270834 - Crash after closing www.hifx.com or Java console in or loading again after close [@ nsXPCWrappedJSClass::GetInterfaceName ]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java: Live Connect, defect)

Description

[Hermann Schwab]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041118
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041118

Sun Java 1.5, java.runtime.version = 1.5.0-b64


When I open the page on Win98, it sometimes hangs, but Win98 isn´t recommended
for  Java 1.5. When I closed the page, Liveconnect was still running in the
JavaConsole (Tracelevel 5). After third push of the 'Clear' Button, Mozilla crashed.
TB2039067E  JPINSCP.DLL + 0x2a96 (0x6d422a96) da2fb27a

Testing on a Win98SE system, JavaConsole opens automatically, I set tracelevel
to 2 or 5:

TB2056158Q, TB2055826Y, TB2055657X

Seen Liveconnect running after I closed page, crash on closing the console.
crash on setting tracelevel in console
Closed page by going back to a bugzilla bug, closed Java Console, crash when
loading URL again.
Talkback wasn´t always coming up.

Link to these Talkbacks marked by URL:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=url&match=contains&searchfor=hifx.com&vendor=All&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid



Reproducible: Always
Steps to Reproduce:
1.open page
2.open Java Console, click there, enter 2 or 5 to set trace level
3.watch liveconnect in console
4.look at page if rendered complete
5.close page
6.watch console
7.close console

Actual Results:  
crashes, sometimes Liveconnect went on after page was closed.

Expected Results:  
not crash

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

nsScriptSecurityManager::GetScriptPrincipal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 1819]
nsScriptSecurityManager::GetFramePrincipal 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 1868]
nsScriptSecurityManager::IsCapabilityEnabled 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/caps/src/nsScriptSecurityManager.cpp,
line 2062]
nsWindowWatcher::CalculateChromeFlags 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 1313]
nsWindowWatcher::OpenWindowJS 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 524]
nsWindowWatcher::OpenWindow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/embedding/components/windowwatcher/src/nsWindowWatcher.cpp,
line 460]
nsNativeAppSupportWin::OpenWindow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsNativeAppSupportWin.cpp,
line 2153]
nsNativeAppSupportWin::OpenBrowserWindow 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsNativeAppSupportWin.cpp,
line 2326]
nsNativeAppSupportWin::HandleRequest 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsNativeAppSupportWin.cpp,
line 1773]
MessageWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsNativeAppSupportWin.cpp,
line 877]
USER32.dll + 0x8709 (0x77d48709)
USER32.dll + 0x87eb (0x77d487eb)
USER32.dll + 0xb368 (0x77d4b368)
USER32.dll + 0x2f575 (0x77d6f575)
ntdll.dll + 0xeae3 (0x7c90eae3)
USER32.dll + 0x93df (0x77d493df)
PeekKeyAndIMEMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 91]
nsAppShell::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 138]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 216]
main1 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1331]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1802]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1828]
WinMainCRTStartup()
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Tuukka Tolvanen (sp3000)]

Crashed on linux using fx1.0 and m1.8a4 as well, with
    INTERNAL ERROR on Browser End: Did not understand spontaneous code 20
    System error?:: Onnistui
(                   ^^^^^^^^ = Success)

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Sorry, all.  Pasted that too soon ;-(

I also see
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB2057907M

FindNamedItems

So I'll remove the stack I put into the summary, sorry.

Comment 4

[OstGote!]

Perhaps related to Bug 246892?

sample crash stack from comment 0 reports

Incident ID: 3421190
Stack Signature	nsXPCWrappedJSClass::GetInterfaceName 40e6503e
Product ID	Firefox10
Build ID	2004080301
Trigger Time	2005-02-01 01:09:43.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766446
Module	FIREFOX.EXE + (000244e0)
URL visited	http://www.hifx.com
User Comments	
Since Last Crash	425129 sec
Total Uptime	2461566 sec
Trigger Reason	Access violation
Source File, Line No.
d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1591
Stack Trace 	
nsXPCWrappedJSClass::GetInterfaceName 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjsclass.cpp,
line 1591]
nsXPCWrappedJS::CallMethod 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappedjs.cpp,
line 450]
SharedStub 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp,
line 147]
RDFXMLDataSourceImpl::EndLoad 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/rdf/base/src/nsRDFXMLDataSource.cpp,
line 1072]
RDFContentSinkImpl::DidBuildModel 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/rdf/base/src/nsRDFContentSink.cpp,
line 670]
CNavDTD::DidBuildModel 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/CNavDTD.cpp,
line 707]
nsParser::DidBuildModel 
[d:/builds/tinderbox/firefox-0.9.3/WINNT_5.0_Clobber/mozilla/htmlparser/src/nsParser.cpp,
line 1245]
0x8f000000

Comment 5

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050313
Java Plug-in 1.5.0_01 for Netscape Navigator (DLL Helper)


crashed Win98SE on test URL, talkback came after reboot, when I started Mozilla.
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4324026W

Stack Trace  	
0x6d42511e
js_GC 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line
1919]
js_ForceGC 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/js/src/jsgc.c, line
1486]
nsAppStartup::Run 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/components/startup/src/nsAppStartup.cpp,
line 208]
main 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1817]
WinMain 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpfe/bootstrap/nsAppRunner.cpp,
line 1841]
KERNEL32.DLL + 0x1b560 (0xbff8b560)
KERNEL32.DLL + 0x1b412 (0xbff8b412)
KERNEL32.DLL + 0x19dd5 (0xbff89dd5)

Comment 6

[Hermann Schwab]

Attachment: reduced testcase, should crash

when testing, have JS and Java enabled. I´m crashing or hanging with current
Java 1.5.0_01, if crashing, windows crashs, doesn´t matter if Win98 SP1 128MB,
or Win98SE 512 MB RAM. When hanging, Mozilla closes, but but still is seen in
sysinternals.com procexp.exe, using more than 90% cpu on a slow Celeron 333.
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml nice freeware

Comment 7

[Hermann Schwab]

crash Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050625
Java(TM) 2 Platform Standard Edition 5.0 Update 4

testcase didn´t seem to be live, so I tested http://www.hifx.com/index.asp and
got more numbers filled in. After closing the tab, Java console was still
connected. I closed Java console, and when I reopened, Liveconnect was still
running, CPU load at 100% on a slow celeron 333. I clicked a bit on the Java
icon, and Javaws.exe was asking the firewall for access to the internet. I
denied, Mozilla crashed.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB6991453Z

Trigger Reason	Access violation
Stack Trace  	
JPINSCP.DLL + 0x2a3b (0x6d422a3b)
JPINSCP.DLL + 0x7e8f (0x6d427e8f)
JPINSCP.DLL + 0x8605 (0x6d428605)
0x778b0c24

Comment 8

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20050901 SeaMonkey/1.1a
Java(TM) 2 Platform Standard Edition 5.0 Update 4
hanging on Deerpark, crashing on Seamonkey

Steps to repeat:
1. Load http://www.hifx.com/index.asp in a new tab
2. delete tab
3. back to step 1

or:
1. Load http://www.hifx.com/index.asp in a new tab
2. open the 'more' link of the applet in a new tab
3. close that tab.

After hanging on Deerpark, I also got hanging in Seamonkey.

TB8942524K
TB8946867H
JPINSCP.DLL + 0x2a3b (0x6d422a3b)
JPINSCP.DLL + 0x7e8f (0x6d427e8f)
JPINSCP.DLL + 0x8605 (0x6d428605)
0x778b0c24

Same signature seen in Bug 295926 comment 14: TB8805465Q

Comment 9

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.9a1) Gecko/20051002 SeaMonkey/1.1a
Java(TM) 2 Platform Standard Edition 5.0 Update 5

couldn't reproduce crash using steps to repeat from comment 8, but also don't
see activity in the tables, testcase doesn't show rates, but I don't remember if
testcase was showing rates. Maybe crash can't be reproduced on weekends, when
trading is inactive.

Comment 10

[Hermann Schwab]

(In reply to comment #9)

Java(TM) 2 Platform Standard Edition 5.0 Update 5

> couldn't reproduce crash using steps to repeat from comment 8, but also don't
> see activity in the tables, 

retested today on same system using FirefoxTrunk, saw activity in the tables and
got a hang (100%CPU), had to abort Firefox, as I did a bigger download with Mozilla.

Comment 11

[Ronald Tilby]

URL and Testcases WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060601 Minefield/3.0a1 ID:2006060105 [cairo]

Comment 12

[Hermann Schwab]

(In reply to comment #11)
> URL and Testcases WFM using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
> rv:1.9a1) Gecko/20060601 Minefield/3.0a1 ID:2006060105 [cairo]

It also was WFM in comment #9, as there was no activity seen on the weekend,  
but I got a hang later in comment #10 using JRE 1.5.0_05.

Ron, which version of Java are you using? 
(type about:plugins into the location bar) 

Comment 13

[Wayne Mery (:wsmwk)]

WFM comment 8 testcase. multiple attempts against all 3 "more" links on the page

java 1.5.0_10
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
did not test seamonkey

also, nsxpcwrappedjsclass::getinterfacename crashers on talkback are all 1.7, none 1.8 branch or 1.9

STM this is gone.

Comment 14

[Ronald Tilby]

Testcase wfm using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070215 Firefox/2.0.0.2 ID:2007021518
and Java(TM) 2 Platform Standard Edition 5.0 Update 10

Comment 15

[Wayne Mery (:wsmwk)]

-> WFM