Closed Bug 112434 Opened 23 years ago Closed 21 years ago

JVM plugin crashes Mozilla when loading java applet.

Categories

(Core Graveyard :: Java: OJI, defect, P1)

Product:
Core Graveyard
Component:
Java: OJI
Platform:
x86
Linux
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: mostafah, Assigned: joshua.xia)

References

(
URL
)

Details

(Keywords: hang)

Attachments

(1 file)

gdb backtrace
2.95 KB, text/plain
Details 
Redhat 7.1 Linux
Mozilla 0.9.5: Build: 2001101202
Reproducable: always
Steps to reproduce:
1)Make sure you have the java-vm plugin (libjavaplugin_oji.so ) installed
2)Visit http://scores.nfl.com/scores
3)Click on a GameDay Live link
4)Press cancel if you see the download-flash-8.5 dialog
5)Mozilla freezes

This debug message is displayed on a debug-enabled build:
--------------------------------------------------------------------------
Error loading URL
javascript:openVis('http://www.nfl.com/u/multimedia/live/football/nfl/frameset.htm?gameDate=20011202&gameCode=NFL_20011202_NE@NYJ&isLive=0')
: 805303f5
INTERNAL ERROR on Browser End: Exec of "java_vm" failed: 2
<
System error?:: No such file or directory
----------------------------------------------------------------------------
->OJI
Assignee: idk → joe.chou
Component: Java-Implemented Plugins → OJI
QA Contact: avm → pmac
Dupe of bug 85181

Honestly, you'd think some people would at least check if their bug has already
been reported _today_!
Reporter: How did you install plugin?
          Note, you should not copy oji lib. Just make a symlink.
          Please close as dupe if this solve your problem.
Good point. I removed the library and made a symlink to the original location it
still crashes but the error message has changed:

Error loading URL
javascript:openVis('http://www.nfl.com/u/multimedia/live/football/nfl/frameset.htm?gameDate=20011202&gameCode=NFL_20011202_TEN@CLE&isLive=0')
: 805303f5
Document
http://www.nfl.com/u/multimedia/live/football/nfl/frameset.htm?gameDate=20011202&gameCode=NFL_20011202_TEN@CLE&isLive=0
loaded successfully
/usr/local/mozilla0.9.5/run-mozilla.sh: line 72: 28887 Segmentation fault     
$prog ${1+"$@"}

Is http://java.sun.com work for you?
Absolutely no problem.

Ok, i am able to reproduce this on redhat 6.2 with latest trunk build.

I will post stacktrace shortly. 
It looks like this is not OJI-related problem.

Please change "component" to more appropriate (may be Layout?)
Attached file gdb backtrace — 
Stacktrace for the crash.
Moving to Layout on Igor's behalf
Component: OJI → Layout
reassign to Marc
Assignee: joe.chou → attinasi
QA Contact: pmac → petersen
Marc isn't going to look at this....but maybe Serge can on Linux?
Assignee: attinasi → serge
Status: UNCONFIRMED → NEW
Ever confirmed: true
try to reload this page several times
http://www.nfl.com/u/multimedia/live/football/nfl/frameset.htm?gameDate=20011129
&gameCode=NFL_20011129_PHI@KC&isLive=0
win2k stack trace:
feeefeee()
map_jsj_thread_to_js_context_impl(JSJavaThreadState * 0x00000000, 
*** INALID POINTER to pluginInstance ==> void * 0x1e092558,
 JNIEnv_ * 0x03d35e20, char * * 0x0012fb9c) line 156 + 16 bytes
enter_js_from_java_impl(JNIEnv_ * 0x03d35e20, char * * 0x0012fb9c, void * * 
0x00000000, int 0x00000000, void * 0x1a4f6ae8, void * 0x1e092558) line 426 + 19 
bytes
jsj_enter_js(const JNINativeInterface_ * * 0x03d35e20, void * 0x1e092558, 
_jobject * 0x00000000, JSContext * * 0x0012fbec, JSObject * * 0x00000000, void 
(JSContext *, const char *, JSErrorReport *)* * 0x0012fbe4, void * * 0x00000000, 
int 0x00000000, void * 0x1a4f6ae8) line 705 + 33 bytes
nsCLiveconnect::GetWindow(nsCLiveconnect * const 0x04b64368, JNIEnv_ * 
0x03d35e20,
***==> void * 0x1e092558,
 void * * 0x00000000, int 0x00000000, nsISupports * 0x1a4f6ae8, long * 
0x1a3d93fc) line 573 + 40 bytes
JPINS32! DllUnregisterServer + 5963 bytes
JPINS32! DllUnregisterServer + 5446 bytes
PL_HandleEvent(PLEvent * 0x04edd1d0) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00fa5728) line 520 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00180434, unsigned int 0x0000c175, unsigned int 
0x00000000, long 0x00fa5728) line 1071 + 9 bytes
USER32! UserCallWinProc@20 + 24 bytes
USER32! DispatchMessageWorker@8 + 244 bytes
USER32! DispatchMessageA@4 + 11 bytes
nsAppShell::Run(nsAppShell * const 0x00ff9628) line 122
nsAppShellService::Run(nsAppShellService * const 0x00ff9148) line 303
main1(int 0x00000001, char * * 0x003572f0, nsISupports * 0x00000000) line 1304 + 
32 bytes
main(int 0x00000001, char * * 0x003572f0) line 1630 + 37 bytes
mainCRTStartup() line 338 + 17 bytes
---
-	pluginInstance	0x1e092558
-	nsISupports	{...}
-	__vfptr	0x1e096e68
	[0x0]	0x00330178
	[0x1]	0x1e092558
	[0x2]	0xfeeefeee
and we are calling 0xfeeefeee()
I'm not sure how is the right person to reassign this, JPINS32 is sun's dll.
Any idea?
*** Bug 114152 has been marked as a duplicate of this bug. ***
Severity: normal → critical
Keywords: crash
this is not a plugin problem see my comment #12
back to OJI
-->joe.chou@eng.sun.com
Component: Layout → OJI
and I'm still seeing this on w2k
Assignee: serge → joe.chou
Keywords: mozilla1.0, oeone
At least several times crash happen inside of sun's java plugin 
(1.4, recent build) on NETSCAPE_6_2_1 branch. -> cc: skatz

However, crash symptoms may differ from time to time (at least for me). 
And it looks like stack may get corrupted and problem relate to 
thread interaction (info threads in gdb shows number of very suspicious 
threads)

Could also relate to bug 124053 (however problem still persisted
when i applied suggested patch for bug 124053)


Test case can be reduced to:
http://www.nfl.com/u/multimedia/live/football/nfl/nfl_tabs.htm
In this case crashing occurs at the same place:

#0  0x40661a74 in ?? () from /lib/i686/libc.so.6
#1  0x4066113a in ?? () from /lib/i686/libc.so.6
#2  0x42085789 in send_msg ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#3  0x4208da10 in jni_SecureNewObject ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#4  0x4207cc1e in CSecureJNIEnv::NewObject ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#5  0x41f7c86e in ProxyJNIEnv::NewObjectV (env=0x8721310, clazz=0x80be9ac, 
    methodID=0x85b70c8, args=0xbffff3f4) at ProxyJNI.cpp:467
#6  0x41f7c7aa in ProxyJNIEnv::NewObject (env=0x8721310, clazz=0x80be9ac, 
    methodID=0x85b70c8) at ProxyJNI.cpp:451
#7  0x4006bd28 in ?? () from /export/lsv/mozilla/dist/lib/libjsj.so
#8  0x40073219 in ?? () from /export/lsv/mozilla/dist/lib/libjsj.so
#9  0x4208e87b in JSObjectCall ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#10 0x4208ee3c in JSHandler ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#11 0x4208134d in JavaVM5::ProcessSpontaneousQueue ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#12 0x420802b7 in gdk_spont_event_handler ()
   from /usr/local/java/jdk1.3.1_01/jre/plugin/i386/ns600/libjavaplugin_oji.so
#13 0x4047fb46 in ?? () from /usr/lib/libgdk-1.2.so.0
#14 0x404b201e in ?? () from /usr/lib/libglib-1.2.so.0
#15 0x404b37f3 in ?? () from /usr/lib/libglib-1.2.so.0
#16 0x404b3dd9 in ?? () from /usr/lib/libglib-1.2.so.0
#17 0x404b3f8c in ?? () from /usr/lib/libglib-1.2.so.0
#18 0x403c8803 in ?? () from /usr/lib/libgtk-1.2.so.0
#19 0x4098dcc9 in ?? () from
/export/lsv/mozilla/dist/bin/components/libwidget_gtk.so
#20 0x4092c24d in ?? () from
/export/lsv/mozilla/dist/bin/components/libnsappshell.so
#21 0x08059825 in main1 (argc=2, argv=0xbffff99c, nativeApp=0x0)
    at nsAppRunner.cpp:1285
#22 0x0805a4bf in main (argc=2, argv=0xbffff99c) at nsAppRunner.cpp:1625
#23 0x405fe177 in ?? () from /lib/i686/libc.so.6

Maybe there is some problem in marshaling of arguments from/to java/js.
Sergey,

I note that your case uses Java 1.3.1_01.  Can you also reproduce this problem
with 1.4?  I tried to do so, on Solaris w/ 1.4 and 6.2.1-beta, but the applet
ran fine.  There is a substantial change in the code, indicated by the stack
trace, between the two versions.



Steve, I tried 6.2.1 with jre 1.4.0 on Linux: mozilla crashes.
I think this is Linux specific bug.

The stack trace for jre 1.4.0 is:

#0  0x4061a341 in ?? () from /lib/i686/libc.so.6
#1  0x4061a13a in ?? () from /lib/i686/libc.so.6
#2  0x41f90c49 in send_msg ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#3  0x41f98f70 in jni_SecureNewObject ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#4  0x41f8b5fe in CSecureJNIEnv::NewObject ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#5  0x41e91686 in ProxyJNIEnv::NewObjectV (env=0x85f8e80, clazz=0x81d6f0c, 
    methodID=0x88bb308, args=0xbffff2f8) at ProxyJNI.cpp:396
#6  0x41e915c2 in ProxyJNIEnv::NewObject (env=0x85f8e80, clazz=0x81d6f0c, 
    methodID=0x88bb308) at ProxyJNI.cpp:380
#7  0x40265d0c in jsj_ConvertJSValueToJavaObject (cx=0x85659e8, jEnv=0x85f8e80,
v=6, 
    signature=0x8845b38, cost=0xbffff380, java_value=0xbffff374, 
    is_local_refp=0xbffff37c) at jsj_convert.c:286
#8  0x4026d209 in nsCLiveconnect::Call (this=0x87eb928, jEnv=0x85f8e80,
obj=142996928, 
    name=0x88b6c80, length=9, java_args=0x4d6f2750, principalsArray=0x0, 
    numPrincipals=0, securitySupports=0x88ba888, pjobj=0xbffff3ec)
    at nsCLiveconnect.cpp:461
#9  0x41f99dc1 in JSObjectCall ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#10 0x41f9a3c3 in JSHandler ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#11 0x41f8f5c1 in JavaVM5::ProcessSpontaneousQueue ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#12 0x41f8e677 in spont_queue_processor ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#13 0x41f8afc6 in QueueRunnable::Run ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libjavaplugin_oji140.so
#14 0x41e85c76 in handleRunnableEvent (aEvent=0x8850538) at nsJVMManager.cpp:299
#15 0x401c200c in ?? () from /export/lsv/6.2.1/mozilla/dist/lib/libxpcom.so
#16 0x401c1e21 in ?? () from /export/lsv/6.2.1/mozilla/dist/lib/libxpcom.so
#17 0x401c40da in ?? () from /export/lsv/6.2.1/mozilla/dist/lib/libxpcom.so
#18 0x410a3e64 in ?? ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libwidget_gtk.so
#19 0x410a3a43 in ?? ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libwidget_gtk.so
#20 0x4046b01e in ?? () from /usr/lib/libglib-1.2.so.0
#21 0x4046c7f3 in ?? () from /usr/lib/libglib-1.2.so.0
#22 0x4046cdd9 in ?? () from /usr/lib/libglib-1.2.so.0
#23 0x4046cf8c in ?? () from /usr/lib/libglib-1.2.so.0
#24 0x40381803 in ?? () from /usr/lib/libgtk-1.2.so.0
#25 0x410a44d9 in ?? ()
#26 0x408866b5 in ?? ()
   from /export/lsv/6.2.1/mozilla/dist/bin/components/libnsappshell.so
#27 0x08059add in main1 (argc=2, argv=0xbffff9ac, nativeApp=0x0)
    at nsAppRunner.cpp:1304
#28 0x0805a7bf in main (argc=2, argv=0xbffff9ac) at nsAppRunner.cpp:1632
#29 0x405b7177 in ?? () from /lib/i686/libc.so.6

The stack trace I pointed in the previous comment is not the only one:
it's just most frequently occured. Actually the point of crashing
depends on user behaviour: mouse moving/nonmoving, maximazing/minimazing of
browser window etc.

The JRE 1.4.0 I used was: Java HotSpot(TM) Client VM (build 1.4.0-beta3-b84,
mixed mode).
priority to P1
Priority: -- → P1
Tried it with moz099 and JRE 1.4 (build 92) on Linux, the browser seemed to exit
(could not find the core). Running on Solaris (also moz099 and JRE 1.4_00 b05)
seemed to be fine, the box was loaded after clicking Cancel button.
So, this seems to be a Linux specific problem, as Serge said before.

Reporter, is it possible to generate a simplified test case, so we can debug
this problem?
This bug can't be reproducted on Windows 2000. On Solaris I use mozilla 1.0rc1 
with JRE1.4.1, this bug also not happen.

This bug happen on Linux 7.1, I use mozilla0.9.9 with jre1.4.0 on linux. The 
last message in Java Console window is:

OJIPlugin acq Spontaneous pipe=10
Trying to enter spont monitor: 0
 OJIPlugin release for:Thread[Finalizer,8,system]
OJIPlugin releasePipe - exiting spont monitor
Current thread:Thread[Thread-
10,4,http://www.nfl.com/u/multimedia/live/football/nfl/-threadGroup]
OJIPlugin: No AThread

OJIPlugin acq Spontaneous pipe=10
Trying to enter spont monitor: 0
                      PLUGIN ERROR 
                      ************ 
Java process: unexpected request ffffffff


And the mozilla crash

I will test it by using mozilla 0.9.9 with jre1.4.1 on Linux7.1

---------------------Sun China ERI-----------------------------------------
http://home.earthlink.net/~aaparker/monterey_bay_sar_welcome.htm
JAVA 1.31. OS/2. This site crashes Mozilla when loading JAVA applet. This site
works perfectly with Netscape 4.61 and JAVA 1.31.
Tried the test case with ns7.0 pr1 and JRE 1.4.0_01 on Linux, the browser still
seemed to hang or crash, with an exception in Java console:

"java.io.IOException: Caching not supported for http://live.nfl.com:2112/z.jar
	at sun.plugin.cache.CachedJarLoader.download(CachedJarLoader.java:323)
	at sun.plugin.cache.CachedJarLoader.load(CachedJarLoader.java:131)
	at sun.plugin.cache.JarCache.get(JarCache.java:177)
        ..."

From the core stack, the problem seemed to occur when Java plugin was sending a
message to JVM. 

Re-assign to Joshua for further investigation.
Assignee: joe.chou → joshua.xia
Another data point for you folks:

I get intermittent crashes under Windows 98 with version 1.3.1 of the JRE.
These crashes only occur when trying to launch a java applet, but they
don't always happen - I can have it crash when trying to view a particular
page, reboot, go back to the page and it works fine.

The crashes are very severe - the entire machine appears hung. I can't get
the task manager to come up, although hitting Ctrl-Alt-Del twice does still
restart the computer. No one else I've talked to has had this problem, but
they all run Win2K at this point.
Netscape 6.x + jre/jpi 1.4.x on Windows 2K work well (There are a lot of 
liveconnect between js and java, so Browser respond slowly and at last the page 
will be displayed).
I propose the OS change to ALL.  Comment #15 indicates it occurs on Windows
2000.  Comment #24 indicates it occurs on OS/2.  It also occurs for me on
EComStation (OS/2), Mozilla 1.1beta (build 2002073108), Java 1.3.1 (build 0731).

For me, it occurs when trying to access the calendar function of my employer's
MS-Exchange web interface.  I've duplicated it at        

     http://mozillatest.snakedance.org/112434/

I have just installed OS/2 Version 1.2a and this is STILL the same problem with
that version. Exactly the same as previous.
Add OS/2 to this bug if it is not included already (as I have previously
reported). Here is the crash log from this problem in OS/2, Mozilla version 1.2a

10-21-2002  10:29:24  SYS3176  PID 0027  TID 0007  Slot 007c
I:\MOZILLA12\MOZILLA.EXE
c000001c
068293bc
EAX=00000001  EBX=00000000  ECX=00000001  EDX=ffffffff
ESI=00000000  EDI=010cf650  
DS=0053  DSACC=d0f3  DSLIM=3fffffff  
ES=0053  ESACC=d0f3  ESLIM=3fffffff  
FS=150b  FSACC=00f3  FSLIM=00000030
GS=0000  GSACC=****  GSLIM=********
CS:EIP=005b:068293bc  CSACC=d0df  CSLIM=3fffffff
SS:ESP=0053:010cf638  SSACC=d0f3  SSLIM=3fffffff
EBP=010cf674  FLG=00012202

JITC.DLL


I can confirm this bug under Linux 2.4.19 with the latest Mozilla nightly build
or any of the releases going back prior to the 1.0 release. New or old profile.
It is present when using the Blackdown or Sun JDK; symlinked or copied lib.

I can reproduce this crash every time. Visit a Java-enabeled site with Java
enabled and Mozilla crashes immediately.

Tested on atleast four different computers.
according to comments #31, the java plugin must be installed uncorrectly
Confirm hang on Linux(RH8.0) mozilla1.2 JRE1.4.1_01
Keywords: crash, mozilla1.0 → hang, mozilla1.2
Java crashes Linux Mozilla 1.2.1 at a particular site:
http://www.thebrain.com/
I now have both jre2 1.4.1 and 1.4.0. The only plugin that works without
crashing is in 1.4.0 /plugin/i386/ns600. Neither plugin (ns600, ns610) works in
1.4.1 and ns610 in 1.4.1 seizes up the browser as well. Browser freezes on the
screen and has to be killed using 'ps f' to locate the process and 'kill XXX'.
Is this a Java problem or a Mozilla problem? I set up my plugins via a
symlink 'java.so' in the /mozilla/plugins/ directory to whichever one
I want. 
I am currently running Debian 2.2 r5 with a 2.2.19pre17 kernel.



can't reproduce this bug by using JRE1.4.2 beat-b16 and the latest Mozilla.
I'm using

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3) Gecko/20030313
/usr/java/j2re1.4.1_02/plugin/i386/ns610/libjavaplugin_oji.so

and this reproducible everytime!

1. go to http://www.shockwave.com/sw/content/dynomite
2. click on play game
3. wait for window to load
4. then it will crashes and closes all mozilla windows
please try the latest jre1.4.2-beta, this has been fixed in jre!
can't reproduce on Mozilla 1.5a
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5a) Gecko/20030617
+
jre1.4.2 build 27

->wfm
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → WORKSFORME
Confirmed fix. With jre1.4.2 and Mozilla1.3 on Linux, the original URL and all
links mentioned in comments ( except those that are out of date ) load
successfully. I'll try with the latest working 1.5a and then verify as resolved.
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: