287492 - crash after loading a web page with java in it [@ ntdll.dll + 0x106c3 (0x7c9206c3) - EnsureZTreeNodeCreated][@ jpinscp.dll + (00002a3b)]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Java: Live Connect, defect)

Description

[Gabriel Chadwick]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.6) Gecko/20050318 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.6) Gecko/20050318 Firefox/1.0.2

After upgrading correctly to 1.0.2 i exprerience a crash after loading page with
java and sound in the java. The browser will crash randomly after loading this java.

Reproducible: Sometimes

Steps to Reproduce:
1.Load the page and the java ad.
2.Continue browsing.
3.It will crash.

Actual Results:  
It crashes but not always.

Expected Results:  
Not crashed.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

Can you provide a Talkback ID?

Comment 2

[Gabriel Chadwick]

here is a link to the report by the quality agent :
membres.lycos.fr/arkar/details.zip

Comment 3

[Gabriel Chadwick]

Here are the talkback ids

TB4561835H
TB4561509K
TB4561467M
TB4561034H

(In reply to comment #1)
> Can you provide a Talkback ID?

Comment 4

[:Gavin Sharp [email: [e-mail]]]

There are a number of these java crashers filed already, this is probably a dupe
of one of them.

Comment 5

[Gabriel Chadwick]

sorry

(In reply to comment #4)
> There are a number of these java crashers filed already, this is probably a dupe
> of one of them.

Comment 6

[timeless]

Incident ID: 4561835
Incident ID: 4561509
Stack Signature	ntdll.dll + 0x106c3 (0x7c9206c3) 0013beba
Product ID	Firefox10
Build ID	2005031812
Trigger Time	2005-03-23 20:15:48.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (000106c3)
URL visited	http://www2.canoe.com/cinema/bientot_en_videodvd.html
User Comments	it is the java ad that cause firefox to crash.
Since Last Crash	132 sec
Total Uptime	9119 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x106c3 (0x7c9206c3)
msvcrt.dll + 0x1c3c9 (0x77bfc3c9)
msvcrt.dll + 0x1c3e7 (0x77bfc3e7)
msvcrt.dll + 0x19cd4 (0x77bf9cd4)
EnsureZTreeNodeCreated 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 3363]
nsViewManager::BuildDisplayList 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2220]
nsViewManager::BuildEventTargetList 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2250]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2289]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
USER32.dll + 0x8709 (0x77d18709)
USER32.dll + 0x87eb (0x77d187eb)
USER32.dll + 0x89a5 (0x77d189a5)
USER32.dll + 0x89e8 (0x77d189e8)
nsAppShell::Run 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsAppShell.cpp,
line 159]
nsAppShellService::Run 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/xpfe/appshell/src/nsAppShellService.cpp,
line 495]
main 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 58]
kernel32.dll + 0x16d4f (0x7c816d4f)

Incident ID: 4561467
Bug 251088

Incident ID: 4561034
Stack Signature	ntdll.dll + 0x10f29 (0x7c920f29) 9319d1c6
Product ID	Firefox10
Build ID	2005031812
Trigger Time	2005-03-23 19:46:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	ntdll.dll + (00010f29)
URL visited	
User Comments	viewing a web page
Since Last Crash	8578 sec
Total Uptime	8578 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x10f29 (0x7c920f29)
ntdll.dll + 0x10d5c (0x7c920d5c)
msvcrt.dll + 0x1c2de (0x77bfc2de)
nsLineBox::Cleanup 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsLineBox.cpp,
line 124]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsTableFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 310]
nsTableOuterFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 82]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsTableFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/table/src/nsTableFrame.cpp,
line 310]
nsTableOuterFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/table/src/nsTableOuterFrame.cpp,
line 82]
CanvasFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsHTMLFrame.cpp,
line 240]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsFrameList::DestroyFrames 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/base/src/nsFrameList.cpp,
line 129]
nsBoxFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/xul/base/src/nsBoxFrame.cpp,
line 1065]
nsGfxScrollFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsGfxScrollFrame.cpp,
line 433]
nsPositionedInlineFrame::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsInlineFrame.cpp,
line 1103]
PresShell::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 1868]
DocumentViewerImpl::Destroy 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 1242]
DocumentViewerImpl::Show 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/content/base/src/nsDocumentViewer.cpp,
line 1504]
PresShell::UnsuppressAndInvalidate 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 4815]
PresShell::UnsuppressPainting 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/layout/html/base/src/nsPresShell.cpp,
line 4860]
PL_HandleEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/xpcom/threads/plevent.c,
line 674]
0x778b0c24
nsWyciwygChannel::SetNotificationCallbacks 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/content/html/document/src/nsWyciwygChannel.cpp,
line 225]
0xac02a302

Comment 7

[Hermann Schwab]

Bug also seen on older Trunk build.
Which version of Java do you use?
Type about:plugins and copy and paste the result, like this:
Java(TM) 2 Platform Standard Edition 5.0 Update 1
Java Plug-in 1.5.0_01 for Netscape Navigator (DLL Helper)

Latest version is Update 2, 1.5.0_02.


I had to look around to get a Java ad. When I succeeded, it was a nice crash.

http://www2.canoe.com/cinema/boxoffice.html

Mozilla/5.0 (Windows; U; Win98; de-DE; rv:1.7.6) Gecko/20050321 Firefox/1.0.2
Java(TM) 2 Platform Standard Edition 5.0 Update 1
Java Plug-in 1.5.0_01 for Netscape Navigator (DLL Helper)

I didn´t update this old Win98 Machine to Java Plug-in 1.5.0_02, will recheck,
when I did.


TB4579264Q
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB4579264Q

MSVCRT.DLL + 0x9a3b (0x78009a3b)
MSVCRT.DLL + 0x94b6 (0x780094b6)
nsViewManager::DestroyZTreeNode 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 221]
nsViewManager::DestroyZTreeNode 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 220]
nsViewManager::DestroyZTreeNode 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 219]
nsViewManager::BuildDisplayList 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2230]
nsViewManager::BuildEventTargetList 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2250]
nsViewManager::HandleEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2289]
nsViewManager::DispatchEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsViewManager.cpp,
line 2066]
HandleEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/view/src/nsView.cpp,
line 77]
nsWindow::DispatchEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1067]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5261]
ChildWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 5511]
nsWindow::WindowProc 
[c:/builds/tinderbox/Fx-Aviary1.0.1-l10n/WINNT_5.1_Clobber/mozilla/widget/src/windows/nsWindow.cpp,
line 1349]
KERNEL32.DLL + 0x363b (0xbff7363b)
KERNEL32.DLL + 0x242e7 (0xbff942e7)


Using an older, buggy Mozilla nightly to isolate another bug, i found:

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8a5) Gecko/20041006

http://www2.canoe.com/artsetculture/dossiers

Used  (german version of) the Java console to log:
Java Plug-in 1.5.0_01
Verwendung der JRE-Version 1.5.0_01 Java HotSpot(TM) Client VM

Applet ID : 2003-9-22-11-24-13  DEV AvGeLiMaSECURED_EYE_URLID:
Trace-Stufe auf 5 (alle) setzen ... abgeschlossen.
basic:
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_son_off.gif wird
aus dem Cache geladen
network: Verbindung von
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_droite.gif mit
Proxy=DIRECT wird hergestellt
network: Verbindung
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_droite.gif mit
Cookie "NGUserID=c0a8dcdc-21407-1111703873-2"
basic:
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_droite.gif wird
aus dem Cache geladen
network: Verbindung von
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_head.gif mit
Proxy=DIRECT wird hergestellt
network: Verbindung
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_head.gif mit
Cookie "NGUserID=c0a8dcdc-21407-1111703873-2"
basic: http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_head.gif
wird aus dem Cache geladen
network: Verbindung von
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_gauche.gif mit
Proxy=DIRECT wird hergestellt
network: Verbindung
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_gauche.gif mit
Cookie "NGUserID=c0a8dcdc-21407-1111703873-2"
basic:
http://imageads.canoe.ca/eyewonder/bleupoudre/eyeImages/eyebleu_gauche.gif wird
aus dem Cache geladen
network: Verbindung von
http://imageads.canoe.ca/eyewonder/bleupoudre/arafatAUD.eye mit Proxy=DIRECT
wird hergestellt
network: Verbindung http://imageads.canoe.ca/eyewonder/bleupoudre/arafatAUD.eye
mit Cookie "NGUserID=c0a8dcdc-21407-1111703873-2"
network: Verbindung von
http://imageads.canoe.ca/eyewonder/bleupoudre/arafatAUD.eye mit Proxy=DIRECT
wird hergestellt
network: Verbindung http://imageads.canoe.ca/eyewonder/bleupoudre/arafatAUD.eye
mit Cookie "NGUserID=c0a8dcdc-21407-1111703873-2"
network: Verbindung von
http://imageads.canoe.ca/eyewonder/bleupoudre/arafat90.eye mit Proxy=DIRECT wird
hergestellt
liveconnect: Die URL des Applets lautet http://imageads.canoe.ca, die
Berechtigung = false
liveconnect: Die URL des Applets lautet http://imageads.canoe.ca, die
Berechtigung = false
liveconnect: JavaScript: UniversalBrowserRead aktiviert
liveconnect: JavaScript: UniversalJavaPermission aktiviert
liveconnect: JSObject::call: Name=eyeEventListener
network: Verbindung http://imageads.canoe.ca/eyewonder/bleupoudre/arafat90.eye
mit Cookie "NGUserID=c0a8dcdc-21407-1111703873-2"
liveconnect: JSObject::call: Name=eyeEventListener
liveconnect: Die URL des Applets lautet http://imageads.canoe.ca, die
Berechtigung = false
liveconnect: Die URL des Applets lautet http://imageads.canoe.ca, die
Berechtigung = false
liveconnect: JavaScript: Java-Systemcode wird aufgerufen
liveconnect: JavaScript: Standard-Sicherheitsrichtlinie = http://www.canoe.com
liveconnect: JavaScript: Java-Systemcode wird aufgerufen
liveconnect: JavaScript: Standard-Sicherheitsrichtlinie = http://www.canoe.com
liveconnect: JavaScript: Java-Systemcode wird aufgerufen
liveconnect: JavaScript: Standard-Sicherheitsrichtlinie = http://www.canoe.com
liveconnect: JavaScript: Java-Systemcode wird aufgerufen
liveconnect: JavaScript: Standard-Sicherheitsrichtlinie = http://www.canoe.com
liveconnect: JavaScript: Java-Systemcode wird aufgerufen
liveconnect: JavaScript: Standard-Sicherheitsrichtlinie = http://www.canoe.com
liveconnect: JavaScript: Java-Systemcode wird aufgerufen
liveconnect: JavaScript: Standard-Sicherheitsrichtlinie = http://www.canoe.com

That is only a quick copy from the console to my editor, to save the data before
Mozilla, Java and console are crashing, so I don´t know if the event leading to
the crash is seen in this part of the log.

I don´t think this bug has anything todo with layout.
The applet started fine, liveconnect was running fine for a couple of cycles,
then crashed.

I´ve copied first part of another log, where
liveconnect: JSObject::call: Name=eyeEventListener and the lines below repeated
five times before I copied, and soon crashed afterwards.

Comment 8

[Gabriel Chadwick]

Another talkback id TB4586491Q. I am using the last version of java (1.5.0_02).

Comment 9

[Gabriel Chadwick]

Here is a talkback id with the nightly version 20050326 : TB4629984Y . I hope it
will help.

Comment 10

[timeless]

Incident ID: 4629984
Stack Signature	jpinscp.dll + 0x2a3b (0x6d422a3b) bc690e78
Product ID	FirefoxTrunk
Build ID	2005032606
Trigger Time	2005-03-26 21:01:24.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	jpinscp.dll + (00002a3b)
URL visited	http://www2.canoe.com/cinema/bientot_en_videodvd.html
User Comments	related to java
Since Last Crash	283 sec
Total Uptime	283 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
jpinscp.dll + 0x2a3b (0x6d422a3b)
jpinscp.dll + 0x7e8f (0x6d427e8f)
jpinscp.dll + 0x85ff (0x6d4285ff)
0x778b0c24
nsButtonFrameRenderer::GetButtonInnerFocusMargin 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/forms/nsButtonFrameRenderer.cpp,
line 249]
0xac02a302

Comment 11

[Gabriel Chadwick]

An other talkback id TB5026877E

Comment 12

[Gabriel Chadwick]

I get it again at the same adress just have to get the java add and it will crash using Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8b5) Gecko/20051006 Firefox/1.4.1

Comment 13

[Hermann Schwab]

didn't crash surfing around at canoe.com
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1) Gecko/20060922 BonEcho/2.0

Gabriel, do you still get crashes using Firefox 1.5.0.7 or 2.0, or can this bugbe resolved as wfm?

Current Java Update 8 available here: http://plugindoc.mozdev.org/windows.html#Java

Java is used in some calculators:
http://argent.canoe.com/calculateur/calc_epargne_etudes.html

Comment 14

[Gabriel Chadwick]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) Gecko/20060918 Firefox/2.0 ID:2006091818 but can't find the ads that trigered the crash... Will reopen if I find.