165097 - Mozilla crashes (and disappears) when loading the applet on this page (I think)

Status: RESOLVED DUPLICATE of bug 160602

(SeaMonkey :: General, defect)

Description

[Lincoln Ramsay]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826

Mozilla dies with the following error:
The instruction at "0x77f82dd2" referenced memory at "0x39393929". The memory
could not be "read".

Sometimes it just disappears quietly.


Reproducible: Always

Steps to Reproduce:
1. Make sure you have Java 1.3.1 plugin (also affects Java 1.3.1_01 plugin)
2. Open the URL above

Actual Results:  
All mozilla windows disappear and an error message may be shown. It's an 'OK
only' error message.

Expected Results:  
Loaded the applet. Maybe barfed but mozilla should not have just crashed.


I'll test this on Mozilla 1.0 to see if it's a regression problem.

Comment 1

[Lincoln Ramsay]

I couldn't get it to crash Mozilla 1.0 so I guess it's a regression bug. The
instruction address and the referenced memory address seem to be constant if
that helps (ie. they have the same values every time it crashes on me).

I suspect that the following code from the page is causing the problem (it's a
dodgy 1x2 pixel applet).

<script language="JavaScript"><!--
if(w0){
var imgN='<img src="http://server-au.imrworldwide.com/cgi-bin/count?ref='+
	refR+'&cid='+pCid+'" width=1 height=1>';
if(navigator.userAgent.indexOf('Mac')!=-1){document.write(imgN);
}else{
	document.write('<applet code="Measure.class" '+
	'codebase="http://server-au.imrworldwide.com/"'+'width=1 height=2>'+
	'<param name="ref" value="'+refR+'">'+'<param name="cid" value="'+pCid+
	'"><textflow>'+imgN+'</textflow></applet>');
	}
}
document.write("<COMMENT>");
//-->
</script>

Comment 2

[Lincoln Ramsay]

AARRGGHH!!

Slashdot is crashing Moz 1.1 with the same error as above today.

I'm going back to 1.0 (at least it is stable).

Comment 3

[Frederic Bezies]

WFM - trunk build 2002083008 - WinXP - JRE 1.4.0_01

Reporter : can you try with a younger JRE ?

Thanks.

Comment 4

[Olav Vitters]

*** This bug has been marked as a duplicate of 160602 ***