Re: [PATCH v2 0/5] MR10429: msxml3/tests: Add some more DOM tests.

[Nikolay Sivov (＠nsivov)]

On Tue Mar 24 11:28:25 2026 +0000, Bernhard Übelacker wrote:
> Hello @nsivov, the first patch e4832050f of this merge request triggers
> ASan in `test_removeAttributeNode` in this CI runs:
> [32bit](https://gitlab.winehq.org/bernhardu/wine/-/jobs/241883#L2771) [64bit](https://gitlab.winehq.org/bernhardu/wine/-/jobs/241884#L2990).
> For completeness, this CI runs include also the additional patch from
> !9279 by @yshui.
> <details>
> <summary>ASan details</summary>
> ```
> ==msxml3_test.exe==428==ERROR: AddressSanitizer: heap-use-after-free on
> address 0x025cc574 at pc 0x779a2d4a bp 0x0022fb14 sp 0x0022fb10
> READ of size 4 at 0x025cc574 thread T0
>     #0 0x779a2d49 in domattr_get_namespaceURI /builds/bernhardu/wine/build64/../dlls/msxml3/attribute.c:546:36
>     #1 0x004630d1 in IXMLDOMAttribute_get_namespaceURI /builds/bernhardu/wine/build64/include/msxml.h:3574:12
>     #2 0x0044339b in test_removeAttributeNode /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:14550:10
>     #3 0x004011e8 in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16092:5
>     #4 0x004ad6f1 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
>     #5 0x004ad1aa in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
> ...
> 0x025cc574 is located 36 bytes inside of 48-byte region [0x025cc550,0x025cc580)
> freed by thread T0 here:
>     #0 0x785f558b in free /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:78:3
>     #1 0x77b1f262 in xmlFreeProp /builds/bernhardu/wine/build64/../libs/xml2/tree.c:2079:5
>     #2 0x77b1f498 in xmlRemoveProp /builds/bernhardu/wine/build64/../libs/xml2/tree.c
>     #3 0x779d4eb9 in domelem_remove_qualified_item /builds/bernhardu/wine/build64/../dlls/msxml3/element.c:1754:13
>     #4 0x779d4496 in domelem_remove_named_item /builds/bernhardu/wine/build64/../dlls/msxml3/element.c:1794:10
>     #5 0x77a0dae8 in xmlnodemap_removeNamedItem /builds/bernhardu/wine/build64/../dlls/msxml3/nodemap.c:219:12
>     #6 0x779d73d1 in IXMLDOMNamedNodeMap_removeNamedItem /builds/bernhardu/wine/build64/include/msxml6.h:5425:12
>     #7 0x779d0fe1 in domelem_removeAttribute /builds/bernhardu/wine/build64/../dlls/msxml3/element.c:1341:10
>     #8 0x00463071 in IXMLDOMElement_removeAttribute /builds/bernhardu/wine/build64/include/msxml.h:4104:12
>     #9 0x0044329a in test_removeAttributeNode /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:14541:10
>     #10 0x004011e8 in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16092:5
>     #11 0x004ad6f1 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
>     #12 0x004ad1aa in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
> ...
> previously allocated by thread T0 here:
>     #0 0x785f568b in malloc /home/runner/work/llvm-mingw/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:87:3
>     #1 0x77b1e5c8 in xmlNewPropInternal /builds/bernhardu/wine/build64/../libs/xml2/tree.c:1851:24
>     #2 0x77b1ed3c in xmlNewNsPropEatName /builds/bernhardu/wine/build64/../libs/xml2/tree.c:1979:12
>     #3 0x77b84b25 in xmlSAX2AttributeInternal /builds/bernhardu/wine/build64/../libs/xml2/SAX2.c:1249:11
>     #4 0x77b82dda in xmlSAX2StartElement /builds/bernhardu/wine/build64/../libs/xml2/SAX2.c:1662:7
>     #5 0x77ac1554 in xmlParseStartTag /builds/bernhardu/wine/build64/../libs/xml2/parser.c
>     #6 0x77ac456b in xmlParseElementStart /builds/bernhardu/wine/build64/../libs/xml2/parser.c:10476:9
>     #7 0x77ac4071 in xmlParseElement /builds/bernhardu/wine/build64/../libs/xml2/parser.c:10406:9
>     #8 0x77ac81b7 in xmlParseDocument /builds/bernhardu/wine/build64/../libs/xml2/parser.c:11190:2
>     #9 0x779c9243 in doparse /builds/bernhardu/wine/build64/../dlls/msxml3/domdoc.c:544:5
>     #10 0x779c2d5a in domdoc_loadXML /builds/bernhardu/wine/build64/../dlls/msxml3/domdoc.c:2492:22
>     #11 0x00452c64 in IXMLDOMDocument_loadXML /builds/bernhardu/wine/build64/include/msxml.h:1776:12
>     #12 0x00442ecf in test_removeAttributeNode /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:14503:10
>     #13 0x004011e8 in func_domdoc /builds/bernhardu/wine/build64/../dlls/msxml3/tests/domdoc.c:16092:5
>     #14 0x004ad6f1 in run_test /builds/bernhardu/wine/build64/../include/wine/test.h:780:5
>     #15 0x004ad1aa in main /builds/bernhardu/wine/build64/../include/wine/test.h:900:12
> ...
> SUMMARY: AddressSanitizer: heap-use-after-free
> /builds/bernhardu/wine/build64/../dlls/msxml3/attribute.c:546:36 in domattr_get_namespaceURI
> ```
> </details>
> Thank you, I'll skip it on Wine for now, in !10435.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/10429#note_133525