226485 - Crash when JS calls an Applet method

Status: VERIFIED DUPLICATE of bug 225423

(Core Graveyard :: Java: Live Connect, defect)

Description

[André Schild]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6b) Gecko/20031121
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6b) Gecko/20031121

When javascript calls a method of a java applet, then
the browser crashes after 3-5 seconds.

Reproducible: Always

Steps to Reproduce:
1. Unpack the attached liveconnect.zip file in a directory.
2. Open the TestLive1.html page in your browser
3. The JVM starts and the initial applet is displayed
4. Then the onload triggers the setAppletText() JS function who then trys to
call a method in the applet with a string parameter
5. Wait 2-5 seconds and Mozilla crashes




Expected Results:  
The text "My Hello world set from JScript" should 
be displayed in the label at the bottom of the applet.
The initial text for the label is "JLabel1"

The very same test WORKS with older builds.
For example this one works fine:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20031007

Comment 1

[André Schild]

Attachment: Testcase for method calling from JS -> Java

Comment 2

[André Schild]

I use the most current JVM 1.4.2_02 and it crashes with the current
build (crashes with build 2003-11-20 too)

Comment 3

[André Schild]

Attachment: Second testcase to make sure it's not onload related

This second testcase is to make sure the problem
isn't caused by the onload method.

As soon as the "Set text on applet" button is clicked
Mozilla crashes. 
(Here too, the older release works just fine)

Comment 4

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031028
That´s the last windows nightly including talkback, so I can´t give a TB Id.

Comment 5

[Olivier Cahagne]

confirming crash 20031120 Win2k Sun's JRE 1.4.2_02.
I clicked on "set text..." with testlive2.html to crash.
Did you test 1.5 and 1.6a ? That would reduce the regression window.

Comment 6

[André Schild]

Works with 1.6a  (2003110115)

André

Comment 7

[Charles Fenwick]

Looks like the regression occurred sometime during the drought of windows
nightlies from mozilla.org.  Works on 20031028 nightly but crashes the mozilla -
trunk + calendar -O1 -G6 - 05-nov-2003.exe build that was provided by MozJF.

Comment 8

[André Schild]

Are there no talkback enabled builds available for windows ?

Comment 9

[Phil Schwartau]

Regression window seems the same as in bug 225423,
"Loading URL crashes Moz [@ JavaObject_getPropertyById ]"

That bug was introduced in the November 3rd/4th timeframe,
according to bug 225423 comment 13.

If someone could get a stacktrace here, we'd know for sure.
cc'ing Bernard to get his opinion -

Comment 10

[Olivier Cahagne]

sorry, I should have mentioned in comment 5 I got a stack, which was "different"
(not quite sure about Dr. Watson level of reliability though) from the ones I
got from bug 225423 (and its dupes). Basically, Dr Watson shows it's crashing in
function <nosymbols>, not very helpful.

Comment 11

[Bernard Alleysson]

the stack is:
	jsj3250.dll!jsj_GetClassInstanceMembers()  Line 600	C++
 	jsj3250.dll!jsj_JavaInstanceMethodWrapper(JSContext * cx=0x0264c7f0, JSObject
* obj=0x00e298a0, unsigned int argc=1, long * argv=0x012e5c94, long *
vp=0x0012eee8)  Line 1800 + 0x11	C++
 	js3250.dll!js_Invoke(JSContext * cx=, unsigned int argc=, unsigned int flags=)
 Line 932 + 0x1c	C
 	js3250.dll!js_Interpret(JSContext * cx=0x0264c7f0, long * result=0x0012f0a4) 
Line 2954	C
 	js3250.dll!js_Invoke(JSContext * cx=, unsigned int argc=, unsigned int flags=)
 Line 949 + 0xb	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x00000000, JSObject *
obj=0x01d41598, long fval=14762848, unsigned int flags=0, unsigned int
argc=40159260, long * argv=0x0012f26c, long * rval=0x0012f218)  Line 1026 + 0xe	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x0264c7f0, JSObject *
obj=0x01d41598, long fval=14762848, unsigned int argc=1, long * argv=0x0012f26c,
long * rval=0x0012f218)  Line 3572 + 0x26	C
 	jsdom.dll!nsJSContext::CallEventHandler(void * aTarget=0x01d41598, void *
aHandler=0x00e14360, unsigned int argc=1, void * argv=0x0012f26c, int *
aBoolResult=0x0012f268, int aReverseReturnResult=0)  Line 1245 + 0x1b	C++
 	jsdom.dll!nsJSEventListener::HandleEvent(nsIDOMEvent * aEvent=0x019975b0) 
Line 182	C++
 	gklayout.dll!nsEventListenerManager::HandleEventSubType(nsIDOMEventTarget *
aCurrentTarget=0x02427c50, unsigned int aSubType=1, nsCxPusher pusher={...},
nsCOMPtr<nsIJSEventListener> jslistener={...}, nsCOMPtr<nsIScriptContext>
scriptCX={...})  Line 1420 + 0x9	C++
 	gklayout.dll!nsEventListenerManager::HandleEvent(nsIPresContext *
aPresContext=0x00000008, nsEvent * aEvent=0x0012f4fc, nsIDOMEvent * *
aDOMEvent=0x0012f488, nsIDOMEventTarget * aCurrentTarget=0x02427c50, unsigned
int aFlags=7, nsEventStatus * aEventStatus=0x0012f528)  Line 1513 + 0x24	C++
 	jsdom.dll!GlobalWindowImpl::HandleDOMEvent(nsIPresContext *
aPresContext=0x02773f60, nsEvent * aEvent=0x0012f4fc, nsIDOMEvent * *
aDOMEvent=0x0012f488, unsigned int aFlags=1, nsEventStatus *
aEventStatus=0x0012f528)  Line 846	C++
 	gklayout.dll!DocumentViewerImpl::LoadComplete(unsigned int aStatus=0)  Line
909 + 0x48	C++
 	docshell.dll!nsDocShell::EndPageLoad(nsIWebProgress * aProgress=0x60142bbd,
nsIChannel * aChannel=0x027a2f4c, unsigned int aStatus=28561480)  Line 4326	C++
 	necko.dll!nsFileChannel::GetURI(nsIURI * * aURI=0x00000000)  Line 240	C++
 	gklayout.dll!nsBoxFrame::GetPrefSize(nsBoxLayoutState & aBoxLayoutState={...},
nsSize & aSize={...})  Line 930 + 0x12	C++
 	gklayout.dll!nsGfxScrollFrame::GetScrollbarSizes(nsIPresContext *
aPresContext=0x77f473f3, int * aVbarWidth=0x01a108e8, int *
aHbarHeight=0x00000028)  Line 324 + 0x12	C++
 	ntdll.dll!_RtlpAllocateFromHeapLookaside@4()  + 0x2d	
 	xpcom.dll!SearchTable(PLDHashTable * table=0x000b0023, const void *
key=0x0241dd48, unsigned int keyHash=2012506081, PLDHashOperator op=2689080) 
Line 378 + 0x13	C++
 	ntdll.dll!_RtlpFreeToHeapLookaside@8()  + 0x1f	
 	ntdll.dll!_RtlFreeHeap@12()  + 0x114	
 	msvcr71.dll!free(void * pBlock=)  Line 103 + 0x5	C

so this is the same as bug 225423, with the exact same message, and the exact
same bogus value class_descriptor = 0x01

*** This bug has been marked as a duplicate of 225423 ***

Comment 12

[Phil Schwartau]

Thanks to all - marking Verified Duplicate -

Comment 13

[Hermann Schwab]

Bug 225423 is fixed, this one is still buggy for me, and shows same behaviour as
a testcase in Bug 64319

Bug 64319 Java to JavaScript: pointer to the applet object is hard coded to NULL
http://www.apl.jhu.edu/~hall/CWP-Sources/CWP-Examples/Chapter19/Everest.html

Seemed to be working for some time, even multiple reloads were working, then the
throbber was spinning, switching tabs showed grey only, content wasn´t redrawn.

To me it seems this isn´t a dupe of Bug 225423, but of open Bug 64319

tested with Tinderbox  build BuildID 2003112523
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6b) Gecko/20031125
Java Plug-in 1.4.2_01 for Netscape Navigator (DLL Helper)

Comment 14

[Hermann Schwab]

wfm Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6b) Gecko/20031126
BuildID 2003112608, Java Plug-in 1.4.2_02

re comment 13:
seems I forgot to update my Java on the other computer (Win98SE), will retest
tomorrow. I didn´t get the Alert box on pressing jButton1, instead the applet
turned grey, and when I switched tabs, the window turned grey, and on closing
the browser, the Java Icon was staying in the tray, though I didn´t see a
browser in the task manager.