215872 - Browser crashes upon visiting qx.net and trying to view webmail link

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java: OJI, defect)

Description

[Brendan Chandler]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030704
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030704

Start the browser and go to www.qx.net.  On the left side of the page is a link
to "Web-Based E-Mail."  Clicking on this link expands to two more options, "Web
Mail" and "Business Mail."  Click on the web mail link and mozilla crashes.

Reproducible: Always

Steps to Reproduce:
1. Load www.qx.net
2. Expand "Web-Based E-Mail" link
3. Click the web mail link.

Actual Results:  
Browser Crashed

Expected Results:  
Load the linked page.

Mozilla was installed on affected machine using dropline gnome. 
(http://www.dropline.net/gnome/)

Comment 1

[Matthias Versen [:Matti]]

wfm with win2k and 20030811..

Comment 2

[Andrew Schultz]

this crashes in OJI (liboji.so, not the java plugin).
I'm recompiling to get a stack with symbols.

==> OJI

Comment 3

[Andrew Schultz]

Attachment: stacktrace

frame 5 is:
426 JSContext *pJSCX	=
map_jsj_thread_to_js_context_impl(nsnull,java_applet_obj,jEnv,errp);

Comment 4

[Andrew Schultz]

meant to mark this NEW as well.

Comment 5

[Joshua Xia]

wfm with Mozilla 1.5b
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030722
+
jre1.5 on win2k

It seems there is no java on this page at all.

Comment 6

[Andrew Schultz]

Attachment: testcase

linux trunk 20030812 crashes if you load this and then reload.
the iframe contains a javascript-generated scroller that uses a java applet.
Loading the iframe from a local file did not exhibit the crash.

Comment 7

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

worksforme Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b)
Gecko/20030817 Mozilla Firebird/0.6.1+ (debug build)

BUT.... an I get an assertion failed ("DAMAGE: after Normal block (#2104250) at
0x05586778").  I'm having trouble getting the debugger to help me here though.

Call stack at the failed assert:

_free_dbg_lk(void * 0x05586778, int 1) line 1066 + 60 bytes
_free_dbg(void * 0x05586778, int 1) line 1001 + 13 bytes
free(void * 0x05586778) line 956 + 11 bytes
JS_free(JSContext * 0x05291ac0, void * 0x05586778) line 1457 + 10 bytes
js_DestroyScript(JSContext * 0x05291ac0, JSScript * 0x05586778) line 1108 + 13 bytes
JS_DestroyScript(JSContext * 0x05291ac0, JSScript * 0x05586778) line 3190 + 13 bytes
JS_EvaluateUCScriptForPrincipals(JSContext * 0x05291ac0, JSObject * 0x05153aa8,
JSPrincipals * 0x051e3b90, const unsigned short * 0x0541b028, unsigned int
15353, const char * 0x0012f5ac, unsigned int 1, long * 0x0012f494) line 3494 +
13 bytes
nsJSContext::EvaluateString(nsJSContext * const 0x05291a58, const nsAString &
{...}, void * 0x05153aa8, nsIPrincipal * 0x051e3b88, const char * 0x0012f5ac,
unsigned int 1, const char * 0x01902418, nsAString & {...}, int * 0x0012f4f8)
line 875 + 85 bytes
nsScriptLoader::EvaluateScript(nsScriptLoadRequest * 0x051d64b0, const
nsAFlatString & {...}) line 649
nsScriptLoader::ProcessRequest(nsScriptLoadRequest * 0x051d64b0) line 562 + 22 bytes
nsScriptLoader::OnStreamComplete(nsScriptLoader * const 0x02be383c,
nsIStreamLoader * 0x05597530, nsISupports * 0x051d64b0, unsigned int 0, unsigned
int 4294967295, const char * 0x051d5c22) line 905
nsStreamLoader::OnStopRequest(nsStreamLoader * const 0x05597534, nsIRequest *
0x054fc948, nsISupports * 0x051d64b0, unsigned int 0) line 144
nsHttpChannel::OnStopRequest(nsHttpChannel * const 0x054fc950, nsIRequest *
0x05228758, nsISupports * 0x051d64b0, unsigned int 0) line 3322
nsInputStreamPump::OnStateStop() line 484
nsInputStreamPump::OnInputStreamReady(nsInputStreamPump * const 0x0522875c,
nsIAsyncInputStream * 0x055ac64c) line 324 + 11 bytes
nsInputStreamReadyEvent::EventHandler(PLEvent * 0x055ac86c) line 117
PL_HandleEvent(PLEvent * 0x055ac86c) line 671 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x020b1ff8) line 606 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x00e40280, unsigned int 49410, unsigned int 0,
long 34283512) line 1412 + 9 bytes
USER32! 77d67ad7()
USER32! 77d6ccd4()
USER32! 77d44455()
USER32! 77d495d5()
nsAppShellService::Run(nsAppShellService * const 0x02031ad8) line 484
main1(int 1, char * * 0x01966ef8, nsISupports * 0x01fe1530, const nsXREAppData &
{...}) line 1281 + 32 bytes
xre_main(int 1, char * * 0x01966ef8, const nsXREAppData & {...}) line 1692 + 41
bytes
main(int 1, char * * 0x01966ef8) line 51 + 17 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e814c7()

Comment 8

[Hermann Schwab]

crash on the website using
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031022
Java Plug-in 1.4.2_01 for Netscape Navigator (DLL Helper)
Win98 + SP1

Talkback ID: TB24656155Z

Comment 9

[Hermann Schwab]

crash on the testcase using
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031022
Java Plug-in 1.4.2_01 for Netscape Navigator (DLL Helper)
Win98 + SP1

Talkback ID: TB24656548Q

Setting OS to all, as this is seen on Linux and Windows.

Comment 10

[Hermann Schwab]

upgraded java:
deinstalled JRE 1.4.2_01, rebooted, installed JRE 1.4.2_02

crash on the testcase using
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031022
Java Plug-in 1.4.2_02 for Netscape Navigator (DLL Helper)
Win98 + SP1

Talkback ID: can´t connect

Comment 11

[Joshua Xia]

->kyle

Comment 12

[Kyle Yuan]

Can somebody still see the problem with newest mozilla & jre?

Comment 13

[Adam Hauner]

Hermann: Are you able to reproduce with 1.7 and newest JRE?

Comment 14

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

WFM, Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a3) Gecko/20040717

However, it's possible the page content has changed since the original crasher,
and the testcase refers to their server, so it could also have changed.

Comment 15

[Hermann Schwab]

crashing with 1.7 and jre1.5.0beta2, Talkback TB359781H

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a2) Gecko/20040714
    C:\Programme\Java\jre1.5.0\bin\NPJava32.dll
    Java Plug-in 1.5.0 for Netscape Navigator (DLL Helper)

Load testcase, reload testcase, shift reload and crash, Talkback

Load testcase, load one of the links in the IFRAME into a new tab, read
something there, close tab, crash, no Talkback

Comment 16

[Hermann Schwab]

loaded URL in another tab, killed tab, DocWatson came up, froze after maybe half
it´s work was done. This time no Talkback.

from crash before:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB359781H

0x3d704600
JPIOJI.DLL + 0x4867 (0x6d434867)
JPINSCP.DLL + 0x3956 (0x6d413956)
PluginWndProc
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp,
line 273]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00648b56

Processor is Celeron 333, 96 MB RAM, Win98 SP1.

Comment 17

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

> Load testcase, reload testcase, shift reload and crash, Talkback
> Load testcase, load one of the links in the IFRAME into a new tab, read
something there, close tab, crash, no Talkback

Both WFM.

Comment 18

[Andrew Schultz]

testcase and URL WORKSFORME with linux trunk 2005031005

Comment 19

[Hermann Schwab]

Currently I don´t have Java installed, so worksforme.
I´ll retest when I´ve java installed again.

testcase calls this in an <iframe>: http://www.qx.net/nav.htm

from the source:
<!--
NOTE REGARDING JAVA: This scroller achieves its smooth scrolling effect by utilizing
a small 1K Java class file. The class file does not delay load time or display
time, the
scroller still loads with the page. In the rare case that Java capabilities are
not detected 
the scroller will ignore the class file and employ a standard scroll effect, while
appearing and functioning identical to the smooth scrolling version.
/////////////////////////////////////////////////////////////////-->
<script language="JavaScript1.2" src="scroller/scroller.js"></script>
<script language="JavaScript1.2" src="scroller/dvs_script.js"></script>
</body>



Error: appObj.stopscroll is not a function
Source File: http://www.qx.net/scroller/dvs_script.js
Line: 1

Comment 20

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050625
Java(TM) 2 Platform Standard Edition 5.0 Update 4

I'm testing the testcase, https://bugzilla.mozilla.org/attachment.cgi?id=12979
I'm using the freeware Process Explorer 9.10 from http://www.sysinternals.com/

There seems to be a memory leak.

It is getting slower and slower, in the first minutes the CPU load changes
between 60% and 100%, after ten minutes lets say between 99 and 100%.
I lost 1 MB of RAM in 5 minutes, from 20 MB down to 19 MB.
Some earlier tests I only had 2000 KB, and it went down to a two-digit number,
than freezed. A Mah-Jong game had 6000 kb available.
I don´t mind the 100% CPU load, if it happens from time to time, as that
computer is a slow Celeron333 with 128 MB RAM running Win98 (not recommended for
Java 1.5) Crashes I see on this computer I also see on another running Win98SE
(recommended for Java 1.5), having a relatively fast Athlon XP1600+ and 512 MB
of RAM, and ample space on the harddisk. 

I don´t crash, but there definitely is a memory leak, though it takes minutes to
notice it.
I´m reopening that bug.

Comment 21

[Andrew Schultz]

Herman: can you file a new bug for the leak?  There is very little chance it is
related to this bug (since the crash is gone).  I'll need to do more testing,
but I think I'm seeing something similar to what you're seeing.