321091 - Firefox crashes with a simple RDF template, because of the value given to the uri attribute in the action [@ LiteralImpl::~LiteralImpl]

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[François Degrave]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8) Gecko/20051111 Firefox/1.5

In a template with a single rule, and a condition like : <triple ?a pred1 ?b> <triple ?a pred2 ?c>, the template engine crashes when the action is:

          <treeitem uri="?c">
            <treerow>
              <treecell label="?b"/>
              <treecell label="?c"/>
            </treerow>
          </treeitem>

and works without problems when the action is:

          <treeitem uri="?a">
            <treerow>
              <treecell label="?b"/>
              <treecell label="?c"/>
            </treerow>
          </treeitem>

I didn't find the general case of such crashes yet, but I'm searching it.

Reproducible: Always

Steps to Reproduce:
1.Download the ZIP file I sent
2.Unzip
3.Run crash.xul

Actual Results:  
Firefox crashes!

Expected Results:  
A tree is shown, and there's a row for each value of the ?pred variable.

Comment 1

[François Degrave]

When I talk about the ZIP file I sent, see the URL above.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Attachment: rdf file

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Attachment: testcase (zipped)

Scratch that, I couldn't get it to crash with a remote datasource.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Francois, any chance you could get a stack trace for the crash?

Comment 5

[François Degrave]

Here are the details given by the quality manager of Firefox:
http://users.skynet.be/fa388841/details.txt

Comment 6

[Adam Guthrie]

François, the talkback data has to be sent to the server for it to be interpreted. Can you open up talkback.exe and get the talkback ID for the crash. Talkback.exe is in %Program Files%\Mozilla Firefox\extensions\[e-mail]\.

Comment 7

[François Degrave]

TB13194910Z

Comment 8

[Adam Guthrie]

Incident ID: 13194910
Stack Signature	LiteralImpl::~LiteralImpl db42e5fe
Product ID	Firefox15
Build ID	2005111116
Trigger Time	2005-12-23 03:22:43.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	FIREFOX.EXE + (000a9de8)
URL visited	
User Comments	
Since Last Crash	156150 sec
Total Uptime	156301 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFService.cpp, line 590
Stack Trace 	
LiteralImpl::~LiteralImpl  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFService.cpp, line 590]
nsXULContentBuilder::BuildContentFromTemplate  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 582]
nsXULContentBuilder::ReplaceMatch  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1659]
nsXULTemplateBuilder::FireNewlyMatchedRules  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 478]
nsXULTemplateBuilder::OnAssert  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 509]
CompositeDataSourceImpl::OnAssert  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsCompositeDataSource.cpp, line 1462]
InMemoryDataSource::Assert  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsInMemoryDataSource.cpp, line 1407]
RDFXMLDataSourceImpl::Assert  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFXMLDataSource.cpp, line 715]
RDFContainerImpl::AppendElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFContainer.cpp, line 257]
RDFContentSinkImpl::OpenMember  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFContentSink.cpp, line 1251]
RDFContentSinkImpl::HandleStartElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFContentSink.cpp, line 472]
nsExpatDriver::HandleStartElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 375]
Driver_HandleStartElement  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 87]
contentProcessor  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/expat/lib/xmlparse.c, line 1942]
prologProcessor  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/expat/lib/xmlparse.c, line 3618]
prologInitProcessor  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/expat/lib/xmlparse.c, line 3449]
nsExpatDriver::ParseBuffer  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 855]
nsExpatDriver::ConsumeToken  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 984]
nsParser::Tokenize  [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsParser.cpp, line 2826]

Comment 9

[Axel Hecht [:Pike]]

not RDF, but templates.

Comment 10

[Neil Deakin]

*** Bug 309254 has been marked as a duplicate of this bug. ***

Comment 11

[Neil Deakin]

This bug is fixed by the new template builder, which doesn't allow literals as the value of uri="?blah"

Note that the testcase should not produce any output.

Comment 12

[Neil Deakin]

Crash is fixed.