286004 - Crash with tr:hover, td:hover position:fixed on this Java applet testcase

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect)

Description

[Martijn Wargers (dead)]

See upcoming testcase. the java .class file comes from the url I gave here above.

Talkback ID's:
TB4322254W, TB4321921G and TB4321837Z
They all show something different.

I actually don't know what the right component of this bug should be.

Comment 1

[Martijn Wargers (dead)]

Attachment: Java .class file for testcase

Comment 2

[Martijn Wargers (dead)]

Attachment: Testcase

Quickly hovering over the java file (or the text) should trigger the crash. (it
does for me within 10 times hovering over it).

Comment 3

[Martijn Wargers (dead)]

Hmm, forget about the testcase, the java file doesn't seem to run in bugzilla.
But this one works (and crashes Mozilla when quickly hovering over the applet): 
http://wargers.org/test/mozilla/crash/286004_java.htm

Comment 4

[Martijn Wargers (dead)]

Forgot to mention, it seems to have something to do with this applet, I haven't
been able to crash with a different applet.

Comment 5

[Martijn Wargers (dead)]

Also crashes Mozilla1.7 and Mozilla1.4.

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: java console log

Using Java 1.5.0_01, I can crash trunk sm as well although not consistently and
the stacks are all different. The attached java console log shows the initial
page load up through the liveconnect: the url... line 13. Afterwards the
console messages are for moving the mouse over the text/page rapidly. It
sometimes crashes at around the "basic: Done ..." lines.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Martijn, do you still crash if you use nested divs (with "div { position: fixed
}") instead of using a table?

Comment 8

[Martijn Wargers (dead)]

Yes, in fact only one div with div:hover{position:fixed} is enough for me to crash:
http://wargers.org/test/mozilla/crash/286004_java_div.htm

Comment 9

[Boris Zbarsky [:bzbarsky]]

Want to attach that to this bug?

I assume that's the same crash I see in a debug build unloading the testcase in
bug 283385...

Comment 10

[Boris Zbarsky [:bzbarsky]]

Oh, and this is totally views, looks like...

Comment 11

[Martijn Wargers (dead)]

Attachment: Testcase

Ok, this is the same testcase as mentioned in comment 8.
However, for me the Java applet won't load in the bugzilla url.

Comment 12

[Martijn Wargers (dead)]

The testcase don't crash directly anymore with 20050318 build (with the fix for
bug 283385 ), but they crash still when you close the tab or visit another url.

Comment 13

[Benjamin Smedberg]

See also bug 285982, bug 245692, bug 287034, bug 275783.

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Duplicate of bug 285996? We'll see when I land the patch

Comment 15

[Martijn Wargers (dead)]

This is not fixed with the fix for bug 285996.
I tried the testcase (at
http://wargers.org/test/mozilla/crash/286004_java_div.htm ) 3 times.
The first time I crashed on reload, the second time Mozilla hanged and the the
third time Mozilla closed directly on hovering.

Comment 16

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I just tried lots of hovering and clicking and reloading and it did not crash.

Comment 17

[Bernd]

Martijn, whats the status on this one?, wfm winxp 2005060306

Comment 18

[Martijn Wargers (dead)]

Sorry, because of some server issue all my files were wiped :-(
Like I said, you can only try to see if it crashes here:
http://wargers.org/test/mozilla/crash/286004_java_div.htm
The attached testcase at bugzilla won't work, because the Java applet won't load.
The current situation is that it still hangs/freezes my Firefox when quickly
hovering over the testcase. (in the status bar I get messages like "Applet
inited", "Applet started").

Comment 19

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Martijn, when I load that URL the page is not found.

Comment 20

[Martijn Wargers (dead)]

My provider accidently wiped out my webspace :(
The url should work again, now.

Comment 21

[Adam Guthrie]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20060519 Minefield/3.0a1

WFM with Java(TM) Plug-in 1.5.0_06-b05.

Comment 22

[Martijn Wargers (dead)]

I still am able to crash with a 2006-05-22 trunk build on winxp, using Java build build 1.5.0_06-b05.
Talkback ID: TB19056511Z
jpinscp.dll + 0x73a1 (0x6d4273a1)
PresShell::EnumeratePlugins   PresShell::Freeze   DocumentViewerImpl::Destroy   DocumentViewerImpl::Show   nsPresContext::EnsureVisible   nsPluginInstanceOwner::Init   nsObjectFrame::PrepareInstanceOwner   nsObjectLoadingContent::Instantiate   0x290a2ebc
0x0249c300
nsAccessibleWrap::AddRef   0x0a75c085
This was after hovering over the testcase a few times and then loading a new page.

Comment 23

[Martijn Wargers (dead)]

After updating to Version 1.5.0 (build 1.5.0_10-b03) of Java, I don't crash anymore with the testcase, so marking worksforme.