133762 - Using netscape.javascript.JSObject makes Mozilla freeze!

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java: OJI, defect)

Description

[Stephan Fuhrmann]

I tried a little test Applet with netscape.javascript.JSObject.

This applet reads over the JSObject facility some JavaScript variables and
writes them to a Java TextArea, visible in the Applet area.

The first call of the applet is ok. But when I hit the "reload" button, the
browser crashes.

Mozi Build ID is 2002031008 (0.99), JVM Version is 1.4.0-b92 from SUN.

The output of the first Applet run is quite as expected.

An attached zip file will contain the simple Applet that causes the crash / hang
of Mozi.

I hope this is the right component I'm addressing the bug to!

Comment 1

[Stephan Fuhrmann]

Attachment: Demonstration Applet for the Crash (ZIP Archive).

The ZIP file contains the Java Source, compiled Class file and two html files
to demonstrate the effect (one plain applet html file, and another object html
file, both using the JS.class file). Extract the files to a separate directory
(no dir will be created). 

The output of the applet should be something like

info / java
java.version=1.4.0
java.vm.version=1.4.0-b92
java.vm.vendor=Sun Microsystems Inc.
java.vm.name=Java HotSpot(TM) Client VM
java.specification.version=1.4
java.specification.vendor=Sun Microsystems Inc.
java.specification.name=Java Platform API Specification
javascript test beginnt
win obj == null : false
win obj ist : [object Window]
1+1 : 2.0
stringvar : hase
intvar : 10.0
javascript test endet

After hitting reload the browser should ;) crash.

Comment 2

[Stephan Fuhrmann]

Just one note. Netscape 6.2 crashes, too. Just thought you'd like to know ;).

Comment 3

[Tom Parker]

wfm, Build 2002031104, JRE 1.3.1_01

Comment 4

[Stephan Fuhrmann]

Tried it with JRE 1.4 and the new Release Candidate 1 for version 1.0 (build ID
2002041711). After several reloads the whole browser HANGS and doesn't react on
signals (SIGINT, ...).

Please note that this time I had to hit 'reload' several times. There has been a
talkback report created and sent away, I added the bug ID of this bug track.

Comment 5

[Jacob Kjome]

Have you tried the latest nightly builds?

I have a local applet that I've reloaded many times and it hasn't ever crashed.
 It uses JSObject to communicate with javascript and javascript makes calls back
to the applet as well.  No troubles except for the fact that javascript --> Java
communication does not work with the <object> tag, but does with the <applet> tag.

Jake

Comment 6

[Stephan Fuhrmann]

Tried with Mozi 1.0 RC 2 (build id 2002051009). Things are WORSE, Mozi crashes
(!!) when the test applet starts up and does the first things.

The quality feedback agent catched the thing... sent incident id is TB6274696G
and additional TB6274696G.

Would really like to see this fixed for relase 1.0 since it crashes mozilla.

Comment 7

[Jacob Kjome]

Ok, I did reproduce the crash in build 2002051404 on Win2k (sp2sr1) after 
downloading the testcase and running it on my own server.  I had to hit the 
reload button in rapid succession...not reallly allowing the page to ever load 
before it would crash.

Talkback ID:  TB6275939M

Actually, after it crashed, all attempts to load Mozilla are now crashing.  
Looks like this hoses up mozilla pretty bad.

I'd like to see this a a block to 1.0 as well.

Jake

Comment 8

[Jacob Kjome]

updated summary with CRASH keyword

Comment 9

[Jacob Kjome]

Just a note.  In comment 7 where I mentioned that after the crash, every 
restart of Mozilla crashed immediately.  It was remedied by deleting the bin 
directory and freshly unzipping a new one in its place.  So, the crash didn't 
corrupt my profile, which is what I was most worried about.

This should still be a blocker, though.  Mozilla can't go out with the poor 
Java support that is has right now and it certainly can't crash this easily.

Jake

Comment 10

[Stephan Fuhrmann]

Problem still exists in build 2002072204.

Comment 11

[Asaf Amit]

I have contacted the current assignee Igor Kushnirskiy 
<[e-mail]> and he replied :

	Hello there,

	This bug was created for wrong component. It should be moved to
	"OJI" from "Java to XPCOM Bridge".

	Could you please update the bug and reassing it to the default 
        engineer for the OJI component.

	Thanks,
		Igor


Therfore I re-assign the module upon his request.

Comment 12

[Jay Yan]

->Joshua and Jennifer.

Comment 13

[jian wen hao]

Testing this bug on Redhat Linux8.0 ,Solaris 5.9u2b9, windows2000,the result as
following:
Redhat Linux8.0 ,mozilla1.0.1,mozilla1.2, netscape7 
JRE: 1.4.0_03, 1.4.1
Test Result :the browser hang but no crash.

Terminal display some info like :
MOZILLA_FIVE_HOME=/home/hjw/netscape
  LD_LIBRARY_PATH=/home/hjw/netscape:/home/hjw/netscape/Cool
          LIBPATH=/home/hjw/netscape:/home/hjw/netscape/Cool
       SHLIB_PATH=/home/hjw/netscape:/home/hjw/netscape/Cool
      XPCS_HOME=/home/hjw/netscape/Cool
      MOZ_PROGRAM=./netscape-bin
      MOZ_TOOLKIT=
        moz_debug=0
     moz_debugger=
Warning: Cannot convert string "<Key>Escape,_Key_Cancel" to type VirtualBinding
Warning: Cannot convert string "<Key>Home,_Key_Begin" to type VirtualBinding
Warning: Cannot convert string "<Key>F1,_Key_Help" to type VirtualBinding
Warning: Cannot convert string "Shift<Key>F10,_Key_Menu" to type VirtualBinding
Warning: Cannot convert string "<Key>F10,Shift_Key_Menu" to type VirtualBinding
Warning: Cannot convert string "<Key>KP_Enter,_Key_Execute" to type VirtualBindi
ng
Warning: Cannot convert string "Alt<Key>Return,Alt_Key_KP_Enter" to type Virtual
Binding
Warning:
    Name: HorScrollBar
    Class: XmScrollBar
    The specified scrollbar value is greater than the maximum
    scrollbar value minus the scrollbar slider size.
Warning:
    Name: HorScrollBar
    Class: XmScrollBar
    The specified scrollbar value is greater than the maximum
    scrollbar value minus the scrollbar slider size.

The java console display some info:
Current thread:Thread[thread applet-JS,4,file:/root/test/-threadGroup]
OJIPlugin: No AThread

OJIPlugin acq Spontaneous pipe=10
Trying to enter spont monitor: 0
 OJIPlugin release for:Thread[thread applet-JS,4,file:/root/test/-threadGroup]
OJIPlugin releasePipe - exiting spont monitor
Current thread:Thread[thread applet-JS,4,file:/root/test/-threadGroup]
OJIPlugin: No AThread

Solaris5.9 mozilla1.2 jre 1.4.1 rc-b19
The applet runs correctly.

win2000 netscape7,mozilla 1.2 jre1.4.1
The applet runs correctly.
 

Comment 14

[Joshua Xia]

Stephan:

Would you like to use the lastest j2se 1.4.1?
We can't reproduce this bug.

Comment 15

[Stephan Fuhrmann]

Joshua,

I retried with Mozilla build ID 2002103010 and Java version 1.4.1_01.

The effect is that Mozilla hangs when trying to "reload" the applet page. Please
try hitting "reload" more often to reproduce the bug.
Java continues to work, but Mozilla is hanging.
Therefore, Mozilla doesn't crash anymore like reported at the beginning of the
bug, it just starts to hang endlessly.

Comment 16

[Joshua Xia]

I tested this bug, Mozilla hanged on Linux but run well on Solaris.
Mozilla's implemention on linux is almost same to on Solaris,
but JPI is not same. Is there some wrong with JPI?
Go on investigate.

Comment 17

[Pete Zha]

Remove crash keywords and summary per comment 15

Comment 18

[Adrian Sutton]

This also occurs if the applet calls a javascript function that redirects to 
another page or submits a form.

Also occurred on one test when first loading the page via the command line:

mozilla http://boardroom/applet.html

Finally, it seems to occur when using the back and forward buttons to move 
between the test page and another page (without any applets).

Comment 19

[Robert O'Callahan (:roc) (email my personal email if necessary)]

This looks bad. Please fix it for 1.3final, but we won't wait for it for 1.3beta.

Comment 20

[Adrian Sutton]

This is a very long standing bug which is marked critical, I hate to pester but 
is anyone working on a fix for this or is JSObject support just silently being 
dropped on Linux?

Comment 21

[Joshua Xia]

->kyle

Comment 22

[Kyle Yuan]

I can't reproduce this using Mozilla 1.4 + JRE 1.4.2_02 both on Windows 2000 &
Linux (SuSE8.1).

Comment 23

[Jason]

Attachment: IE6 Java console logs for Hushmail.com login process

Comment 24

[Jason]

Attachment: Mozilla 1.4 Java console logs for Hushmail.com

Comment 25

[Jason]

On Windows XP and Windows 2000
Using Mozilla 1.4, 1.6, Firefox 0.7 and 0.8
Java(TM) Plug-in: Version 1.4.2_03
Using JRE version 1.4.2_03 Java HotSpot(TM) Client VM

This bug seems to affect the email provider www.hushmail.com
An applet that is loaded as part of the login process hangs while calling the
JSObject::eval(window.onAppletLoaded() function. I have attached the Java
console logs for Mozilla 1.4 and IE6. Where IE6 successfully uses JSObject,
Mozilla hangs and repeatedly logs:

IE
Feb 29, 2004 10:05:11 AM sun.plugin.util.PluginLogger log
INFO: Checking if certificate is in JPI permanent certificate store
Hush Encryption Engine Version 2.4.0.22
Invoking JS method: execScript
Feb 29, 2004 10:07:11 AM sun.plugin.util.PluginLogger log
INFO: Invoking JS method: execScript
Invoking JS method: evalIntermediateValueToReturn
Feb 29, 2004 10:07:11 AM sun.plugin.util.PluginLogger log
INFO: Invoking JS method: evalIntermediateValueToReturn
Stopping applet ...

Mozilla
Feb 29, 2004 9:52:07 AM sun.plugin.util.PluginLogger log
INFO: JavaScript: UniversalJavaPermission enabled
JSObject::eval(window.onAppletLoaded()), url=https://mailserver2.hushmail.com,
permission=true
Feb 29, 2004 9:52:07 AM sun.plugin.util.PluginLogger log
INFO: JSObject::eval(window.onAppletLoaded()),
url=https://mailserver2.hushmail.com, permission=true
JavaScript: calling Java system code
Feb 29, 2004 9:52:07 AM sun.plugin.util.PluginLogger log
INFO: JavaScript: calling Java system code
JavaScript: default security policy = https://mailserver2.hushmail.com
...

According to the Java console logs, the applet enters an infinite loop trying to
retrieve the return value from this function. The applet/browser utilizes 100%
cpu and eventually times out (~15 min on AMD 1.9GHz, ~1 hour on PIII 700Mhz).
The rest of the login process continues normally.

Steps to reproduce:
Use the test case already attached to this bug or...
1. https://www.hushmail.com
2. Open Java console, enable logging and set trace level to 5.
3. Enter username and log in.
4. Applet is loaded and hangs.
5. Wait until applet times out and login continues or forcefully kill browser.

Comment 26

[Kyle Yuan]

Regarding comment #25, I don't think it is the same problem as the orginal filed
bug. Please confirm that and if it is different bug, please file another bug.