271301 - crash in qprefs with invoking browser spoofing [@ RDF.DLL + 0x12a3a - nsXULTemplateBuilder::SubstituteTextReplaceVariable ]

Status: RESOLVED DUPLICATE of bug 321091

(Core :: XUL, defect)

Description

[Gottfried Helms]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; de-AT; rv:1.8a4) Gecko/20040927 MultiZilla/1.6.0.0e
Build Identifier: Mozilla/5.0 (Windows; U; Win98; de-AT; rv:1.8a4) Gecko/20040927 MultiZilla/1.6.0.0e

Just tried to open menu-entry of qprefs - button, browser-spoofing.
Browser crashes immediately. This happens *only* with this menu-entry.

Reproducable.
(Possibly connected to previous mnenhy-add-on in mozilla1.6 ????
 Didn't install that in 1.8a)

Reproducible: Always
Steps to Reproduce:
1.click qprefs-button
2.click browser-spoofing
3.*crash* 

Actual Results:  
Mozilla crashed

Expected Results:  
to see the sub-menu-items

error-msg: error in rdf.dll 
(eventually: "page-fault in rdf.dll")

Comment 1

[Gottfried Helms]

MOZILLA verursachte einen Fehler durch eine ungültige Seite
in Modul RDF.DLL bei 0167:60a12a3a.
Register:
EAX=01d3dda0 CS=0167 EIP=60a12a3a EFLGS=00010293
EBX=01e96504 SS=016f ESP=0064dd8c EBP=0064ddac
ECX=60a12a38 DS=016f ESI=0064de84 FS=5bb7
EDX=0064df5a ES=016f EDI=00000000 GS=0000
Bytes bei CS:EIP:
a1 60 fc 59 a0 60 0e 5a a0 60 e1 5a a0 60 24 5b 
Stapelwerte:
610bdc7a 01d3dda0 60442fb0 0064ddb8 610bdcf5 60442fb0 0064ddb8 00000002 0064de78
603cd48d 01d3dda0 60442fb0 0064dec8 0064def8 610b9c08 0064df50 

Comment 2

[Adam Hauner]

Gottfried Helms: Could you provide Talkback incident ID?

Comment 3

[Gottfried Helms]

(In reply to comment #2)
> Gottfried Helms: Could you provide Talkback incident ID?

Sorry, don't know how to find such an ID. No TALKBACK-entry
in Menu; I installed Moz by just extracting system from *.zip-
file. (have "Extra","Debug" and "QA" menu, but without "talkback"
mentioned anywhere... ;-( 

Gottfried Helms

Comment 4

[Adam Hauner]

To get the Talkback ID's go to your mozilla directory and go to components/,
there start talkback.exe, it'll give you a list with the IDs. Thank's a lot.
(more info on http://www.mozilla.org/quality/qfa.html)

Comment 5

[Gottfried Helms]

(In reply to comment #4)
> To get the Talkback ID's go to your mozilla directory and go to components/,
> there start talkback.exe, it'll give you a list with the IDs. Thank's a lot.
> (more info on http://www.mozilla.org/quality/qfa.html)
Sorry again ;-( 
Tried different ways to collect some talkback.-infos; bt the talkback-window
remains empty.
1) Assumed, talkback must be started before Mozilla(perhaps installing some
system-hooks...)
- started Talkback, switch agent "on"
- started Mozilla
 ... mozilla crashes: no info
stopped talkback.exe
2)Assumed, talkback must be started after mozilla(perhaps searching some
windows-identifiers)
- again no information in the talkback-window

So - what would you like me to do now?

Gottfried Helms

Comment 6

[timeless]

try quiting mozilla, deleting components\compreg.dat, running mozilla, crashing
again.

Comment 7

[Gottfried Helms]

(In reply to comment #6)
> try quiting mozilla, deleting components\compreg.dat, running mozilla, crashing
> again.

Wow. This is program-information ...

Now I got:          ID =  TB2138467H

Full "details"-info at
 
 www.uni-kassel.de/~helms/sw/details.zip

Gottfried Helms

Comment 8

[timeless]

Incident ID: 2138467
Stack Signature	RDF.DLL + 0x12a3a (0x60a12a3a) 6a9e35f8
Product ID	MozillaTrunk
Build ID	2004092716
Trigger Time	2004-11-23 12:42:36.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	RDF.DLL + (00012a3a)
URL visited	
User Comments	clicking qprefs; trying to open submenu "browserspoofing"
Since Last Crash	695 sec
Total Uptime	695 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
RDF.DLL + 0x12a3a (0x60a12a3a)
nsXULTemplateBuilder::SubstituteTextReplaceVariable 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp,
line 1105]
nsXULTemplateBuilder::ParseAttribute 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp,
line 1002]
nsXULTemplateBuilder::SubstituteText 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp,
line 1052]
nsXULContentBuilder::BuildContentFromTemplate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 739]
nsXULContentBuilder::CreateContainerContents 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1250]
nsXULContentBuilder::CreateTemplateAndContainerContents 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1145]
nsXULContentBuilder::RebuildAll 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1933]
nsXULTemplateBuilder::Rebuild 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp,
line 240]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2030]
XPC_WN_CallMethod 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1288]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1282]
js_Interpret 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 3374]
js_Invoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1301]
js_InternalInvoke 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c,
line 1378]
JS_CallFunctionValue 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line
3713]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1346]
nsJSEventListener::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/dom/src/events/nsJSEventListener.cpp,
line 181]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1513]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1589]
nsXULElement::HandleDOMEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2824]
PresShell::HandleDOMEventWithTarget 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6006]
nsMenuFrame::OnCreate 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1669]
nsMenuFrame::OpenMenuInternal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 740]
nsMenuFrame::AttributeChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 689]
nsCSSFrameConstructor::AttributeChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/style/src/nsCSSFrameConstructor.cpp,
line 10193]
PresShell::AttributeChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5073]
nsXULDocument::AttributeChanged 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1142]
nsXULElement::SetAttrAndNotify 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2206]
nsXULElement::SetAttr 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2130]
nsXULElement::SetAttribute 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 1029]
nsMenuFrame::OpenMenu 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 722]
nsMenuFrame::Notify 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1299]
nsTimerImpl::Fire 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 396]
handleTimerEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 450]
PL_HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 693]
PL_ProcessPendingEvents 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 631]
_md_TimerProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/threads/plevent.c,
line 999]
KERNEL32.DLL + 0x2317 (0xbff72317)

Comment 9

[Axel Hecht]

Something odd is going on. I get Literals instead of Resources inside the template
builder. Probably not a RDF bug, but I'm going to give it another debug shot.

Comment 10

[Axel Hecht]

This is not RDF land.
This is template foo, triggered by menus.
nsTemplateRule.cpp:182 casts a mISupports from a Value to a nsIRDFResource.
Sadly, that one is a LiteralImpl. This should crash.

Could someone enlighten us where the actual template for this is?
It displays the useragents.rdf, which looks like 

<RDF:RDF xmlns:MZ="http://multizilla.mozdev.org/rdf#"
         xmlns:NC="http://home.netscape.com/NC-rdf#"
         xmlns:RDF="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
  <RDF:Seq RDF:about="urn:useragent-data">
    <RDF:li>Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
Netscape/7.1</RDF:li>
  </RDF:Seq>
</RDF:RDF>

That literal is the value that I see in my debugger.

Comment 11

[Neil Deakin]

Axel's last comment would suggest a duplicate of 321091, but needs a real testcase to be sure

Comment 12

[Jesse Ruderman on Windows]

I don't think a real testcase is going to materialize, so...