Closed Bug 292128 Opened 20 years ago Closed 18 years ago

applet calling javascript function replacing element innerHTML crashes firefox

Categories

(Core Graveyard :: Java: Live Connect, defect)

Product:
Core Graveyard
Component:
Java: Live Connect
Platform:
x86
Windows 2000
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: gilles, Unassigned)

References

(
URL
)

Details

(Keywords: crash)

Attachments

(3 files)

the web page to load
515 bytes, text/html
Details
jar file containing the applet class files and source code
2.69 KB, application/octet-stream
Details
this version doesn't use the applet, and works fine
433 bytes, text/html
Details 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

The applet CounterApplet (I will attach it later to this bug report) updates a
counter every 10ms, and calls a javascript function with the new value as an
argument. The javascript function replaces some element's innerHTML with the new
counter value. After running for a few seconds, this crashes firefox.

This was also happening when I was using mozilla, and started when I upgraded my
java plugin a while back (somewhere around 1.4 I would think, sorry I didn't put
that down). This doesn't happen with IE, whether it's using the ms jvm or the
sun one. I am now using version 1.5.0_02 of the java plugin.

This also doesn't happen if, instead of using the applet, the funciton is using
setTimeout() to call itself 10ms later. This confirms the problem is with the
interfacing with the java plugin.



Reproducible: Always

Steps to Reproduce:
I'm going to create attachments with all the files, but in the meantime:

1. create a web page counter.html with the following html:
<html>
<head>
	<title>test js</title>
	<script language="JavaScript">
	<!--
		function jscallback(cnt)
		{
			var elt = document.getElementById("num");
			if (elt != null)
			{
				var strData = "" + cnt;
				elt.innerHTML = strData;
			}
		}
	-->
	</script>
</head>
<body>

<applet id="counterapplet" 
		name="counterapplet"
		code="CounterApplet.class" 
		archive="counter.jar" 
		width="1" 
		height="1"
		mayscript>
</applet>

Counter: <span id="num">---</span>

</body>
</html>


2. put the following applet source code in file CounterApplet.java
import java.applet.*;
import netscape.javascript.*;

/**
 * Calls a javascript function every second, with an incremented counter as a
parameter.
 * The name of the callback is 'jscallback'.
 */
public class CounterApplet extends Applet
{
	private CounterThread m_counterThread = new CounterThread();
	
	//----------------------------------------------------------------
	public String getAppletInfo() 
	{
		return "calls a javascript function every second, with an incremented counter
as a parameter";
	}

	//----------------------------------------------------------------
	public void start() 
	{
		m_counterThread.setRunning(true);
	}

	//----------------------------------------------------------------
	public void stop() 
	{
		m_counterThread.setRunning(false);
	}

	//----------------------------------------------------------------
	public void destroy() 
	{
		m_counterThread.setStop(true);
	}
	
	//----------------------------------------------------------------
	public void init() 
	{
		new Thread(m_counterThread).start();
	}

	/**
	 * Loads a url in the background.
	 *///=============================================================
	class CounterThread implements Runnable
	{
		private boolean			m_bRunning = false;
		private boolean			m_bStop = false;
		private int					m_cnt = 0;
		
		//--------------------------------------------------------------
		private synchronized boolean	getRunning()						{return m_bRunning;}
		private synchronized void		setRunning(boolean bRunning)	{m_bRunning = bRunning;}
		
		private synchronized boolean	getStop()							{return m_bStop;}
		private synchronized void		setStop(boolean bStop)			{m_bStop = bStop;}
		
		//----------------------------------------------------------------
		public void run()
		{
			while (!getStop())
			{
				try
				{
					if (getRunning())
					{
						JSObject win = JSObject.getWindow(CounterApplet.this);
						win.call("jscallback", new Object[] {Integer.toString(m_cnt++)});
					}
					
					try
					{
						Thread.sleep(10);
					}
					catch (InterruptedException error)	{}
				}
				catch (Throwable error)
				{
					System.out.println(error);
				}
			}
		}    
	}
}

3. compile the applet (I'm using -target 1.1 to make it work with IE)
4. put the class files in a jar named counter.jar, in the same directory as the
   web page
3. open firefox and load the web page
4. the web page should display a counter which increments pretty fast
5. wait for firefox to crash (it takes a few seconds on my computer)

Actual Results:  
The firefox window disappears. Sometimes the talback window doesn't show up.

Expected Results:  
not crash ... ;)

talkback incident id: TB5403688M
Attached file the web page to load — 
The web page to load to reproduce the bug.
Save this file in the same directory as counter.html.
This version of the web page shows that not using the applet, but setTimeout()
instead, works fine.
Reporter, please can you try to duplicate this bug with a firefox nightly
(1.1beta) build from
http://www.ftp.uni-erlangen.de/pub/mozilla.org/firefox/nightly/2005-04-22-07-trunk/
And report back whether you still see this crash. Thanks!
I just checked the bug with the firefox nightly (1.1beta) build from
http://www.ftp.uni-erlangen.de/pub/mozilla.org/firefox/nightly/2005-04-22-07-trunk/
and that version crashed too.

I created a new talback incident, with id TB5448479Q.

Incident ID: 5448479
Stack Signature	ntdll.dll + 0x4c1e1 (0x77fcc1e1) 73e98333
Product ID	FirefoxTrunk
Build ID	2005042206
Trigger Time	2005-04-29 06:39:36.0
Platform	Win32
Operating System	Windows NT 5.0 build 2195
Module	ntdll.dll + (0004c1e1)
URL visited	local web page loading custom applet
User Comments	same as incident TB5403688M, but with latest development version
of firefox.
Since Last Crash	15 sec
Total Uptime	15 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
ntdll.dll + 0x4c1e1 (0x77fcc1e1)
MSVCRT.DLL + 0x1532 (0x78001532)
MSVCRT.DLL + 0x14cf (0x780014cf)
ToNewUnicode 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/string/src/nsReadableUtils.cpp,
line 375]
nsRange::CreateContextualFragment 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsRange.cpp,
line 2414]
nsGenericHTMLElement::SetInnerHTML 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 955]
nsGenericHTMLElementTearoff::SetInnerHTML 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/html/content/src/nsGenericHTMLElement.cpp,
line 213]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2065]
XPC_WN_GetterSetter 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1311]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1320]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1417]
js_InternalGetOrSet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1460]
js_SetProperty 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsobj.c, line 2870]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3437]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1340]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1417]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 3804]
nsCLiveconnect::Call 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/liveconnect/nsCLiveconnect.cpp,
line 553]
jpioji.dll + 0x3c10 (0x6d443c10)
jpinscp.dll + 0x7f6f (0x6d427f6f)
jpinscp.dll + 0x85ff (0x6d4285ff)
nsEventQueueImpl::PostSynchronousEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/xpcom/threads/nsEventQueue.cpp,
line 324]
nsJVMManager::PostEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/modules/oji/src/nsJVMManager.cpp,
line 345]
jpioji.dll + 0x1bd3 (0x6d441bd3)
jpinscp.dll + 0x396d (0x6d42396d)
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x6b41 (0x77e16b41)
USER32.dll + 0x6b64 (0x77e16b64)
PluginWndProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp,
line 273]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 145]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7c59893d)
Assignee: nobody → live-connect
Severity: normal → critical
Component: General → Java: Live Connect
Keywords: crash
Product: Firefox → Core
QA Contact: general → pschwartau
Version: unspecified → Trunk
Is this still happening with a current trunk build?
I just tried it on the build from June 8th, and it crashed. The talkback
incident ID is TB6552657W.

The stack there is:


0x286d441d
jpioji.dll + 0x4f0f (0x6d444f0f)
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x6b41 (0x77e16b41)
USER32.dll + 0x6b64 (0x77e16b64)
PluginWndProc 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp,
line 273]
USER32.dll + 0x2a3d0 (0x77e3a3d0)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Run 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 145]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.2_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 61]
KERNEL32.DLL + 0x2893d (0x7c59893d)
I just tested the applet with firefox 1.0.4 and the sun jre 5.0 update 4, and it
didn't crash. I let the applet run for 30 minutes, while it used to take only a
few seconds to crash. So I guess it was a bug in the jvm, and it's been fixed in
that release.


Seems to be be WFM or FIXED.
=>WFM from comment 10.
Status: UNCONFIRMED → RESOLVED
Closed: 18 years ago
Resolution: --- → WORKSFORME
Feel free to reopen it if you can reproduce it on the latest releases or
builds.
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: