197088 - Netscape 7.02 crashes when my JavaScript accesses a Java string or int

Status: VERIFIED FIXED

(Core Graveyard :: Java: OJI, defect)

Description

[RIbo Flavin]

User-Agent:       Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Build Identifier:  Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20030208 Netsca

My webpage has a extensive JS program that creates an <OBJECT...> element
with a calling a java applet.  The JS then finds the new OBJECT element in the
DOM and tries access public static vars (and int or a String) from the applet.
About 3 seconds later, the Netscape window and the Java Console windows 
disappear (I assume this is a crash.)  Calling a java method instead of just
accessing a var works (no crash).

Reproducible: Always

Steps to Reproduce:
1. Too complicated for you to reproduce at this time, I'll try to create a 
minimal version of the failure.
2.
3.

Actual Results:  
The netscape window and java console disappear.  The system did NOT pop up the
window asking if I wanted to send the dump in to you.

Expected Results:  
No crash.

I'm having trouble with java to/from javascript communication.  I'm also
confused(concerned) about possible differences in: APPLET vs OBJECT elements
and OBJECTS that exist in the source HTML verus OBJECTS elements that are
created at javascript run time and later added to the DOM.  Perhaps related to 
this, I've seen document.getElementById() apparently go into a infinite loop
(100% CPU time) trying to find the newly created OBJECT element.  (The OBJECT/
APPLET has PARAMs for mayscript=true and scriptable=true)  If you can help with
the bug, great.  If you can suggest other tests (debugging modes) please do.

Comment 1

[Josh Birnbaum]

Please be sure to test with Mozilla 1.3b or newer (the latest release candidate
of 1.3 is at http://ftp.mozilla.org/pub/mozilla/nightly/latest-1.3/).  Reporting
Netscape bugs here is a quick way to get your report ignored.

Comment 2

[Phil Schwartau]

Reassigning to the OJI component. Here is a list of the current OJI bugs
with keyword="crash". Perhaps you will a similar or duplicate report here:

http://bugzilla.mozilla.org/buglist.cgi?query_format=&short_desc_type=allwordssu
bstr&short_desc=&product=Browser&component=OJI&long_desc_type=substring&long_des
c=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allword
ssubstr&status_whiteboard=&keywords_type=allwords&keywords=crash&bug_status=UNCO
NFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&emailassigned_to1
=1&emailtype1=exact&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact
2=1&emailtype2=exact&email2=&bugidtype=include&bug_id=&votes=&changedin=&chfield
from=&chfieldto=Now&chfieldvalue=&cmdtype=doit&remtype=asnamed&newqueryname=&ord
er=Reuse+same+sort+as+last+time&field0-0-0=noop&type0-0-0=noop&value0-0-0=

Comment 3

[RIbo Flavin]

Attachment: Test case available

A test case is available at:
  http://westchester.watson.ibm.com/xm2
Follow the instructions on that page.
(ignore the attached file)

Comment 4

[Josh Birnbaum]

It crashes Moz 1.3b on WinXP with Java 1.4.1.

Comment 5

[Joshua Xia]

accept it and it also happen on unix

Comment 6

[Joshua Xia]

Attachment: test html

Test Html page

Comment 7

[Joshua Xia]

Attachment: Test Java source code

Test Java source code

Comment 8

[Joshua Xia]

Attachment: fix js/liveconnect 's GetStatic##Type##Field bug

The second parameter of GetStatic##Type##Field should be jclass, not jobject!

Comment 9

[Joshua Xia]

Hi Patrick Beard and Roger Lawrence

Please review / super-review my patch.

Thanks a lot!

Comment 10

[Patrick C. Beard]

Comment on attachment 117459 [details] [diff] [review]
fix js/liveconnect 's GetStatic##Type##Field bug

Good catch. sr=beard

Comment 11

[av (gone)]

Comment on attachment 117459 [details] [diff] [review]
fix js/liveconnect 's GetStatic##Type##Field bug

r=av

Comment 12

[Bolian Yin]

checked in Trunk.

Comment 13

[dsirnapalli]

-- Verified in the latest trunk build on WinXP with JRE1.4.1_02. The test case
crashes no more. Marking the bug Verified.