404911 - Crash at jpinscp.dll@0xcf45 when leaving page with non-executed Java applet signed by expired certificate.

Status: VERIFIED DUPLICATE of bug 275783

(Core Graveyard :: Plug-ins, defect)

Description

[Masahiro YAMADA]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b2pre) Gecko/2007112106 Firefox/3.0b2pre
Build Identifier: 

I'm using with JRE 1.6.0_03-b05

When leaving web page that contains Java Applet (but it is not executed)
Java Applet is digital signed. But its certification is already expired.
It causes JRE to display dialog to confirm to execute the applet.

When clicking "cancel" of the dialog, execution of the applet is canceled.

At the moment , Minefield still works.
But when leaving the applet-page (closing window or show other web page) , Minefield will crash.


Reproducible: Always

Steps to Reproduce:
1.Change your preference "general.useragent.extra.firefox" to be start with "Firefox" (sample: "Firefox/3.0b2")
2.http://www.trendflexsecurity.jp/service_components/jp/portal/applet_index.php?PARAM=893B3FE84A1D80067B037C65884FDF513F9F622CEE1C25C3E0282C4FCC0A164D3F21EF7D7E76AE1ACB989052756FE15BEFD885DBC76790C7BECAFE3D9674522C2789D073C8850C45D8C7FEB0EEC0A6671D9B8206F64974FBF22261EE7A26C2473383D57D218BB8FCA3D1304644A762A3641EF687B67807A5268CE40D1732D47A
3. cancel execution of Java Applet.
4. leave the page (Close window / Goto )

Actual Results:  
Minefield will crash.

Expected Results:  
Minefield should not crash.

When using firefox2, crash does not happen. But, after closing all window , process of "firefox.exe" is still exist and it never stops.

I want to send crash report. But crash-reporter always fails to submit with error:
> Crash report submision failed: Unknown error, error code: 0x00002f19
How should I send crash report?

Comment 1

[Masahiro YAMADA]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b2pre) Gecko/2007112505 Firefox/3.0b2pre

Crash ID: bp-82833c9c-9be8-11dc-8aa5-001a4bd43e5c

Comment 2

[Masahiro YAMADA]

I reported this bug to sun.

Comment 3

[Masahiro YAMADA]

According to crash report, this issue seems to be stack overflow caused by inifinitly recursive call.

Frames
-------------
0  	jpinscp.dll@0xcf45  	
1 	InternalCallWinProc 	
2 	UserCallWinProcCheckWow 	
3 	CallWindowProcAorW 	
4 	CallWindowProcA 	
5 	jpinscp.dll@0x3788 	
6 	InternalCallWinProc 	
7 	UserCallWinProcCheckWow 	
8 	CallWindowProcAorW 	
9 	CallWindowProcA 	

# Stack frame from 10 to 1149 is 228 times repeat of 5 to 9.

1150  	PluginWndProc  	 mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp:357
1151 	InternalCallWinProc 	
1152 	UserCallWinProcCheckWow 	
1153 	DispatchClientMessage 	
1154 	__fnDWORD 	
1155 	KiUserCallbackDispatcher 	
1156 	nsDelayedPopupsEnabledEvent::Run() 	mozilla/modules/plugin/base/src/nsPluginNativeWindowWin.cpp:199
1157 	TestWindowProcess 	
1158 	nsLineBox::DeleteLineList(nsPresContext*, nsLineList&) 	mozilla/layout/generic/nsLineBox.cpp:340
1159 	nsBlockFrame::Destroy() 	mozilla/layout/generic/nsBlockFrame.cpp:300
1160 	nsFrameList::DestroyFrames() 	mozilla/layout/generic/nsFrameList.cpp:67
1161 	nsContainerFrame::Destroy() 	mozilla/layout/generic/nsContainerFrame.cpp:257
1162 	CanvasFrame::Destroy() 	mozilla/layout/generic/nsHTMLFrame.cpp:206
1163 	nsFrameList::DestroyFrames() 	mozilla/layout/generic/nsFrameList.cpp:67
1164 	nsContainerFrame::Destroy() 	mozilla/layout/generic/nsContainerFrame.cpp:257
1165 	nsFrameList::DestroyFrames() 	mozilla/layout/generic/nsFrameList.cpp:67
1166 	nsContainerFrame::Destroy() 	mozilla/layout/generic/nsContainerFrame.cpp:257
1167 	nsFrameManager::Destroy() 	mozilla/layout/base/nsFrameManager.cpp:283
1168 	PresShell::Destroy() 	mozilla/layout/base/nsPresShell.cpp:1673
1169 	DocumentViewerImpl::Destroy() 	mozilla/layout/base/nsDocumentViewer.cpp:1521
1170 	nsDocShell::Destroy() 	mozilla/docshell/base/nsDocShell.cpp:3654
1171 	nsFrameLoader::Destroy() 	mozilla/content/base/src/nsFrameLoader.cpp:265
1172 	nsGenericHTMLFrameElement::DestroyContent() 	mozilla/content/html/content/src/nsGenericHTMLElement.cpp:3007
1173 	nsGenericElement::DestroyContent() 	mozilla/content/base/src/nsGenericElement.cpp:2900
1174 	nsGenericElement::DestroyContent() 	mozilla/content/base/src/nsGenericElement.cpp:2900
1175 	nsDocument::Destroy() 	mozilla/content/base/src/nsDocument.cpp:5424
1176 	DocumentViewerImpl::Close(nsISHEntry*) 	mozilla/layout/base/nsDocumentViewer.cpp:1316

Comment 4

[Masahiro YAMADA]

This issue seems to be DUPLICATE of bug 275783.
Because bug 275783 comment #68 has same stacktrace.
And , at both of this issue and it, crashed when leaving the page.

Comment 5

[Masahiro YAMADA]

When Usging Java 6 Update 10 (Official release), this bug is not reproduced.