166383 - [crash] BBC News crashes mozilla 1.1 (always)

Status: RESOLVED DUPLICATE of bug 154699

(Core Graveyard :: Java: OJI, defect)

Description

[jay ball]

my system:

Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.1) Gecko/20020826

going to BBC today (2002-09-03) causes mozilla to crash, always.  can be
replicated easily.  i'll download the page with a different browser and attach it.

Comment 1

[jay ball]

It also crashes Chimera 0.4.  

Please note that i have a cookie set to "i don't live in the UK" which produces
a different web page from just clicking on "world" or going to the main UK page.
 Thus, no crash in some cases.

Attached is the MSIE web archive of the entire thing.  i hope that helps.  i
also attached just the plain html of the page.

Comment 2

[jay ball]

Attachment: MSIE Web Archive format of site that crashed mozilla 1.1

Comment 3

[jay ball]

Attachment: html only of the page which crashes mozilla 1.1

Comment 4

[jay ball]

the html itself does not crash mozilla, but the html in conjunction with
something else on the site (javascript, java, images, ???) causes the crash.  I
have no idea what the problem could be, but thought it needed reporting and
archiving before BBC updates the site (as news sites so often do ;-).

Comment 5

[R.K.Aa.]

there is a Java ticker on the page. Likely dup of bug 154699.

Comment 6

[jay ball]

it worked in the past, like everyday since i've upgraded to 1.1.  but, i do
think perhaps you're right.

here is the osx crash log (i forgot the logs existed, duh).  notice the thread
that crashes has lots of JVM_* calls on the stack.  Since the bug 154699 says it
was not fixed in time for 1.1.0, then this could be a dup.   If so, please, mark
as such Asa.  

Date/Time:  2002-09-03 12:26:16 -0400
OS Version: 10.2 (Build 6C115)
Host:       spam-o-matic.local.

Command:    Mozilla
PID:        2263

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000034

Thread 0:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x9283ddf4 in JVM_NewInstance
 #3   0x9284ee30 in JVM_GetCPMethodClassNameUTF
 #4   0x92861a94 in JVM_Send
 #5   0x9285eb14 in JVM_FillInStackTrace
 #6   0x92868468 in JVM_DoPrivileged
 #7   0x9288e0e0 in JVM_GetMethodIxExceptionTableEntry
 #8   0x92883e80 in JVM_DefineClass
 #9   0x929ba848 in eh_rest_world_r10
 #10  0x928499b8 in __moddi3
 #11  0x928af2cc in JVM_IsNaN
 #12  0x05332c90 in 0x5332c90
 #13  0x05340d90 in 0x5340d90
 #14  0x0533fdcc in 0x533fdcc
 #15  0x05341f08 in 0x5341f08
 #16  0x05334e60 in 0x5334e60
 #17  0x0523268c in 0x523268c
 #18  0x0523268c in 0x523268c
 #19  0x052325cc in 0x52325cc
 #20  0x052325cc in 0x52325cc
 #21  0x052325cc in 0x52325cc
 #22  0x052325cc in 0x52325cc
 #23  0xa2843c38 in typeinfo name for std::bad_exception
 #24  0x92838bdc in JVM_CurrentTimeMillis
 #25  0x92872ed4 in JVM_GetCPClassNameUTF
 #26  0x92865c80 in JVM_DoPrivileged
 #27  0x05234668 in 0x5234668
 #28  0x052325cc in 0x52325cc
 #29  0xa2843c38 in typeinfo name for std::bad_exception
 #30  0x92838bdc in JVM_CurrentTimeMillis
 #31  0x92872ed4 in JVM_GetCPClassNameUTF
 #32  0x9288f144 in JVM_MonitorNotifyAll
 #33  0x9285fd68 in JVM_GetCPFieldSignatureUTF
 #34  0x92844a98 in JVM_GetClassLoader
 #35  0x92875e64 in JVM_GetCPClassNameUTF
 #36  0x9288199c in JVM_DefineClass
 #37  0x92869ed4 in JVM_DoPrivileged
 #38  0x928480dc in __moddi3
 #39  0x0523ad7c in 0x523ad7c
 #40  0xa2843c38 in typeinfo name for std::bad_exception
 #41  0x92838bdc in JVM_CurrentTimeMillis
 #42  0x92872ed4 in JVM_GetCPClassNameUTF
 #43  0x9288f144 in JVM_MonitorNotifyAll
 #44  0x9285fd68 in JVM_GetCPFieldSignatureUTF
 #45  0x92844a98 in JVM_GetClassLoader
 #46  0x9285fc40 in JVM_GetCPFieldSignatureUTF
 #47  0x92844a98 in JVM_GetClassLoader
 #48  0x9285fc40 in JVM_GetCPFieldSignatureUTF
 #49  0x92844a98 in JVM_GetClassLoader
 #50  0x9285fc40 in JVM_GetCPFieldSignatureUTF
 #51  0x92844a98 in JVM_GetClassLoader
 #52  0x9285fc40 in JVM_GetCPFieldSignatureUTF
 #53  0x92844a98 in JVM_GetClassLoader
 #54  0x928452e8 in JVM_GetMethodIxExceptionTableLength
 #55  0x928a22c4 in JVM_Close
 #56  0x8cfd23e4 in
com_apple_mrj_JavaEmbedding_JE_AppletViewer::intitializeMethodIDs(JNIEnv_*)
 #57  0x8cfd1dec in intitializeAllMethodIDs(JNIEnv_*)
 #58  0x8cfd3068 in InitJavaEmbedding(JNIEnv_*&)
 #59  0x8cfd57d4 in CreateJavaApplet
 #60  0x02ec7734 in MRJContext::loadApplet(void)
 #61  0x02ec8298 in MRJContext::setWindow(nsPluginWindow *)
 #62  0x02ec3ea4 in MRJPluginInstance::SetWindow(nsPluginWindow *)
 #63  0x02c0ebec in InstantiateEmbededPlugin__16nsPluginHostImplFPCcP6nsIURIP22nsI
 #64  0x03304124 in InstantiatePlugin__13nsObjectFrameFP14nsIPresContextR19nsHTMLR
 #65  0x03302e28 in 0x3302e28
 #66  0x03339c24 in 0x3339c24
 #67  0x03332c58 in 0x3332c58
 #68  0x03332938 in DoReflowInlineFrames__12nsBlockFrameFR18nsBlockReflowStateR12n
 #69  0x033325f8 in nsBlockFrame::DoReflowInlineFramesAuto(nsBlockReflowState &)
 #70  0x03332378 in ReflowInlineFrames__12nsBlockFrameFR18nsBlockReflowState19nsLi
 #71  0x03330578 in ReflowLine__12nsBlockFrameFR18nsBlockReflowState19nsLineList_i
 #72  0x0332fb34 in 0x332fb34
 #73  0x0332de3c in 0x332de3c
 #74  0x03356db8 in DoReflowBlock__20nsBlockReflowContextFR17nsHTMLReflowState14ns
 #75  0x03356818 in ReflowBlock__20nsBlockReflowContextFP8nsIFrameRC6nsRectiR18nsC
 #76  0x03331cac in 0x3331cac
 #77  0x0333019c in 0x333019c
 #78  0x0332fb34 in 0x332fb34
 #79  0x0332de3c in 0x332de3c
 #80  0x0328991c in ReflowChild__16nsContainerFrameFP8nsIFrameP14nsIPresContextR19
 #81  0x0342d2f4 in CanvasFrame::Reflow(nsIPresContext *, nsHTMLReflowMetrics &,  &)
 #82  0x033ea2a0 in Reflow__19nsBoxToBlockAdaptorFR16nsBoxLayoutStateP14nsIPresCon
 #83  0x033e9c8c in nsBoxToBlockAdaptor::DoLayout(nsBoxLayoutState &)
 #84  0x033e481c in nsBox::Layout(nsBoxLayoutState &)
 #85  0x034165cc in 0x34165cc
 #86  0x033e481c in nsBox::Layout(nsBoxLayoutState &)
 #87  0x033a50a4 in nsBoxFrame::Reflow(nsIPresContext *, nsHTMLReflowMetrics &,
 const &)
 #88  0x0328991c in ReflowChild__16nsContainerFrameFP8nsIFrameP14nsIPresContextR19
 #89  0x03374578 in Reflow__13ViewportFrameFP14nsIPresContextR19nsHTMLReflowMetric
 #90  0x0329e3f8 in Dispatch__17IncrementalReflowFP14nsIPresContextR19nsHTMLReflow
 #91  0x032af40c in PresShell::ProcessReflowCommands(int)
 #92  0x032aedc4 in HandlePLEvent(ReflowEvent *)
 #93  0x002ce070 in PL_HandleEvent
 #94  0x002cdedc in PL_ProcessPendingEvents
 #95  0x00274efc in nsEventQueueImpl::ProcessPendingEvents(void)
 #96  0x022d9c5c in nsMacNSPREventQueueHandler::ProcessPLEventQueue(void)
 #97  0x022d9b00 in nsMacNSPREventQueueHandler::RepeatAction(EventRecord const &)
 #98  0x02144b14 in Repeater::DoRepeaters(EventRecord const &)
 #99  0x022f0218 in nsMacMessagePump::DispatchEvent(int, EventRecord *)
 #100 0x022eff40 in nsMacMessagePump::DoMessagePump(void)
 #101 0x022ef8bc in nsAppShell::Run(void)
 #102 0x022ac53c in nsAppShellService::Run(void)
 #103 0x001a400c in main1(int, char **, nsISupports *)
 #104 0x001a4a4c in main

Thread 1:
 #0   0x9000582c in syscall
 #1   0x90515d9c in BSD_waitevent
 #2   0x9051576c in CarbonSelectThreadFunc
 #3   0x90021428 in _pthread_body

Thread 2:
 #0   0x9003f188 in semaphore_wait_signal_trap
 #1   0x9003efa4 in _pthread_cond_wait
 #2   0x9051dda0 in CarbonOperationThreadFunc
 #3   0x90021428 in _pthread_body

Thread 3:
 #0   0x90042d68 in semaphore_timedwait_signal_trap
 #1   0x9003ef94 in _pthread_cond_wait
 #2   0x90233470 in TSWaitOnSemaphoreCommon
 #3   0x9023c298 in TimerThread
 #4   0x90021428 in _pthread_body

Thread 4:
 #0   0x9003f188 in semaphore_wait_signal_trap
 #1   0x9003efa4 in _pthread_cond_wait
 #2   0x90233454 in TSWaitOnSemaphoreCommon
 #3   0x90248b2c in AsyncFileThread(void*)
 #4   0x90021428 in _pthread_body

Thread 5:
 #0   0x9003f188 in semaphore_wait_signal_trap
 #1   0x9003efa4 in _pthread_cond_wait
 #2   0x90525b90 in CarbonInetOperThreadFunc
 #3   0x90021428 in _pthread_body

Thread 6:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x928ec28c in JNI_CreateJavaVM_Impl
 #3   0x928ec224 in JNI_CreateJavaVM_Impl
 #4   0x928a51fc in JVM_GetClassMethodsCount
 #5   0x90021428 in _pthread_body

Thread 7 Crashed:
 #0   0x929ba640 in eh_rest_world_r10
 #1   0x92857a38 in JVM_GetMethodIxLocalsCount
 #2   0x9285c128 in JVM_GetCPMethodNameUTF
 #3   0x928917f4 in JVM_MonitorNotifyAll
 #4   0x92886e6c in JVM_SetThreadPriority
 #5   0x92864964 in JVM_Send
 #6   0x9290114c in JNI_CreateJavaVM_Impl
 #7   0x928a51fc in JVM_GetClassMethodsCount
 #8   0x90021428 in _pthread_body

Thread 8:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x9283ddf4 in JVM_NewInstance
 #3   0x92845d80 in JVM_ArrayCopy
 #4   0x9285d620 in JVM_MonitorNotify
 #5   0x9285e2f8 in JVM_MonitorWait
 #6   0x05234668 in 0x5234668
 #7   0x0523268c in 0x523268c
 #8   0x0523268c in 0x523268c
 #9   0xa2843c38 in typeinfo name for std::bad_exception
 #10  0x92838bdc in JVM_CurrentTimeMillis
 #11  0x92878c28 in JVM_FindClassFromClass
 #12  0x92892c90 in JVM_IsSameClassPackage
 #13  0x9288cf70 in JVM_GetMethodIxExceptionTableEntry
 #14  0x928787a0 in JVM_FindClassFromClass
 #15  0x928a51fc in JVM_GetClassMethodsCount
 #16  0x90021428 in _pthread_body

Thread 9:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x9283ddf4 in JVM_NewInstance
 #3   0x92845d80 in JVM_ArrayCopy
 #4   0x9285d620 in JVM_MonitorNotify
 #5   0x9285e2f8 in JVM_MonitorWait
 #6   0x05234668 in 0x5234668
 #7   0x0523268c in 0x523268c
 #8   0x052325cc in 0x52325cc
 #9   0x052325cc in 0x52325cc
 #10  0xa2843c38 in typeinfo name for std::bad_exception
 #11  0x92838bdc in JVM_CurrentTimeMillis
 #12  0x92878c28 in JVM_FindClassFromClass
 #13  0x92892c90 in JVM_IsSameClassPackage
 #14  0x9288cf70 in JVM_GetMethodIxExceptionTableEntry
 #15  0x928787a0 in JVM_FindClassFromClass
 #16  0x928a51fc in JVM_GetClassMethodsCount
 #17  0x90021428 in _pthread_body

Thread 10:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x9283de9c in JVM_NewInstance
 #3   0x92844e18 in JVM_GetClassLoader
 #4   0x92844ba4 in JVM_GetClassLoader
 #5   0x928a51fc in JVM_GetClassMethodsCount
 #6   0x90021428 in _pthread_body

Thread 11:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x9283ddf4 in JVM_NewInstance
 #3   0x9285eb40 in JVM_FillInStackTrace
 #4   0x92903300 in JVM_InitProperties
 #5   0x92903138 in JVM_InitProperties
 #6   0x928787a0 in JVM_FindClassFromClass
 #7   0x928a51fc in JVM_GetClassMethodsCount
 #8   0x90021428 in _pthread_body

Thread 12:
 #0   0x90074328 in mach_msg_trap
 #1   0x90006670 in mach_msg
 #2   0x9283ddf4 in JVM_NewInstance
 #3   0x9285eb40 in JVM_FillInStackTrace
 #4   0x9288890c in JVM_StartThread
 #5   0x92876c10 in JVM_FindLoadedClass
 #6   0x928787a0 in JVM_FindClassFromClass
 #7   0x928a51fc in JVM_GetClassMethodsCount
 #8   0x90021428 in _pthread_body

PPC Thread State:
  srr0: 0x929ba640 srr1: 0x0000f030                vrsave: 0x00000000
   xer: 0x00000000   lr: 0x92857a38  ctr: 0x928498e0   mq: 0x00000000
    r0: 0x00000030   r1: 0xf0386a40   r2: 0x92857a38   r3: 0x6c1631d8
    r4: 0x6c1631d8   r5: 0x6c163200   r6: 0x00000000   r7: 0x0000000c
    r8: 0xa2833a58   r9: 0x00000000  r10: 0x00000008  r11: 0x00000b18
   r12: 0x928498e0  r13: 0xa282bd1c  r14: 0x00000000  r15: 0xf0386b90
   r16: 0xa28320f8  r17: 0x00000000  r18: 0x00160000  r19: 0xa282bd1c
   r20: 0xf0386b60  r21: 0xa282bd1c  r22: 0xa282bd1c  r23: 0xa282bd1c
   r24: 0xbfffac9c  r25: 0x0442b940  r26: 0x00000000  r27: 0x00000000
   r28: 0xa28305b0  r29: 0x04426b00  r30: 0x6c1631d8  r31: 0x9285bd1c

Comment 7

[Greg K.]

jay, to be certain, retest using a recent nightly build that includes the fix
for that bug.

(Reassigning to OJI.)

Comment 8

[R.K.Aa.]

This is close to identical to the stack as in bug 163684 which Brian Nesse
resolved as dup of bug 154699 (Same stack as in many of the other dups as well)
Resolving as duplicate. Please add comment if builds with the fix for bug 154699
still crash.

*** This bug has been marked as a duplicate of 154699 ***

Comment 9

[jay ball]

i download today's mozilla aka: Mozilla 1.1b - Mozilla/5.0 (Macintosh; U; PPC
Mac OS X; en-US; rv:1.1b) Gecko/20020830.

it apparently is fixed.  i was unable to replicate the exact data the java
ticker displayed, since bbc updates it dynamically, but if the trace matches,
etc, etc, it appears to work for me in the new version.  if the crash is
dependant on the data sent, i'll refile the bug.

coolies.  thanks.