426565 - Firefox 3 crashes with Java applets

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Kenneth Russell]

It was discovered yesterday that recent Firefox 3 builds on Solaris/SPARC are crashing with the new Java Plug-In. At this point we do not know whether this is reproducible on all Unix platforms, just Solaris, or just Solaris on the SPARC architecture. The crash began occurring some time after March 18. The March 18 build works fine. The March 26 and current nightly build crash. There have been no changes to the Java Plug-In that would provoke such a crash. The current build of the new Java Plug-In can be downloaded from http://jdk6.dev.java.net/6uNea.html .

The Sun bug ID for this issue is 6682554: http://bugs.sun.com/view_bug.do?bug_id=6682554

Here is the stack trace from the core file:

(dbx) where
current thread: t@1
=>[1] __lwp_kill(0x0, 0xffffffff, 0x0, 0xff342a00, 0xfff7, 0x0), at 0xff0cab10 
  [2] raise(0xb, 0xffbfdd40, 0x0, 0x0, 0xfffffffc, 0x1), at 0xff07926c 
  [3] nsProfileLock::FatalSignalHandler(0xb, 0x2227ec, 0x6d0dc, 0x28, 0xfe9cff74, 0xfd5484c0), at 0xfd5486d8 
  [4] call_chained_handler(0xb, 0x2babf90, 0xffbfe2c0, 0xffbfe008, 0x2babf88, 0xf2632000), at 0xf2420b5c 
  [5] JVM_handle_solaris_signal(0xb, 0xffbfe2c0, 0xffbfe008, 0x1, 0x325e000, 0xfec618bc), at 0xf218b0b4 
  [6] __sighndlr(0xb, 0xffbfe2c0, 0xffbfe008, 0xf218a790, 0x0, 0x0), at 0xff0c5fa8 
  ---- called from signal handler with signal 11 (SIGSEGV) ------
  [7] PL_strncasecmp(0x2, 0xfe96a4ff, 0x10, 0xfe9cff74, 0xfff96ebc, 0x10000), at 0xfec618bc 
  [8] nsPluginNativeWindowGtk2::CanGetValueFromPlugin(0xfff9a545, 0x2c00, 0xfe96a4b9, 0x80000000, 0xfe9cff74, 0xfe016840), at 0xfe01f5b0 
  [9] nsPluginNativeWindowGtk2::CallSetWindow(0x41a42e0, 0xffbfe5a4, 0x0, 0x4, 0x41a42e0, 0xffbfe5a4), at 0xfe01f01c 
  [10] nsPluginHostImpl::InstantiateEmbeddedPlugin(0xce53c0, 0x145a8d0, 0x41a2108, 0x41a4040, 0x1, 0xffbfe624), at 0xfe007fd0 
  [11] nsObjectFrame::InstantiatePlugin(0x419f4d0, 0xce53c4, 0x145a8d0, 0x41a2108, 0x1360760, 0x4183620), at 0xfd828e14 
  [12] nsObjectFrame::Instantiate(0x419f4fc, 0x145a8d0, 0x41a2108, 0x80000000, 0x0, 0x419f4d0), at 0xfd82a82c 
  [13] nsObjectLoadingContent::Instantiate(0x41a1eb8, 0x419f4f8, 0xfebeb21c, 0xfd833454, 0x3400, 0x1), at 0xfd9f7bf4 
  [14] nsAsyncInstantiateEvent::Run(0x1456bd8, 0x1456be8, 0xfeb47584, 0x419f4f8, 0x419f4f8, 0x4183620), at 0xfd9f2024 
  [15] nsThread::ProcessNextEvent(0x6e3f0, 0x1, 0xffbfe9dc, 0x1, 0x6e408, 0x1), at 0xfe2c9b78 
  [16] NS_ProcessNextEvent_P(0xfe2c9a24, 0x1, 0xfebe9c8c, 0x50d4, 0x759ac0, 0x6e3f0), at 0xfe276454 
  [17] nsBaseAppShell::Run(0x3dc288, 0x1, 0x0, 0x6e3f0, 0x0, 0x0), at 0xfe1716e4 
  [18] nsAppStartup::Run(0xfe1716a4, 0xfebb7060, 0x1, 0xfebe5a88, 0x0, 0x424860), at 0xfdf55dd8 
  [19] XRE_main(0xfea3c3cc, 0xffbfeef8, 0xffbfef24, 0xffbfef4c, 0xfdf55da4, 0xffbfef7c), at 0xfd53fc8c 
  [20] main(0x1, 0xffbff0ac, 0xfffeff10, 0x22130, 0x43cb8, 0xffbff044), at 0x11b50

Comment 1

[Alfred Peng]

Attachment: patch v1

The new Java Plug-In doesn't pass the plugin description to Firefox. We need to initialize the value properly in Firefox side to avoid this crash. Anyway, this is also a bug for Java.

Comment 2

[timeless]

shouldn't you rv check pluginFactory->GetValue?

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 313328 [details] [diff] [review]
patch v1

r+sr=jst either with or w/o checking rv as well.

Comment 4

[Alfred Peng]

Comment on attachment 313328 [details] [diff] [review]
patch v1

This patch is quite safe. Ask for 1.9.

Comment 5

[Damon Sicore (:damons)]

Comment on attachment 313328 [details] [diff] [review]
patch v1

a1.9+=damons.  JST claims it's totally safe and completely untestable.

Comment 6

[Alfred Peng]

Checking in modules/plugin/base/src/nsPluginNativeWindowGtk2.cpp;
/cvsroot/mozilla/modules/plugin/base/src/nsPluginNativeWindowGtk2.cpp,v  <--  nsPluginNativeWindowGtk2.cpp
new revision: 1.12; previous revision: 1.11
done

=>FIXED