264062 - Java Color Picker applet causes crash [@ ntdll.dll + 0x4c1e1]

Status: RESOLVED DUPLICATE of bug 260478

(Core Graveyard :: Java: OJI, defect)

Description

[Donny]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041008 Firefox/0.10
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041008 Firefox/0.10

Click on a color picker to select a color and without releasing drag it around
for colors to change really rapidly. Sometimes it crashes and give a
crash-report-dialog sometimes a crash is quick and clean showing nothing. Tried
that with 2004-10-12 FF branch-build and Mozilla (Mozilla/5.0 (Windows; U;
Windows NT 5.1; en-US; rv:1.7) Gecko/20040616). both crash.

Reproducible: Always
Steps to Reproduce:
http://www.spurgius.com/colorpicker/colorpicker.html and use the java picker
extensively.

Comment 1

[Andrea Aime]

I can confirm it on windows 2000 and java 1.5. I also have another applet that
crashes firefox at: http://games.yahoo.com/games/downloads/bo_msgr.html
It usually crashes when I close the page, but it may also crash during applet
loading (quite easy to reproduce).

Comment 2

[Andrea Aime]

The trackback id for the game applet is TB2154818Q, whilst the one for the color
picker is TB2155052E.

Comment 3

[timeless]

[e-mail]: the two crashes are different, please file a new bug
for the other crash.

Stack Signature	 ntdll.dll + 0x4c1e1 (0x784ac1e1) 61f3a8ff
Product ID	Firefox10
Build ID	2004110711
Trigger Time	2004-11-24 08:53:07.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	ntdll.dll + (0004c1e1)
URL visited	http://games.yahoo.com/games/downloads/bo_msgr.html
User Comments	
Since Last Crash	3056 sec
Total Uptime	157238 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x4c1e1 (0x784ac1e1)
MSVCRT.DLL + 0x1532 (0x78001532)
MSVCRT.DLL + 0x14cf (0x780014cf)
js_AtomizeString 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsatom.c, line
624]
js_AtomizeChars 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsatom.c, line
708]
js_GetToken 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/js/src/jsscan.c, line
1002]
0x03175f88
0x00390042

it's possible that this stack is bogus, although i'm not sure how

Comment 4

[Andrea Aime]

I've reported the java game crash on bug 271574. I have other trackback ids for
the same crash, and I can generate others if you want.

Comment 5

[Bob Clary [:bc] (inactive)]

why is this js engine? I crash with recent seamonkey 1.7 and trunk with java
1.5.0 build 1.5.0-b64

JPIOJI! 6d44917b()
JPINSCP! 6d427ec5()
JPINSCP! 6d4285ff()
nsEventQueueImpl::PostSynchronousEvent(nsEventQueueImpl * const 0x009e3cf0,
PLEvent * 0x02652b08, void * * 0x00000000) line 319 + 11 bytes
nsJVMManager::PostEvent(nsJVMManager * const 0x00a71ebc, PRThread * 0x00284160,
nsIRunnable * 0x02685650, int 0) line 345
JPIOJI! 6d441bd3()
JPINSCP! 6d42396d()
USER32! 77d48709()
USER32! 77d487eb()
USER32! 77d4c00e()
USER32! 77d4e366()
PluginWndProc(HWND__ * 0x000c0348, unsigned int 32780, unsigned int 40374496,
long 2064) line 273
USER32! 77d48709()
USER32! 77d487eb()
USER32! 77d489a5()
USER32! 77d489e8()
nsAppShell::Run(nsAppShell * const 0x01491f60) line 159
nsAppStartup::Run(nsAppStartup * const 0x00a6f608) line 207
main1(int 0, char * * 0x00283f08, nsISupports * 0x00000000) line 1324 + 9 bytes
main(int 1, char * * 0x00283f08) line 1811 + 22 bytes
WinMain(HINSTANCE__ * 0x00400000, HINSTANCE__ * 0x00400000, char * 0x00152368,
HINSTANCE__ * 0x00400000) line 1839 + 23 bytes
MOZILLA! WinMainCRTStartup + 308 bytes

over to Java: OJI

Comment 6

[Kyle Yuan]

see my comment in bug 260478.

*** This bug has been marked as a duplicate of 260478 ***