Code: xsltStylesheetPtr XSLStyleSheet::compileStyleSheet()
{
     if (m_embedded)
         return xsltLoadStylesheetPI(document());
 
     ASSERT(!m_stylesheetDocTaken);
     xsltStylesheetPtr result = xsltParseStylesheetDoc(m_stylesheetDoc);
     if (result)
         m_stylesheetDocTaken = true;
     return result;
 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in the XSLStyleSheet::compileStyleSheet function in core/xml/XSLStyleSheetLibxslt.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of post-failure recompilation in unspecified libxslt versions.
Commit Message: Avoid reparsing an XSLT stylesheet after the first failure.

Certain libxslt versions appear to leave the doc in an invalid state when parsing fails. We should cache this result and avoid re-parsing.

(The test cannot be converted to text-only due to its invalid stylesheet).

R=inferno@chromium.org,abarth@chromium.org,pdr@chromium.org
BUG=271939

Review URL: https://chromiumcodereview.appspot.com/23103007

git-svn-id: svn://svn.chromium.org/blink/trunk@156248 bbb929c8-8fbe-4397-9dbb-9b2b20218538