287034 - Crash [@jpinsp.dll] when shutting down browser while running Java applet

Status: RESOLVED WONTFIX

(Core Graveyard :: Java: OJI, defect)

Description

[Gervase Markham [:gerv]]

We are reproducibly getting the following crash when shutting down trunk Firefox
while it's running a Java applet which is part of one of our products. The
problem also occurs in Firefox 1.0.

jpinsp.dll + 0x6626 (0x6d386626)
nsFrameList::DestroyFrames  [layout/generic/nsFrameList.cpp, line 129]
nsLineBox::DeleteLineList   [layout/generic/nsLineBox.cpp, line 318]
CanvasFrame::Destroy        [layout/generic/nsHTMLFrame.cpp, line 230]
nsFrameList::DestroyFrames  [layout/generic/nsFrameList.cpp, line 129]
...

Example talkback report with complete stack:
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4382548Y

If it would be helpful, it may be possible to get access to a system running the
applet for the person who is looking at this.

Gerv

Comment 1

[Matthias Versen [:Matti]]

jpinsp.dll is AFAIK part of the Java plugin (1.4.x) and it looks like the Java
plugin itself is crashing. 
Which JRE Do you use and did you try it with JRE1.5.x ?

Comment 2

[Jim Wilkinson]

Gerv raised this bug for me.  I've reproed on various flavours of Sun JRE 
1.4.2 and also 1.5.0 and 1.5.0_01.  I'm happy to try with another version if 
that will be useful.

Comment 3

[Gervase Markham [:gerv]]

Kyle: are you able to take a look at this, or recommend someone who can?

Gerv

Comment 4

[Kyle Yuan]

Jim, do you have any particular testcase or url to help me recreate the problem?
Apparently the talkback data in comment 0 was collected with jre 1.4.2. Did you
get any talkback id with jre 1.5?

Comment 5

[Jim Wilkinson]

Kyle,

I have the following Talkback IDs that have all occurred on JRE 1.5.0_0x:

TB4406273Q
TB4541335Y
TB4515766W
TB4382020Y
TB4363301Q
TB4363077G
TB4359692K

I'm currently investigating the possibility of getting you access to one of 
our systems so that you can repro yourself.

Jim

Comment 6

[Gervase Markham [:gerv]]

Kyle: did you have any luck with tracking this down?

Gerv

Comment 7

[Kyle Yuan]

Since the crash happens in jvm, I've filed a bug to the Sun Java Plugin team.
Haven't heard anything back from them yet.

Comment 8

[Kyle Yuan]

mass reassign my bugs to Pete Zha.

Comment 9

[Gervase Markham [:gerv]]

Kyle: any more news?

Gerv

Comment 10

[Pete Zha]

mass reassign to Alfred

Comment 11

[Gervase Markham [:gerv]]

We now have an entirely new Java plugin architecture; the chances of this bug still being useful are 0.

Gerv