Closed Bug 422324 Opened 16 years ago Closed 16 years ago

Crash on Java applets at processing.org [@ nsObjectFrame::CallSetWindow]

Categories

(Core Graveyard :: Plug-ins, defect)

Product:
Core Graveyard
Component:
Plug-ins
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 421833

People

(Reporter: fehe, Unassigned)

References

(
URL
)

Details

(Keywords: crash, topcrash)

Crash Data

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008031109 Minefield/3.0b5pre (like Firefox/2.0.0.13)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5pre) Gecko/2008031109 Minefield/3.0b5pre

When running the java applets at the referenced URL, Firefox crashes.  Sun JRE SE 6 Update 5.

Local Breakpad appears to be broken, because I submitted two crash reports a few minutes ago but all I can find is my old IDs for crashes from Feb 21 to 23.  As such, I cannot provide Breakpad IDs.


Reproducible: Always

Steps to Reproduce:
1. Install JRE SE 6 Update 5, if you don't already have it installed
2. Make sure both JavaScript and Java are enabled then visit the referenced URL
3. Click the drop-down list (on the left) to select applets to run.

Firefox should crash on at least some of those.  I tried the ones under Transform, but others probably also work.

Actual Results:  
Firefox crashes.
Version: unspecified → Trunk
wfm with Java 5 Update 6 and Firefox 3 Beta4.
Can you please try it again in the Firefox safemode : http://kb.mozillazine.org/Safe_Mode
Thanks for the feedback.  Found the cause.  If either Adblock Plus or NoScript (or both) is enabled, crashing occurs with the aforementioned URL.

I will endeavor to contact the extension authors to investigate whether this is a problem with their extensions or a problem with Firefox itself.

we'd still like a stack trace if at all possible, try:
http://developer.mozilla.org/en/docs/How_to_get_a_stacktrace_with_WinDbg
Keywords: crash, stackwanted
I was able to reproduce this crash, here is my breakpad URL: http://crash-stats.mozilla.com/report/index/ff101878-f059-11dc-9133-001a4bd43ef6. Giving a 404 for now but hopefully the digester will catch up.
Status: UNCONFIRMED → NEW
Ever confirmed: true
A stack trace:

ChildEBP RetAddr  
0012fe20 7c90e89a ntdll!KiFastSystemCallRet
0012fe24 7c81cd96 ntdll!ZwTerminateProcess+0xc
0012ff20 7c81cdee kernel32!_ExitProcess+0x62
0012ff34 6000179e kernel32!ExitProcess+0x14
0012ff40 60001b66 MOZCRT19!__crtExitProcess(int status = 1610619886)+0x2e [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\memory\jemalloc\src\crt0dat.c @ 683]
0012ff78 60001bee MOZCRT19!doexit(int code = 0, int quick = 0, int retcaller = 0)+0x116 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\memory\jemalloc\src\crt0dat.c @ 596]
0012ff88 00401439 MOZCRT19!exit(int code = 2088857559)+0xe [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\memory\jemalloc\src\crt0dat.c @ 398]
0012ffc0 7c816fd7 firefox!__tmainCRTStartup(void)+0x169 [e:\builds\tinderbox\fx-trunk\winnt_5.2_depend\mozilla\obj-fx-trunk\memory\jemalloc\src\crtexe.c @ 605]
0012fff0 00000000 kernel32!BaseProcessStart+0x23

I can reproduce (after changing applet several times, though) on a clean profile with just a NOP JS content policy ({shouldLoad:#1=(function () {return 1;}), shouldProcess:#1#}).
Judging by the stack, looks actually like a dupe of bug 409566

timeless, is it a dupe for you too?
BTW, are crashers like these automatically considered blockers for 1.9, or should we ask blocking status for that bug? I definitely want it fixed in Fx 3...
wrt windbg, you need to select [x] debug child processes also.

you have a couple of stacks, one is i believe a duplicate of bug 409566 comment 9.

Here is the other one:
Signature	nsObjectFrame::CallSetWindow()
UUID	fdf7ad1e-f010-11dc-a7d2-001a4bd43e5c
Time	2008-03-12 01:47:46-07:00
Uptime	0
Product	Firefox
Version	3.0b5pre
Build ID	2008031109
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 8 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x1
Comments	
Crashing Thread
Frame 	Signature 	Source
0 	nsObjectFrame::CallSetWindow() 	mozilla/layout/generic/nsObjectFrame.cpp:876
1 	nsObjectFrame::Instantiate(char const*, nsIURI*) 	mozilla/layout/generic/nsObjectFrame.cpp:1650
2 	nsObjectLoadingContent::Instantiate(nsIObjectFrame*, nsACString_internal const&, nsIURI*) 	mozilla/content/base/src/nsObjectLoadingContent.cpp:1635
3 	nsObjectLoadingContent::EnsureInstantiation(nsIPluginInstance**) 	mozilla/content/base/src/nsObjectLoadingContent.cpp:724
4 	nsHTMLPluginObjElementSH::GetPluginInstance(nsIXPConnectWrappedNative*, nsIPluginInstance**) 	mozilla/dom/src/base/nsDOMClassInfo.cpp:8815
5 	nsHTMLPluginObjElementSH::NewResolve(nsIXPConnectWrappedNative*, JSContext*, JSObject*, long, unsigned int, JSObject**, int*) 	mozilla/dom/src/base/nsDOMClassInfo.cpp:9287
6 	XPCWrapper::ResolveNativeProperty(JSContext*, JSObject*, JSObject*, XPCWrappedNative*, long, unsigned int, JSObject**, int) 	mozilla/js/src/xpconnect/src/XPCWrapper.cpp:438
7 	XPC_NW_NewResolve 	mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp:641
8 	js_LookupPropertyWithFlags 	mozilla/js/src/jsobj.c:3296
9 	js_GetPropertyHelper 	mozilla/js/src/jsobj.c:3612
10 	js_Interpret 	mozilla/js/src/jsinterp.c:4231
11 	js_Invoke 	mozilla/js/src/jsinterp.c:1291
12 	js_InternalInvoke 	mozilla/js/src/jsinterp.c:1347
13 	JS_CallFunctionValue 	mozilla/js/src/jsapi.c:5024
14 	nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) 	mozilla/dom/src/base/nsJSEnvironment.cpp:1961
15 	nsGlobalWindow::RunTimeout(nsTimeout*) 	mozilla/dom/src/base/nsGlobalWindow.cpp:7739
16 	nsGlobalWindow::TimerCallback(nsITimer*, void*) 	mozilla/dom/src/base/nsGlobalWindow.cpp:8070
17 	nsTimerImpl::Fire() 	mozilla/xpcom/threads/nsTimerImpl.cpp:400
18 	nsTimerEvent::Run() 	mozilla/xpcom/threads/nsTimerImpl.cpp:490
19 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:510
20 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:151
21 	PR_GetEnv 	
22 	wmain 	mozilla/toolkit/xre/nsWindowsWMain.cpp:87
23 	firefox.exe@0x217f 	
24 	BaseProcessStart
Component: General → Plug-ins
Keywords: stackwanted
Product: Firefox → Core
QA Contact: general → plugins
Summary: Crash on Java applets at processing.org → Crash on Java applets at processing.org [@ nsObjectFrame::CallSetWindow]
(In reply to comment #8)
> wrt windbg, you need to select [x] debug child processes also.
> 

I could not find that option on WinDbg 6.8.0004.0.  Where do I find it?

Could be related to bug 418514 (adblock+ and java are crashing)
if you use file>open executable, it's in the dialog at the bottom.

if you're using attach to process, then i'd hope you don't reach this state (i just updated to 6.8 and the checkbox is definitely there).
(In reply to comment #11)
> if you use file>open executable, it's in the dialog at the bottom.
> 

Thanks.  Finally got it.  Here are two stack traces.  Note: Both crashes occurred for different applets:

FIRST RUN
---------
(df4.4ec): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=6d4232a2 ebx=00000000 ecx=40000000 edx=00000000 esi=6d423279 edi=000340e8
eip=6d4232a4 esp=00033000 ebp=00034080 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Java\jre1.6.0_05\bin\jpinscp.dll - 
jpinscp+0x32a4:
6d4232a4 57              push    edi
0:000> kb
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00034080 7e418734 000401d2 0000000f 00000000 jpinscp+0x32a4
000340ac 7e418816 6d423279 000401d2 0000000f USER32!InternalCallWinProc+0x28
00034114 7e41c63f 00000000 6d423279 000401d2 USER32!UserCallWinProcCheckWow+0x150
00034144 7e41f65d 6d423279 000401d2 0000000f USER32!CallWindowProcAorW+0x98
00034164 6d42374e 6d423279 000401d2 0000000f USER32!CallWindowProcA+0x1b
00035204 7e418734 000401d2 0000000f 00000000 jpinscp+0x374e
00035230 7e418816 6d423279 000401d2 0000000f USER32!InternalCallWinProc+0x28
00035298 7e41c63f 00000000 6d423279 000401d2 USER32!UserCallWinProcCheckWow+0x150
000352c8 7e41f65d 6d423279 000401d2 0000000f USER32!CallWindowProcAorW+0x98
000352e8 6d42374e 6d423279 000401d2 0000000f USER32!CallWindowProcA+0x1b
00036388 7e418734 000401d2 0000000f 00000000 jpinscp+0x374e
000363b4 7e418816 6d423279 000401d2 0000000f USER32!InternalCallWinProc+0x28
0003641c 7e41c63f 00000000 6d423279 000401d2 USER32!UserCallWinProcCheckWow+0x150
0003644c 7e41f65d 6d423279 000401d2 0000000f USER32!CallWindowProcAorW+0x98
0003646c 6d42374e 6d423279 000401d2 0000000f USER32!CallWindowProcA+0x1b
0003750c 7e418734 000401d2 0000000f 00000000 jpinscp+0x374e
00037538 7e418816 6d423279 000401d2 0000000f USER32!InternalCallWinProc+0x28
000375a0 7e41c63f 00000000 6d423279 000401d2 USER32!UserCallWinProcCheckWow+0x150
000375d0 7e41f65d 6d423279 000401d2 0000000f USER32!CallWindowProcAorW+0x98
000375f0 6d42374e 6d423279 000401d2 0000000f USER32!CallWindowProcA+0x1b


SECOND RUN
----------
(9d0.ce8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00006b08 ebx=00006b06 ecx=209909b8 edx=00b73e99 esi=00fe0000 edi=00d2d892
eip=05425664 esp=085ff6b0 ebp=085ff708 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
05425664 850500014802    test    dword ptr ds:[2480100h],eax ds:0023:02480100=????????
0:025> kb
ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
085ff708 05442ec6 0000008d 4243c50a bef4dd6d 0x5425664
085ff778 054334ae 3f6c5a59 434709f4 4301c83c 0x5442ec6
085ff838 0542d1a3 00000002 00000003 3ec6630f 0x54334ae
085ff928 05445ece 26c1f18d 085ff958 085ff980 0x542d1a3
085ff948 05302c7a c0800000 41000000 05302c87 0x5445ece
085ff980 05302c87 209be9e8 085ff98c 26bced39 0x5302c7a
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\PROGRA~1\Java\JRE16~2.0_0\bin\client\jvm.dll - 
085ffaa0 6d88b99c 00001f80 085ffbd0 073e4400 0x5302c87
085ffab8 6d88bd2d 085ffb14 085ffc8c 0000000a jvm!AsyncGetCallTrace+0x2d2cc
085ffb30 6d913441 085ffc84 085ffb00 085ffbd0 jvm!AsyncGetCallTrace+0x2d65d
085ffca8 6d966792 073e4400 073e4400 073e4400 jvm!JVM_FindSignal+0x502f1
085ffcd0 6d9130ac 7c926abe 085ffd10 7c96cde9 jvm!JVM_FindSignal+0xa3642
085ffcd4 7c926abe 085ffd10 7c96cde9 02430000 jvm!JVM_FindSignal+0x4ff5c
6d9130ac ebffffff ec458b17 f2b2e850 8bc3ffff ntdll!RtlFreeHeapSlowly+0x5c2
6d9130ac 00000000 ec458b17 f2b2e850 8bc3ffff 0xebffffff

your first stack matches bug 409566, your second stack doesn't match any of the other stacks we have. wonderful.

i think the thing to do is to file a new bug for your second stack, and then file a bug report w/ sun w/ the same stack including the url (i hope you have) of the crash (include that in the url for the bug report you file w/ us too) and the url to our bug report. then update our report w/ the sun bug report url. and finally comment here w/ the bug number for that stack.
(In reply to comment #13)
> i think the thing to do is to file a new bug for your second stack, and then
> file a bug report w/ sun w/ the same stack including the url (i hope you have)
> of the crash (include that in the url for the bug report you file w/ us too)
> and the url to our bug report. then update our report w/ the sun bug report
> url. and finally comment here w/ the bug number for that stack.
> 

I've just filed Bug 422751 plus a bug report with Sun.  If Sun assigns me a bug number, I will update that bug with it.

Looks like I cannot reproduce this anymore with Java Plugin 1.6.0_10 beta (new Plugin architecture may have helped here).

Same trunk build:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008040404 Minefield/3.0pre eMusic DLM/4.0_1.0.0.1)

1.6 Update 5 stable crashes, 1.6 Update 10 doesn't.

Fixed on Sun side?
Component: Plug-ins → Build Config
Please do not change the component to "build config"
Component: Build Config → Plug-ins
Matthias, did I? 
If so, it's been unintentional (I don't recall to have touched the component drop-down).
This should've been fixed by the fix for bug 421833 (dupe). Marking duplicate.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ nsObjectFrame::CallSetWindow]
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.