstructor (ctxt=0x80e1d20, contextNode=0x8083c58, list=0x805b4a0, templ=0x0) at transform.c:2560
#12 0x4009e13a in xsltEvalGlobalVariable (elem=0x819fa48, ctxt=0x80e1d20) at variables.c:1178
#13 0x4009e311 in xsltGlobalVariableLookup (ctxt=0x80e1d20, name=0x80635e7 "pass1-rtf", ns_uri=<value optimized out>) at variables.c:1852
#14 0x4009e781 in xsltXPathVariableLookup (ctxt=0x80e1d20, name=0x80635e7 "pass1-rtf", ns_uri=0x0) at variables.c:2278
#15 0x401436fc in xmlXPathVariableLookup () from /usr/lib/libxml2.so.2
#16 0x40144903 in xmlXPathFunctionLookup () from /usr/lib/libxml2.so.2
#17 0x40143b0f in xmlXPathFunctionLookup () from /usr/lib/libxml2.so.2
#18 0x4014432a in xmlXPathFunctionLookup () from /usr/lib/libxml2.so.2
#19 0x40144392 in xmlXPathFunctionLookup () from /usr/lib/libxml2.so.2
#20 0x40143b0f in xmlXPathFunctionLookup () from /usr/lib/libxml2.so.2
#21 0x40145846 in xmlXPathFunctionLookup () from /usr/lib/libxml2.so.2
#22 0x40149ed6 in xmlXPathEval () from /usr/lib/libxml2.so.2
#23 0x4014a0d2 in xmlXPathCompiledEval () from /usr/lib/libxml2.so.2
#24 0x4009df09 in xsltEvalGlobalVariable (elem=0x819f6f8, ctxt=0x80e1d20) at variables.c:1115
#25 0x40112a2f in xmlBuildQName () from /usr/lib/libxml2.so.2
#26 0x40112acb in xmlHashScanFull () from /usr/lib/libxml2.so.2
#27 0x40112b1a in xmlHashScan () from /usr/lib/libxml2.so.2
#28 0x4009d39b in xsltEvalGlobalVariables (ctxt=0x80e1d20) at variables.c:1286
#29 0x400b2f80 in xsltApplyStylesheetInternal (style=0x8058800, doc=0x8083c58, params=0x804cb20, output=0x804d2e8 "xproto.c", profile=0x0, userCtxt=0x80e1d20)
    at transform.c:5968
#30 0x400b375b in xsltRunStylesheetUser (style=0x8058800, doc=0x8083c58, params=0x804cb20, output=0x804d2e8 "xproto.c", SAX=0x0, IObuf=0x0, profile=0x0, userCtxt=0x80e1d20)
    at transform.c:6275
#31 0x080498cc in xsltProcess (doc=0x8083c58, cur=0x8058800, filename=0xbfe406f6 "xproto.xml") at xsltproc.c:468
#32 0x0804a37c in main (argc=14, argv=0xbfe3f304) at xsltproc.c:854
#33 0x40220ea8 in __libc_start_main () from /lib/tls/libc.so.6
#34 0x080492d1 in _start () at ../sysdeps/i386/elf/start.S:119

-- System Information:
Debian Release: 4.0
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-1-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages libxslt1.1 depends on:
ii  libc6                      2.3.6.ds1-7   GNU C Library: Shared libraries
ii  libgcrypt11                1.2.3-2       LGPL Crypto library - runtime libr
ii  libgpg-error0              1.4-1         library for common error values an
ii  libxml2                    2.6.27.dfsg-1 GNOME XML library

libxslt1.1 recommends no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/debian-xml-sgml-pkgs/attachments/20061112/1d3404ec/attachment-0001.pgp