285451 - Several consecutive calls to JSObject crashes Firefox [@ jpioji.dll + 0x4865 (0x6d444865)]

Status: RESOLVED DUPLICATE of bug 260478

(Core Graveyard :: Java: OJI, defect)

Description

[Giovani Pieri]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050308 Firefox/1.0+

When an applet executes several calls to JSObject to execute some javascript 
code firefox crashes. I created an example to demonstrate this behaviour, it 
may be found on http://telis.edugraf.ufsc.br/apliques/Giovani/quebrandoTudo/ 
the html page has just an applet and a textbox, the applet uses javascript to 
change the content of the text box.

I've tested it on Windows XP java 5 and Conectiva Linux. On Conectiva no 
problems have happened.

Reproducible: Always

Steps to Reproduce:
1. Create an html page with an applet and a textbox
2. Make the applet change the value of the textbox with JSObject.eval
("document.getElementById().value='valor'") about a hundread times (it normally 
crashes on the 40th, 60th change)

Actual Results:  
The browser crashed and Mozilla Feed Back Agent show up.

Expected Results:  
Change the content of the textbox. Without crashing.

The Talkback crash ID is: 4221939.

Comment 1

[timeless]

Incident ID: 4221939
Stack Signature	jpioji.dll + 0x4865 (0x6d444865) e2b07837
Product ID	FirefoxTrunk
Build ID	2005030806
Trigger Time	2005-03-09 04:54:03.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	jpioji.dll + (00004865)
URL visited	http://telis.edugraf.ufsc.br/apliques/Giovani/quebrandoTudo/teste.html
User Comments	I was testing java to javascript communication (LiveConnect) on
java 5 and Windows XP. The source of the applet is on
http://telis.edugraf.ufsc.br/apliques/Giovani/quebrandoTudo/teste.java
Since Last Crash	54 sec
Total Uptime	54 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
jpioji.dll + 0x4865 (0x6d444865)
jpinscp.dll + 0x3956 (0x6d423956)
USER32.dll + 0x8709 (0x77d28709)
USER32.dll + 0x87eb (0x77d287eb)
USER32.dll + 0xc00e (0x77d2c00e)
USER32.dll + 0xe366 (0x77d2e366)
PluginWndProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp,
line 273]
USER32.dll + 0x8709 (0x77d28709)
USER32.dll + 0x87eb (0x77d287eb)
USER32.dll + 0x89a5 (0x77d289a5)
USER32.dll + 0x89e8 (0x77d289e8)
nsAppShell::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 145]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
kernel32.dll + 0x16d4f (0x7c816d4f)

Comment 2

[Bob Clary [:bc] (inactive)]

I can confirm the crash with yesterdays' seamonkey trunk build on winxp. It
crashes so hard, the "debug dialog" doesn't even show. Can confirm the stack in
yesterday's firefox trunk debug build.

Comment 3

[Bob Clary [:bc] (inactive)]

probably a dupe of bug 215872 

Comment 4

[Charles Fenwick]

URL crashed me using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
Gecko/20050328

Testcase in bug 215872 had no effect.

Comment 5

[Robin Monks]

*** This bug has been marked as a duplicate of 260478 ***