230227 - Crash while creating Java window with JS & LiveConnect [@ jsj_LookupJavaStaticMemberDescriptorById]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java: Live Connect, defect)

Description

[Marek Stępień [:marcoos, inactive]]

If someone tries to create and display a new Java window using JavaScript
LiveConnect, Mozilla crashes:

var f = new java.awt.Frame("Hello World");
var ta = new java.awt.TextArea("This will crash Mozilla, unfortunately... :(",
5, 20);
f.add("Center", ta);
f.pack();
f.show();

(This code comes from David Flanagan's "JavaScript. The Definitive Guide").

Reproduced on Linux with;

- Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7a) Gecko/20040106
- official Netscape 7.1
- some December 2003 Firebird builds
- my own build of cvs-pulled Firebird 0.7+ (from current code).

Java Plugin: Blackdown Java-Linux Java(TM) Plug-in 1.4.1

It is also reproducible with Firebird 0.7 under Windows 2000 with Sun Java 1.4.x
. I haven't tested other systems.


Steps to reproduce:
1. Go to http://web.pertus.com.pl/~marcoos/mozilla/lc.html
2. Click "Click me".

Actual results:
1. Mozilla/Netscape/Firebird crashes

Expected results:
1. Display a Java window called "Hello World" with awt's textarea in it, as
Netscape 4.8 and Opera 7.5-preview do (which both use the same Blackdown Java
plugin on my Linux box).

Comment 1

[Marek Stępień [:marcoos, inactive]]

Also, MozillaPL has reports ( http://mozillapl.org/forum/viewtopic.php?t=4592 )
that this code behaves in four different ways in Mozilla:

- it may do what it is supposed to do (open a Java window)
- it may crash
- it may throw a java.security.PrivilegedActionException
- it may throw an "Error: There is no Java constructor for class
java.awt.TextArea that matches JavaScript argument types (undefined, undefined,
undefined)." while the constructor is invoked with (String, Number, Number).

Comment 2

[Kyle Yuan]

I got an interesting result on both Linux & Windows 2000 (with Sun jre 1.4.2):
1) if I opened Java Console before clicked "Click me", it works;
2) if I didn't open Java Console, a java.security.PrivilegedActionException will
be thrown, but no crash.

Comment 3

[Marek Stępień [:marcoos, inactive]]

This bug still occurs in current nightlies and my own builds...

Comment 4

[Marek Stępień [:marcoos, inactive]]

A talkback report for this bug from the most recent Mozilla 1.8a5-trunk nightly:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1933391K

Comment 5

[Marek Stępień [:marcoos, inactive]]

Attachment: Testcase

The same as the URL mentioned earlier.

Comment 6

[timeless]

Stack Signature	jsj_LookupJavaStaticMemberDescriptorById() 0b3be062
Product ID	MozillaTrunk
Build ID	2004111223
Trigger Time	2004-11-13 16:31:51.0
Platform	LinuxIntel
Operating System	Linux 2.6.7-gentoo-r1
Module	libjsj.so + (0000d490)
URL visited	http://web.pertus.com.pl/~marcoos/mozilla/lc.html
User Comments	
Since Last Crash	3 sec
Total Uptime	3 sec
Trigger Reason	SIGSEGV: Segmentation Fault: (signal 11)
Source File, Line No.
/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/liveconnect/jsj_class.c,
line 615
Stack Trace 	
jsj_LookupJavaStaticMemberDescriptorById() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/liveconnect/jsj_class.c,
line 615]
lookup_static_member_by_id() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/liveconnect/jsj_JavaClass.c,
line 125]
JavaClass_getPropertyById() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/liveconnect/jsj_JavaClass.c,
line 181]
js_Interpret() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 3025]
js_Execute() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsinterp.c,
line 1562]
JS_EvaluateUCScriptForPrincipals() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/js/src/jsapi.c,
line 3700]
nsJSContext::EvaluateString() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 141]
nsJSThunk::EvaluateScript() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,
line 711]
nsJSChannel::InternalOpen() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,
line 693]
nsJSChannel::AsyncOpen() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,
line 510]
nsDocumentOpenInfo::Open() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 222]
nsURILoader::OpenURI() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/uriloader/base/nsURILoader.cpp,
line 711]
nsDocShell::DoChannelLoad() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 5720]
nsDocShell::DoURILoad() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 705]
nsDocShell::InternalLoad() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsDocShell.cpp,
line 5358]
nsWebShell::OnLinkClickSync() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsWebShell.cpp,
line 113]
HandlePLEvent() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/docshell/base/nsWebShell.cpp,
line 693]
PL_HandleEvent() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 692]
PL_ProcessPendingEvents() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/plevent.c,
line 627]
nsEventQueueImpl::ProcessPendingEvents() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/xpcom/threads/nsEventQueue.cpp,
line 398]
event_processor_callback() 
[/builds/tinderbox/SeaMonkey-Release/Linux_2.4.20-28.8_Clobber/mozilla/widget/src/gtk2/nsAppShell.cpp,
line 71]

Comment 7

[Marek Stępień [:marcoos, inactive]]

This no longer causes a crash for me with Firefox 1.5rc2 (though I'm now using Sun's Java 1.4.2 instead of the Blackdown one).

The code from the testcase throws a java.security.PrivilegedActionException.

Is this the correct behavior? (As I said before, this JS code creates an AWT window in Opera, including Opera 8).

Comment 8

[Matthias Versen [:Matti]]

wfm
Please reopen if you still get this with a recent build and JRE