Closed Bug 267462 Opened 20 years ago Closed 17 years ago

unreproduceable crash when loading terkepbank.hu java page [@ 0x00000000 - nsXULElement::QueryInterface][@ jpioji.dll ]

Categories

(Core Graveyard :: Java: OJI, defect)

defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: phajdu, Assigned: alfred.peng)

References

()

Details

(Keywords: crash, qawanted)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041026 Firefox/1.0RC1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20041026 Firefox/1.0RC1

Almost every time when I try to load www.terkepbank.hu in Firefox, the browser
hangs and crashes with an error message. This page uses java. After that Firefox
can only be run with a reboot.

Reproducible: Sometimes
Steps to Reproduce:
1.Try to open www.terkepbank.hu
2.Firefox tries to load the java applet
3.It crashes

Actual Results:  
Firefox crashed

Expected Results:  
Load the java applet properly
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041102
WFM 
I crashed using FF RC1 20041101 on Win2k + JRE 1.5.0.

0x00000000
nsXULElement::QueryInterface 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 579]
nsQueryInterface::operator() 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpcom/glue/nsCOMPtr.cpp,
line 52]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2811]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2821]
nsXULElement::HandleChromeEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/xul/content/src/nsXULElement.cpp,
line 3988]
GlobalWindowImpl::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 916]
nsDocument::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsDocument.cpp,
line 3742]
nsGenericElement::HandleDOMEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/content/base/src/nsGenericElement.cpp,
line 1918]
PresShell::HandleEventInternal 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 6059]
PresShell::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 5921]
nsViewManager::HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2326]
nsViewManager::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x1ef0 (0x77e11ef0)
USER32.dll + 0x204c (0x77e1204c)
USER32.dll + 0x21af (0x77e121af)
nsAppShellService::Run 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[d:/builds/tinderbox/firefox-1.0/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
KERNEL32.DLL + 0x2893d (0x7c59893d)
Keywords: crash
Summary: crash when loading this page which uses java → crash when loading this page which uses java [@ 0x000000 ]
I got the same crash on
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3) Gecko/20040910
Win XP Pro

Talkback ID = TB1701225K

I had to reload the page many times, the crash happens quite rarely.
This is not ff problem, it is the sites prob. There site is optimized for IE use
Summary: crash when loading this page which uses java [@ 0x000000 ] → crash when loading this page which uses java [@ 0x00000000 - nsXULElement::QueryInterface]
"optimized for IE" doesn't mean it's OK for Firefox to crash. From the stack
trace this is clearly a Firefox crash.
Confirmed for Mozilla nightly:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041109
JRE 1.5.0

Page had to be reloaded several times for the crash to occur.

"This is not ff problem, it is the sites prob": the browser should never crash
because of faulty input.
Keywords: qawanted
*** Bug 270959 has been marked as a duplicate of this bug. ***
Also crashing in jpioji.dll from TB2077048K.
Assignee: general → kyle.yuan
Status: UNCONFIRMED → NEW
Component: Browser-General → Java: OJI
Ever confirmed: true
OS: Windows XP → All
QA Contact: general
Hardware: PC → All
Summary: crash when loading this page which uses java [@ 0x00000000 - nsXULElement::QueryInterface] → crash when loading this page which uses java [@ 0x00000000 - nsXULElement::QueryInterface][@ jpioji.dll ]
This URL: 
http://www.anfyteam.com/anj/wormhole/wormhole.html
Seems to behave very similarly.
Why is this bug against Java: OJI and assigned to Kyle?  Is the Java plugin a
necessary part of the steps to reproduce?  It's not implicated in the stack in
comment 2.

/be
the reason it's assigned to kyle is:

Stack Signature	 JPIOJI.DLL + 0x4865 (0x6d444865) decf6138
Product ID	MozillaTrunk
Build ID	2004111904
Trigger Time	2004-11-20 11:10:10.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766222
Module	JPIOJI.DLL + (00004865)
URL visited	http://www.terkepbank.hu/
User Comments	Bug 270959 Crash if i visit the above with javascript enabled for
browsing Java was enabled. previous talkabck on this URL: TB2076348Y
Since Last Crash	859 sec
Total Uptime	979 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
JPIOJI.DLL + 0x4865 (0x6d444865)
JPINSCP.DLL + 0x3956 (0x6d423956)
PluginWndProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp,
line 273]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00638be6
timeless: thanks for citing that here.  So in what bugs does the comment 2 stack
backtrace belong, or is it an understood consequence of the Java crash bug?

/be
i'm not sure, and i'd rather not install java to figure it out. we're not even
shipping plugin support :), so i can hardly justify the research :).

the crashes are sorta all overe the map, but supposing that this one is a middle
ground:

Incident ID: 2076348
Stack Signature	MSVCRT.DLL + 0xd269 (0x7800d269) 05d755b9
Product ID	MozillaTrunk
Build ID	2004111904
Trigger Time	2004-11-20 10:55:08.0
Platform	Win32
Operating System	Windows 98 4.10 build 67766222
Module	MSVCRT.DLL + (0000d269)
URL visited	
User Comments	
Since Last Crash	120 sec
Total Uptime	120 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
MSVCRT.DLL + 0xd269 (0x7800d269)
MSVCRT.DLL + 0xcc3f (0x7800cc3f)
??3@YAXPAX@Z
nsRegionWin::Release 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/gfx/src/windows/nsRegionWin.cpp,
line 66]
nsCOMPtr_base::~nsCOMPtr_base 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/build/nsCOMPtr.cpp,
line 82]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2006]
HandleEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/view/src/nsView.cpp,
line 166]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1078]
nsWindow::DispatchWindowEvent 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1100]
nsWindow::OnPaint 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5087]
nsWindow::ProcessMessage 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 3863]
nsWindow::WindowProc 
[c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1356]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)
0x00638be6

and that what's happening is the plugin is causing a region to be destroyed or
have its refcount confused, then that could account for what we see. or perhaps
the plugin is just causing events to end up in places where mozilla isn't
expecting them.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a5) Gecko/20041124

I got this trace when going to http://www.terkepbank.hu using mozilla -g
(debugger: ddd/gdb)
I've uninstalled ALL java before running. Btw, if i start Mozilla as root, i
don't get any crashes, this might be the reason why some people don't have it.

....                                                                            
.... (similar lines)                                                           
                
....                                                                            
#110 0x40906c49 in NSGetModule () from /usr/local/mozilla/components/libgklayout
.so                                                                             
#111 0x408e7962 in NSGetModule () from /usr/local/mozilla/components/libgklayout
.so                                                                             
#112 0x408f2eaf in NSGetModule () from /usr/local/mozilla/components/libgklayout
.so                                                                             
#113 0x408f47b6 in NSGetModule () from /usr/local/mozilla/components/libgklayout
.so                                                                             
#114 0x408f292f in NSGetModule () from /usr/local/mozilla/components/libgklayout
.so                                                                             
#115 0x400ad5e7 in PL_HandleEvent () from ./libxpcom_core.so                    
#116 0x400ad514 in PL_ProcessPendingEvents () from ./libxpcom_core.so           
#117 0x400af18b in nsEventQueueImpl::ProcessPendingEvents() () from ./libxpcom_c
ore.so                                                                          
#118 0x40db5b85 in NSGetModule () from /usr/local/mozilla/components/libwidget_g
tk.so                                                                           
#119 0x40db573d in NSGetModule () from /usr/local/mozilla/components/libwidget_g
tk.so                                                                           
#120 0x403890a6 in g_io_add_watch () from /usr/lib/libglib-1.2.so.0             
#121 0x4038a9ae in g_get_current_time () from /usr/lib/libglib-1.2.so.0         
#122 0x4038ae89 in g_get_current_time () from /usr/lib/libglib-1.2.so.0         
#123 0x4038b124 in g_main_run () from /usr/lib/libglib-1.2.so.0                 
#124 0x402a62e3 in gtk_main () from /usr/lib/libgtk-1.2.so.0                    
#125 0x40db5d56 in NSGetModule () from /usr/local/mozilla/components/libwidget_g
tk.so                                                                           
#126 0x40d9ae64 in NSGetModule () from /usr/local/mozilla/components/libappcomps
.so                                                                             
#127 0x0804e441 in getCountry(nsAString const&, nsAString&) ()                  
#128 0x0804eff4 in main ()                                                      
#129 0x404c962d in __libc_start_main () from /lib/libc.so.6                     

This isn't a Java bug.

(In reply to comment #15)
> Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a5) Gecko/20041124
> 
> I got this trace when going to http://www.terkepbank.hu using mozilla -g
> (debugger: ddd/gdb)
> I've uninstalled ALL java before running. Btw, if i start Mozilla as root, i
> don't get any crashes, this might be the reason why some people don't have it.

> This isn't a Java bug.

Maybe there are two Bugs? 
One for non-root users on Linux not using Java, and the other one for a crashing
Plugin?
Using a current Mozilla Trunk nightly and Firefox 1.0, JS fully enabled, Java
disabled, I wasn´t able to crash, though trying hard by following links,
Loading/shift-Reloading. I´m using Win98, that is nearly comparable to surfing
as root ;-)

In comment 9 I´ve been crashing when Java was enabled, didn´t retest this today,
but I remember having tested with and without Java, and got the crash only when
Java was enabled.
(In reply to comment #16)
> > This isn't a Java bug.
> 
> Maybe there are two Bugs? 
> One for non-root users on Linux not using Java, and the other one for a crashing
> Plugin?
> 

In that case, my original bugreport: Bug 270959 should be detached from this one.
The page in http://www.terkepbank.hu/ contains applet code that makes extensive
use of Liveconnect, a feature that is problematic in the combination

Firefox 1.0.* + Sun's 1.5 plugin + Windows XP/2000

Probably related to bug 285451: if applet code calls JSObject.getWindow() many
times Firefox crashes. 
Was not able to force a crash with either 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050328

or

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317
Firefox/1.0.2

with Java 1.5.0_02
according to comment 18, this is likely a dup of bug 260478. But the fix for
260478 is windows-only, I don't know what causes mozilla crash in comment 15.
mass reassign my bugs to Pete Zha.
Assignee: kyle.yuan → pete.zha
mass reassign to Alfred
Assignee: zhayupeng → alfred.peng
No luck reproducing a crash on either http://www.terkepbank.hu or http://www.anfyteam.com/anj/wormhole/wormhole.html using 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060313 Firefox/1.5.0.2 and Java Plug-in/JRE 1.4.2_06
Summary: crash when loading this page which uses java [@ 0x00000000 - nsXULElement::QueryInterface][@ jpioji.dll ] → unreproduceable crash when loading terkepbank.hu java page [@ 0x00000000 - nsXULElement::QueryInterface][@ jpioji.dll ]
The bug can't be reproduced using Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.12) Gecko/20050919 Firefox/1.0.7 with Java Plug-in 1.5.0_06 here.

Could anyone help verify this bug?
Blocks: 353557
No longer blocks: 353557
closing WFM per comment 23 & 24
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → WORKSFORME
Product: Core → Core Graveyard
Crash Signature: [@ 0x00000000 - nsXULElement::QueryInterface] [@ jpioji.dll ]
You need to log in before you can comment on or make changes to this bug.