266592 - Buffer Overflow Crashes All Windows [@ fun_mark]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java APIs for DOM, defect)

Description

[Blagovest Dachev]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10.1

Srolling the panoramic image at
http://www.path.unimelb.edu.au/~bernardk/tutorials/360/ptviewer/vr/ptv002.html
causes Firefox to crash. In my understanding the reason is a Buffer Overflow in
JVM. Sometimes (but not always, as it sometimes crashes quietly), this brings
the Windows Error Report agent/applet. After electing to debug, Visual Studio 6
issues Access Violation and application hangs at offset 0x00000000. I have
attached a HotSpot Virtual Machine log file.

Reproducible: Always
Steps to Reproduce:
1.Go the the provided URL.
2.Scroll the panoramic image all the way to the top, then all the way to the
bottom and then in any direction.

Actual Results:  
Firefox crashes


Platform:
PC
WinXP - Home
FireFox 1.0PR (also reproducable on FireBird 0.7)
Java Plug-in 1.5.0 for Netscape Navigator (DLL Helper)
Error:
Unhandled Exception in JPIOJI.DLL

Occurs only when the applet is accessing the folowing JavaScript function:
function getview(p,t,f) {
   document.cn.pan.value = p ;
   document.cn.tilt.value = t ;
   document.cn.fov.value = f ;
}

Comment 1

[Blagovest Dachev]

Attachment: HotSpot Virtual Machine Error Log

Comment 2

[Blagovest Dachev]

Correction:
FireFox 1.0PR generates Unhandled Exception in 0xC0000005, rather then
JPIOJI.DLL (as wrongfully reported).
FireBird 0.7 generates Unhandled Exception in JPIOJI.DLL

Comment 3

[Robert Strong (they/them - no direct email)]

Confirming crash with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5)
Gecko/20041027 Firefox/0.9.1+. Java(TM) 2 Platform Standard Edition 5.0 (e.g.
1.5). Adding keyword crash.

http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB1587557Y
Stack Signature	 fun_mark d2e428f4
Source File, Line No.
c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsfun.c, line 1306

Comment 4

[Blagovest Dachev]

Here is my original crash report:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=1542365

Comment 5

[Blagovest Dachev]

Attachment: Testcase

Comment 6

[Blagovest Dachev]

Attachment: Testcase Image

Comment 7

[Blagovest Dachev]

Attachment: Testcase Class File

Comment 8

[Blagovest Dachev]

Attachment: Testcase Jar File

Comment 9

[Blagovest Dachev]

Attachment: Testcase2

Comment 10

[Blagovest Dachev]

Attachment: Testcase3

Comment 11

[Blagovest Dachev]

Attachment: Testcase Final

Comment 12

[chris hofmann]

I wan't able to reproduce when I just tested with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060313 Firefox/1.5.0.2 and JRE/Java Plug-in 1.4.2_06 

Anyone still see the crash?

Comment 13

[Bob Clary [:bc] (inactive)]

nor me on winxp with jre1.5.0 update 6.

please reopen if you can reproduce with a recent jre.