301537 - crash when selecting a XUL menu with RDF [@ LiteralImpl::~LiteralImpl]

Status: RESOLVED INCOMPLETE

(Core Graveyard :: RDF, defect)

Description

[Daniel de Wildt]

I tested one auf Neil Deakins template examples (see URL) with firefox 1.0.5.

To reproduce:
Open the URL above in firefox.
Click on the button. (A menu should appear.)
Select an entry. (A submenu should appear.)
The new submenu has two empty entries.
Select an entry and click on it.
Firefox crashes.

Talkback reports:
TB7635621G
TB7636637W

I can not reproduce this in deer park alpha2, because an empty menu appears
after I clicked on the first button.

I hope this is the correct component (and branch).

Comment 1

[Daniel de Wildt]

Talkback data (TB7635621G):

LiteralImpl::~LiteralImpl 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFService.cpp,
line 573]
nsXULContentBuilder::BuildContentFromTemplate 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 606]
nsXULContentBuilder::CreateContainerContents 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1255]
nsXULContentBuilder::OpenContainer 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1844]
nsXULContentBuilder::AttributeChanged 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp,
line 1634]
nsXULDocument::AttributeChanged 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/document/src/nsXULDocument.cpp,
line 1140]
nsXULElement::SetAttrAndNotify 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2229]
nsXULElement::SetAttr 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2152]
nsXULElement::SetAttribute 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 1021]
nsMenuFrame::OpenMenu 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 743]
nsMenuFrame::Notify 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1331]
nsTimerImpl::Fire 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/xpcom/threads/nsTimerImpl.cpp,
line 395]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1/WINNT_5.2_Depend/mozilla/xpcom/threads/plevent.c,
line 674]
SETUPAPI.dll + 0x30c24 (0x778b0c24)

Comment 2

[Hermann Schwab]

(In reply to comment #0)
> I tested one auf Neil Deakins template examples (see URL) with firefox 1.0.5.

I tested it with firefox 1.0.6, same result, crash.
testing it with current Firefox Trunk or Seamonkey produced less result, but
also no crash.

> To reproduce:
> Open the URL above in firefox.
> Click on the button. (A menu should appear.)
The menu appears in the 1.7 branch, the trunk only shows a very small box, 1em?

> Select an entry. (A submenu should appear.)
works on branch, not on trunk.

> The new submenu has two empty entries.
on Branch, not on trunk

> Select an entry and click on it.
You don´t need to select or click, hovering over the empty menu is sufficent to
crash the fox.

> Firefox crashes.
> 
> Talkback reports:
> TB7635621G
> TB7636637W

TB7713983E, TB7713417Z on Win98
 
> I can not reproduce this in deer park alpha2, because an empty menu appears
> after I clicked on the first button.

This seems to me more serious than the crash on the branch.
The trunk will replace the branch, so I see the current behaviour of the trunk
as a regression.

> I hope this is the correct component (and branch).

Comment 3

[Jesse Ruderman on Windows]

The testcase is gone.  smaug/enn, is the stack useful, or should this just be marked as incomplete?

Comment 4

[Neil Deakin]

Likely a case where an rdf literal was being used as a value and the old template builder could only handle rdf resources. That's long since fixed and would only be an issue in 1.8 and earlier.