204254 - Trunk crash [@ jvm.dll - nsHTMLExternalObjSH::PostCreate] [@ enter_js_from_java_impl]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java: OJI, defect)

Description

[Jay Patel [:jay]]

This crash has been around in one form or another for a long time.  There are a
lot of bugs dupped to bug 90571 (which claims that this was fixed with the
upgrade to JRE 1.4.1)...but Susie has found an easily reproducible case.

I was able to crash at will on http://www.fidelity.com...and noticed 2 different
stacks.  Here are a couple of my Talkback incidents:
Incident ID 19726978
Stack Signature 	jvm.dll + 0x561fe (0x6d3861fe) 828358a6
Email Address 	[e-mail]
Product ID 	MozillaTrunk
Build ID 	2003050108
Trigger Time 	2003-05-02 15:41:50
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	jvm.dll
URL visited 	fidelity.com
User Comments 	again, closing live chat popup
Trigger Reason 	Access violation
Source File Name 	
Trigger Line No. 	
Stack Trace 	
jvm.dll + 0x561fe (0x6d3861fe)
jvm.dll + 0x5607e (0x6d38607e)
jvm.dll + 0x30961 (0x6d360961)
jvm.dll + 0x306ef (0x6d3606ef)
jvm.dll + 0x31919 (0x6d361919)
jpins32.dll + 0x74d3 (0x018174d3)
jpins32.dll + 0x3114 (0x01813114)
nsHTMLExternalObjSH::PostCreate
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5648]
XPCWrappedNative::GetNewOrUsed
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 427]
XPCConvert::NativeInterface2JSObject
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcconvert.cpp, line 1061]
nsXPConnect::WrapNative
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 564]
nsDOMClassInfo::WrapNative
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 1018]
nsHTMLDocumentSH::GetProperty
[c:/builds/seamonkey/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 5191]
XPC_WN_Helper_GetProperty
[c:/builds/seamonkey/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 807]
js_GetProperty [c:/builds/seamonkey/mozilla/js/src/jsobj.c, line 2552]
js_Interpret [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 2666]
js_Invoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 861]
js_InternalInvoke [c:/builds/seamonkey/mozilla/js/src/jsinterp.c, line 936]
JS_CallFunctionValue [c:/builds/seamonkey/mozilla/js/src/jsapi.c, line 3529]
nsJSContext::CallEventHandler
[c:/builds/seamonkey/mozilla/dom/src/base/nsJSEnvironment.cpp, line 1082]
nsJSEventListener::HandleEvent
[c:/builds/seamonkey/mozilla/dom/src/events/nsJSEventListener.cpp, line 183]
nsEventListenerManager::HandleEventSubType
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1192]
nsEventListenerManager::HandleEvent
[c:/builds/seamonkey/mozilla/content/events/src/nsEventListenerManager.cpp, line
1876]
GlobalWindowImpl::HandleDOMEvent
[c:/builds/seamonkey/mozilla/dom/src/base/nsGlobalWindow.cpp, line 799]
DocumentViewerImpl::LoadComplete
[c:/builds/seamonkey/mozilla/content/base/src/nsDocumentViewer.cpp, line 954]
nsDocShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4334]
nsWebShell::EndPageLoad
[c:/builds/seamonkey/mozilla/docshell/base/nsWebShell.cpp, line 881]
nsDocShell::OnStateChange
[c:/builds/seamonkey/mozilla/docshell/base/nsDocShell.cpp, line 4268]
nsDocLoaderImpl::FireOnStateChange
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 1214]
nsDocLoaderImpl::doStopDocumentLoad
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 869]
nsDocLoaderImpl::DocLoaderIsEmpty
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 767]
nsDocLoaderImpl::OnStopRequest
[c:/builds/seamonkey/mozilla/uriloader/base/nsDocLoader.cpp, line 697]
nsLoadGroup::RemoveRequest
[c:/builds/seamonkey/mozilla/netwerk/base/src/nsLoadGroup.cpp, line 703]
PresShell::RemoveDummyLayoutRequest
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6904]
PresShell::ProcessReflowCommands
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6719]
ReflowEvent::HandleEvent
[c:/builds/seamonkey/mozilla/layout/html/base/src/nsPresShell.cpp, line 6507]
PL_HandleEvent [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c, line 660]
PL_ProcessPendingEvents [c:/builds/seamonkey/mozilla/xpcom/threads/plevent.c,
line 596]
nsEventQueueImpl::ProcessPendingEvents
[c:/builds/seamonkey/mozilla/xpcom/threads/nsEventQueue.cpp, line 391] 

And...
Incident ID 19726930
Stack Signature 	0x0247c13c d77065fe
Email Address 	[e-mail]
Product ID 	MozillaTrunk
Build ID 	2003050108
Trigger Time 	2003-05-02 15:37:48
Platform 	Win32
Operating System 	Windows NT 5.1 build 2600
Module 	
URL visited 	fidelity.com
User Comments 	customer service->contact us->live chat. signed in with name and
email...chat window was started...but i could not send any messages or end
session. closed the popup window...and then tried to click chat button
again...and boom!
Trigger Reason 	Privileged instruction
Source File Name 	
Trigger Line No. 	
Stack Trace 	
0x0247c13c
enter_js_from_java_impl [c:/builds/seamonkey/mozilla/modules/oji/src/lcglue.cpp,
line 430]
jsj_enter_js [c:/builds/seamonkey/mozilla/js/src/liveconnect/jsj_JSObject.c,
line 713]
nsCLiveconnect::GetWindow
[c:/builds/seamonkey/mozilla/js/src/liveconnect/nsCLiveconnect.cpp, line 706]
jpins32.dll + 0x9d76 (0x01539d76)
jpins32.dll + 0x9b78 (0x01539b78)
SHELL32.dll + 0x4e0c24 (0x778b0c24) 

To reproduce the crash just do the following:
1. Goto http://www.fidelity.com/
2. Click on Customer Service and then Contact Us
3. Click on Chat with a Live Rep
4. Select: "Visitor interested..." and Continue
5. Select: "Investing with Fidelity" and Begin Chat
6. A Chat window will popup, just fill in the form and Connect.
7. At this point you will be able to type in a comment, but not send it.  The
Send and End Call buttons don't work.
8. If you close the popup window you will see a crash.  If you try to send a
comment and/or leave the window open long enough, your system might hang and
then the browser will crash eventually.

Comment 1

[Joshua Xia]

reproduce step 4:
Select: "Visitor interested..." and Continue

I can't find "Visitor interested..." link.

reporter: please use jre1.4.2-beta test this bug, you can download the latest
JRE from http://java.sun.com.
thanks!

Comment 2

[Joshua Xia]

->wfm