Bug 1405416 - Assertion failure: mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_INTERACTIVE (Bad readyState) [@ txMozillaTextOutput::endDocument]. r=bzbarsky

We only set a transform observer when transforming through an XSLT PI (nsXMLContentSink::LoadXSLStyleSheet), not when the transform is initiated through the JS API. The only time we can assert that the readystate is READYSTATE_INTERACTIVE is when transforming to a fragment. Because transformToDocument doesn't set an observer, we can't check for a non-null observer but need a state that both XSLT PI transforms and transformToDocument set (which we can do when they create a document).

Differential Revision: https://phabricator.services.mozilla.com/D56860

--HG--
extra : moz-landing-system : lando

dom/xslt/crashtests/1330492.html

@@ -17,6 +17,7 @@ addEventListener("DOMContentLoaded", function(){
   let xsl = doc.parseFromString(o_xslt.textContent, "text/xml");
   xsltPrs.importStylesheet(xsl);
   xsltPrs.transformToFragment(xml, document);
+  xsltPrs.transformToDocument(xml);
 });
 </script>
 </html>

dom/xslt/xslt/txMozillaTextOutput.cpp

@@ -21,12 +21,15 @@
 using namespace mozilla;
 using namespace mozilla::dom;
 
-txMozillaTextOutput::txMozillaTextOutput(nsITransformObserver* aObserver) {
+txMozillaTextOutput::txMozillaTextOutput(nsITransformObserver* aObserver)
+    : mObserver(do_GetWeakReference(aObserver)), mCreatedDocument(false) {
   MOZ_COUNT_CTOR(txMozillaTextOutput);
-  mObserver = do_GetWeakReference(aObserver);
 }
 
-txMozillaTextOutput::txMozillaTextOutput(DocumentFragment* aDest) {
+txMozillaTextOutput::txMozillaTextOutput(DocumentFragment* aDest)
+    : mTextParent(aDest),
+      mDocument(mTextParent->OwnerDoc()),
+      mCreatedDocument(false) {
   MOZ_COUNT_CTOR(txMozillaTextOutput);
   mTextParent = aDest;
   mDocument = mTextParent->OwnerDoc();
@@ -66,7 +69,7 @@ nsresult txMozillaTextOutput::endDocument(nsresult aResult) {
   NS_ENSURE_SUCCESS(rv, rv);
 
   // This should really be handled by Document::EndLoad
-  if (mObserver) {
+  if (mCreatedDocument) {
     MOZ_ASSERT(mDocument->GetReadyStateEnum() == Document::READYSTATE_LOADING,
                "Bad readyState");
   } else {
@@ -116,6 +119,7 @@ nsresult txMozillaTextOutput::createResultDocument(Document* aSourceDocument,
   // Create the document
   nsresult rv = NS_NewXMLDocument(getter_AddRefs(mDocument), aLoadedAsData);
   NS_ENSURE_SUCCESS(rv, rv);
+  mCreatedDocument = true;
   // This should really be handled by Document::BeginLoad
   MOZ_ASSERT(
       mDocument->GetReadyStateEnum() == Document::READYSTATE_UNINITIALIZED,

dom/xslt/xslt/txMozillaTextOutput.h

@@ -42,6 +42,7 @@ class txMozillaTextOutput : public txAOutputXMLEventHandler {
   RefPtr<mozilla::dom::Document> mDocument;
   txOutputFormat mOutputFormat;
   nsString mText;
+  bool mCreatedDocument;
 };
 
 #endif