83581 - Trunk crash loading java applet [@ 0x00000000 - js_LookupProperty]

Status: VERIFIED WORKSFORME

(Core Graveyard :: Java: OJI, defect, P1)

Description

[Jay Patel [:jay]]

Talkback has reported quite of few crashes in recent Trunk builds, most of them
are crashes with Windows 2K.  Here are some entries with user comments
and urls:

0x00000000 006a9377
	 line 
	Build: 2001053006 CrashDate: 2001-05-30 UptimeMinutes: 422  Total: 422 
	OS: Windows NT  5.0 build 2195
	 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31115054
StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31115054
(31115054)
Comments: Crash loading a page with a Java applet.

0x00000000 e9377457
	 line 
	Build: 2001052909 CrashDate: 2001-05-30 UptimeMinutes: 14  Total: 32 
	OS: Windows NT  5.0 build 2195
	 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31084857
StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31084857
(31084857)
URL: http://my.sonicwall.com
(31084857)
Comments: Logging in to a Sonicwall Firewall admin web page. This uses a Java
applet to encrypt the password

0x00000000 e9377457
	 line 
	Build: 2001052909 CrashDate: 2001-05-30 UptimeMinutes: 18  Total: 18 
	OS: Windows NT  5.0 build 2195
	 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31084853
StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31084853
(31084853)
Comments: Logging in to a Sonicwall Firewall admin web page. This uses a Java
applet to encrypt the password

0x00000000 b3c4d646
	 line 
	Build: 2001052909 CrashDate: 2001-05-29 UptimeMinutes: 47  Total: 47 
	OS: Windows NT  4.0 build 1381
	 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31069717
StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31069717
(31069717)
Comments: Testing Java Plug-in 1.4.0 (Beta)

And the stack trace:

Incident ID 31115054
0x00000000
js_LookupProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2183]
js_GetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2336]
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2541]
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825]
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897]
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3322]
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 937]
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140]
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1120]
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1793]
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 600]
DocumentViewerImpl::LoadComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1116]
nsDocShell::EndPageLoad
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3630]
nsWebShell::EndPageLoad
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 902]
nsDocShell::OnStateChange
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3551]
nsDocLoaderImpl::FireOnStateChange
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1096]
nsDocLoaderImpl::doStopDocumentLoad
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 735]
nsDocLoaderImpl::DocLoaderIsEmpty
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 633]
nsDocLoaderImpl::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 564]
nsLoadGroup::RemoveRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 517]
PresShell::RemoveDummyLayoutRequest
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 6049]
PresShell::ProcessReflowCommands
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5779]
ReflowEvent::HandleEvent
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 5625]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 418]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1135]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1429]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1447]
WinMainCRTStartup()
KERNEL32.DLL + 0x17d08 (0x77e97d08)

Comment 1

[Jay Patel [:jay]]

Adding crash, topcrash keywords and [@ 0x00000000 - js_LookupProperty] to
summary for tracking.

Comment 2

[Phil Schwartau]

All the reports given above involve Plug-ins or applets, and therefore
would be best diagnosed by the the OJI (or Plug-ins) component. 
Where the stack trace ends (js_LookupProperty) is not what's going wrong.
It's what's happening earlier in the trace - 

Note this part of the trace indicates some DOM event immediately after 
EndPageLoad that is somehow leading to trouble: 

GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 600]
DocumentViewerImpl::LoadComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1116]
nsDocShell::EndPageLoad


Reassigning to OJI for further triage. Is there anything currently 
going wrong with Plug-ins or applets that would be causing this problem? 

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Is there a JSClass somewhere with a null |resolve| member?

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

A bunch of the JSClass objects in liveconnect have NULL members for members that
are required to be non-null (and for which stubs are available, I think):

http://lxr.mozilla.org/seamonkey/source/js/src/liveconnect/jsj_JavaArray.c#444
http://lxr.mozilla.org/seamonkey/source/js/src/liveconnect/jsj_JavaClass.c#576
http://lxr.mozilla.org/seamonkey/source/js/src/liveconnect/jsj_JavaObject.c#930

Is this code used?  If so, it seems like it could be the cause of this crash.

Comment 5

[Patrick C. Beard]

This code is used if an applet uses netscape.javascript.JSObject Java classes 
(LiveConnect). jband has patches to fix related problems in bug #78428 and bug # 
82034.

Comment 6

[edburns]

Thanks for the tip, Patrick.

Comment 7

[edburns]

I've tried to get myself a userid on My Sonic Wall, but I cannot.  Can someone 
please provide a test id and reopen this bug?

Thanks,

Ed

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I've pointed out a mistake in the code that would cause exactly the crash that's
shown on talkback, I think.  Reopening.

Comment 9

[Phil Schwartau]

I have set up a dummy account at http://my.sonicwall.com 

UserID:   mozilla_bugzilla
Password: bugzilla

Comment 10

[Phil Schwartau]

OK, recent Mozilla builds seem to impose upper-case when you go to
http://my.sonicwall.com and try to log in. But the UserID and password
I set up are in lower-case. If that happens to you, try this URL instead:

 https://www.mysonicwall.com/Login.asp?RC=FFBCDB72855B&US=mozilla_bugzilla

Try to use the password here -  "bugzilla"

Comment 11

[edburns]

I'm able to login using the userid and password provided, but there doesn't 
appear to be any java in the site.  MARKING INVALID.

Comment 12

[edburns]

I can't get it to crash.  I see no java on the site.

Comment 13

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Reopening, because, while two of the three places I pointed out above have been
fixed,
http://lxr.mozilla.org/seamonkey/source/js/src/liveconnect/jsj_JavaClass.c#576
has not yet been fixed.

Comment 14

[Angela Butler]

Any status on fixing the remaining problem?

Comment 15

[edburns]

Attachment: cvs diff -u to replace some NULL members where prototypes exist.

Comment 16

[edburns]

Hello Alexei,

Can you please try this on win2000?  I can't get it to crash on winNT.  I've 
asked JBand for a patch.  If he gives it to me I'll ask you to apply it to your 
tree and see if it still crashes.

Thanks,

Ed

Comment 17

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

That still leaves some mandatory non-NULL members as null.

Comment 18

[John Bandhauer]

Has anyone actually seen any crash in this code since the bug 82034 was fixed? 
Those jsclass function callbacks should simply not matter because these classes 
have their own JSOps handlers. See my comments in bug 82034.

Comment 19

[edburns]

I have not seen the crash.  I've asked my QA Engineer to try to replicate it 
and get back to me.  Alexei, if we can close this as WORKSFORME, please let me 
know.

Comment 20

[Alexei V. Mokeev]

Tested today with jre1.4.0-beta, Win2000 and recent build(2001072303)
Do not see any crash during/after loading site my.sonicwall.com and entering
with id/passwd 

Reassign back to Ed.

Comment 21

[edburns]

DBARON: would you object to closing this as WORKSFORME?

Comment 22

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

No problem, considering jband's comment.

Comment 23

[edburns]

WORKSFORME

Comment 24

[shrirang khanzode]

SPAM: reassigning OJI bugs to new QA, pmac. (227 bugs)

Comment 25

[Patty Mac]

I'm able to login using the userid and password provided, but there doesn't 
appear to be any java in the site. Marking invalid.
(using the commercial trunk: 2001-08-28-03-trunk) on windows 2000.