257374 - Crash apparently when Java applet throws ArrayIndexOutOfBoundsException while not displayed on screen.

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Java: OJI, defect)

Description

[Gareth Randall]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.2) Gecko/20040803
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.2) Gecko/20040803

There is an applet (scroller.class) loaded by the supplied URL which seems to be
able to crash the browser on its own. I conclude this because, when onscreen,
the applet will display ArrayIndexOutOfBoundsException in the Mozilla status bar
about two minutes after first loading the page.

However, if the applet is not onscreen because it is another tab, the browser
crashes after what seems to be about the same time delay.

I think once it crashed Mozilla even though it was onscreen.

My JRE is:
java version "1.4.2_05"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_05-141)
Java HotSpot(TM) Client VM (build 1.4.2-38, mixed mode)


I am hoping this is not just because of a transient network connection (e.g. the
applet cannot download data that it wants) so that you can see it happen too.

(I will try to download the applet itself immediately after posting this report.)


Reproducible: Always
Steps to Reproduce:
1. Launch Mozilla. (I subsequently close the Mail client, should this be relevant.)
2. Open the URL http://www.nationalgrid.com/uk/
3. Open another tab so that the Java applet is not on screen.
4. Wait something like 2 minutes (I inaccurately timed it at 130 secs.) Then the
crash occurs.

Actual Results:  
Crash resulting in both Apple bug submitter and Talkback coming up.

Expected Results:  
Handled the Java exception (if this is what it actually is) without crashing.

I have several Talkback crashes uploaded to you under the e-mail address:
[e-mail]

Feel free to examine them.

Comment 1

[Gareth Randall]

The applet is being loaded with the following parameters:

	<td width="400"><applet code="scroller.class" codebase="scroller" width="400"
height="28" id="scroller">
	<param name="feeder" value="scroller_ukhome.txt" />
	<param name="font" value="name=Arial, style=BOLD, size=12" >
	<param name="direction" value="0" />
	<param name="bg" value="r=0, g=102, b=153" />
	<param name="fg" value="r=255, g=255, b=255">
	<param name="hg" value="r=0, g=204, b=255">
	<param name="fps" value="200" />
	<param name="feedtime" value="60000" />
	<param name="stopat" value="25" />
	<param name="feedlength" value="10" />
	<param name="stillfor" value="500" />
	<param name="launchon" value="_top">
	<param name="changecursor" value="1" />
	</applet></td><!--news ticker end marker-->

(I can't seem to download the applet itself yet. Maybe it is a common one in
which case the source will be out there?)

Comment 2

[Matthias Versen [:Matti]]

-> oji

Comment 3

[Hermann Schwab]

no crash with Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a3) Gecko/20040828

scroller can be found at http://www.nationalgrid.com/uk/scroller/scroller.class

Talkbacks 
685194:        SIGILL: Illegal Instruction: (signal 4)
685221,685222: SIGSEGV: Segmentation Violation: (signal 11) + stacktrace
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=685222
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=685221
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=685194

Comment 4

[Gareth Randall]

I've decompiled some of the Java classes on the website concerned and it is
clear that their author has done some very amateur work with threading,
including not synchronising on an object when calling methods in it, and calling
AWT routines from outside of the event dispatcher thread!

While the crashing classes are hopelessly wrong :-), it would be nice for
Mozilla to be able to survive them.

I used the Jad tool to decompile (http://kpdus.tripod.com/jad.html)

Comment 5

[Gareth Randall]

Still an issue on the latest release:

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.11) Gecko/20050727


The original website have commented out the code that runs the applet, but if
you download the page and replace their applet HTML line with one that specifies
the codebase fully, then the crashing effect is still there:

<applet code="scroller.class" codebase="http://www.nationalgrid.com/uk/scroller"
width="400" height="28" id=
"scroller">

Comment 6

[Pete Zha]

mass reassign to Alfred

Comment 7

[Melchert Fruitema]

(In reply to comment #3)
> ...
> scroller can be found at http://www.nationalgrid.com/uk/scroller/scroller.class
> 
> Talkbacks 
> 685194:        SIGILL: Illegal Instruction: (signal 4)
> 685221,685222: SIGSEGV: Segmentation Violation: (signal 11) + stacktrace
> http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=685222
> http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=685221
> http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=685194

Triage: Applet and talkback reports are no longer available.

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

As long as no-one can supply further information or a working testcase we will close the bug as incomplete. Feel free to reopen when you have the requested information.