User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8) Gecko/20051111 Firefox/1.5 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8) Gecko/20051111 Firefox/1.5 In a template with a single rule, and a condition like : <triple ?a pred1 ?b> <triple ?a pred2 ?c>, the template engine crashes when the action is: <treeitem uri="?c"> <treerow> <treecell label="?b"/> <treecell label="?c"/> </treerow> </treeitem> and works without problems when the action is: <treeitem uri="?a"> <treerow> <treecell label="?b"/> <treecell label="?c"/> </treerow> </treeitem> I didn't find the general case of such crashes yet, but I'm searching it. Reproducible: Always Steps to Reproduce: 1.Download the ZIP file I sent 2.Unzip 3.Run crash.xul Actual Results: Firefox crashes! Expected Results: A tree is shown, and there's a row for each value of the ?pred variable.

When I talk about the ZIP file I sent, see the URL above.

Scratch that, I couldn't get it to crash with a remote datasource.

Francois, any chance you could get a stack trace for the crash?

Here are the details given by the quality manager of Firefox: http://users.skynet.be/fa388841/details.txt

François, the talkback data has to be sent to the server for it to be interpreted. Can you open up talkback.exe and get the talkback ID for the crash. Talkback.exe is in %Program Files%\Mozilla Firefox\extensions\talkback@mozilla.org\.

TB13194910Z

Incident ID: 13194910 Stack Signature LiteralImpl::~LiteralImpl db42e5fe Product ID Firefox15 Build ID 2005111116 Trigger Time 2005-12-23 03:22:43.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module FIREFOX.EXE + (000a9de8) URL visited User Comments Since Last Crash 156150 sec Total Uptime 156301 sec Trigger Reason Access violation Source File, Line No. c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFService.cpp, line 590 Stack Trace LiteralImpl::~LiteralImpl [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFService.cpp, line 590] nsXULContentBuilder::BuildContentFromTemplate [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 582] nsXULContentBuilder::ReplaceMatch [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1659] nsXULTemplateBuilder::FireNewlyMatchedRules [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 478] nsXULTemplateBuilder::OnAssert [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/content/xul/templates/src/nsXULTemplateBuilder.cpp, line 509] CompositeDataSourceImpl::OnAssert [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsCompositeDataSource.cpp, line 1462] InMemoryDataSource::Assert [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsInMemoryDataSource.cpp, line 1407] RDFXMLDataSourceImpl::Assert [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFXMLDataSource.cpp, line 715] RDFContainerImpl::AppendElement [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFContainer.cpp, line 257] RDFContentSinkImpl::OpenMember [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFContentSink.cpp, line 1251] RDFContentSinkImpl::HandleStartElement [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/rdf/base/src/nsRDFContentSink.cpp, line 472] nsExpatDriver::HandleStartElement [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 375] Driver_HandleStartElement [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 87] contentProcessor [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/expat/lib/xmlparse.c, line 1942] prologProcessor [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/expat/lib/xmlparse.c, line 3618] prologInitProcessor [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/expat/lib/xmlparse.c, line 3449] nsExpatDriver::ParseBuffer [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 855] nsExpatDriver::ConsumeToken [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsExpatDriver.cpp, line 984] nsParser::Tokenize [c:/builds/tinderbox/Fx-Mozilla1.8/WINNT_5.2_Depend/mozilla/parser/htmlparser/src/nsParser.cpp, line 2826]

not RDF, but templates.

*** Bug 309254 has been marked as a duplicate of this bug. ***

This bug is fixed by the new template builder, which doesn't allow literals as the value of uri="?blah" Note that the testcase should not produce any output.

Crash is fixed.