86591 - Trunk & M094 linux topcrash when Java and Flash present [@ ProxyJNIEnv::ProxyJNIEnv][@libjavaplugin_oji.so]

Status: VERIFIED FIXED

Description

[Vladimir Kondratiev]

build 2001061821
Flash5 plug-in 5.0r47
XFree86 4.1.0 (RawHide)

Upon start, about:plugins displayed "libflashplayer" as "Default plugin" with
all characteristics (mime type, extensions etc.).
When I try to load any page that uses flash, browser segfaults.

Reproducible: always.

Comment 1

[Gilles Durys]

confirming using 2001061821 trunk linux and flash 5.0r47

url to test: http://www.zipiz.com/

Comment 2

[Jens-Uwe]

confirming.
blocker?

Comment 3

[Gilles Durys]

*** Bug 86618 has been marked as a duplicate of this bug. ***

Comment 4

[Matthew Miller]

I'd vote for it as a blocker -- a lot of stuff I do uses flash. And even for
sites that use it but don't require it, it's pretty solidly annoying to keep
having to dismiss the "this site requires a plugin" dialog.

I'm using build 2001061905, btw.

Comment 5

[shrirang khanzode]

works for me on 2001061808 trunk on redhat linux 6.1. Also, 'about:plugins' is 
showing the correct info. What's ur OS guys ?

Comment 6

[Matthew Miller]

Linux. That's why the bug says OS:Linux :)

Notice that everyone who has the problem has a build later than the one you
have. Try something from today and see what happens.

Comment 7

[shrirang khanzode]

ok..will try a latest build..and I meant..the OS version.. ;). Lately some users 
are seeing problems with redhat 7.1 which do not show in 6.1 ..that's why..

Comment 8

[Matthew Miller]

It's BU Linux 1.1, which is based on Red Hat 6.2. Kernel is 2.2.19. I don't
think that's the issue in this case.

Comment 9

[Francisco León]

Yup confirming this one, linux 2001061821
This should be blocker and regression
Bad, bad bug

Comment 10

[Theblueman]

Not sure if this is relavent, but flash worked properly with build
2001-06-18-08(linux).  Bug 74313 ( resized gifs not displaying) was successfully
implemented in latest 2 builds which is when I noticed the problem.  

Comment 11

[yiming chung]

good point. I was going to say it works on my 06-17 build but your test result
is even better.  May be we can start looking into changes made between 
2001-06-18-08(linux) and 2001061821. 

Comment 12

[Chase Tingley]

*** Bug 86679 has been marked as a duplicate of this bug. ***

Comment 13

[Chase Tingley]

Note that these pages (including www.weather.com, www.time.com from the bug I
just duped) are crashing my 2001061909/Linux even though I don't have flash
installed.  Yuck.

Comment 14

[Francisco León]

Well, i also no longer see the "hey QFA: talkback loaded ok" thing so this may
also be broken.

Java works

This is going to make 0.9.2 really bad

Comment 15

[Chris Hiner]

I just crashed my linux cvs build from 6/19 19:30 on http://www.weather.com/
Redhat 6.2, java 1.3.0_01.  It displayed correctly on the about:plugins page.
I'll attach the stack trace.  The stack trace says java all over it.  I removed
my java plugin, and then the flash on www.weather.com worked fine.

Comment 16

[Chris Hiner]

Created attachment 39275 [details]
stack trace

Comment 17

[Peter Lubczynski]

This is a crash in the Java plugin. Over to the OJI group who probably know
where this bug should go.

Comment 18

[Chris Hiner]

With a new linux cvs build from this morning with java and flash enabled, I can
no longer duplicate the crash on http://www.weather.com/
It appears one of the many checkins from last night fixed whatever was causing
it.  Java appears to work on java.sun.com, and flash works
on www.time.com.

Comment 19

[Peter Lubczynski]

Per last comments, marking WORKSFORME. I had a hunch it was fixed.

Comment 20

[Scott Kester]

I am still seeing a problem, but not a crash.  If I have java enabled, the flash
on www.weather.com does not work.  If I disable java via
(Edit->Prefs->Advanced->Java), the flash works fine.  It's java or flash but not
both.  I can't re-open this bug, so should I file a new one?  Also can someone
else try to verify this behavior?  I am running RH 7.0 and mozilla build 2001062008

Comment 21

[Francisco León]

Flash plugin is now "detected" on later builds, but some pages are having
trouble with it. Check out bug 86127 testcase
I can hear the flash plugin, but i cant see it.
Please i want as much people as i can get to test that one
http://cgi.cartoonnetworkla.com/cgi-bin/postcards_xmas.pl?command=claim&id=992632357s

Comment 22

[Vladimir Kondratiev]

build 2001-06-20-21-trunk on Linux,
Flash is working on http://www.macromedia.com/software/flash/about/
however I need to reload this URL several times.
Java is working on http://java.sun.com/
URL mentioned
(http://cgi.cartoonnetworkla.com/cgi-bin/postcards_xmas.pl?command=claim&id=992632357s)
causes segfault.

Comment 23

[Francisco León]

This needs to be reopen
2001062015 linux
I installed java2, made the symlink, installed flash...
Went to my old webpage (http://espectro.hypermart.net)
Flash applet does not work
Now see a curious thing... Right click on the black webpage where the flash
applet is supposed to see... What do you get?
¨Movie not loaded, about flash player 4"
Flash player 4? I have 5, latest version, as all of you do!

Comment 24

[Francisco León]

This behavior i described in last post is not constant. Went back again and now
it  works. However, i went to my test case (the cartoonnetwork page) and neither
flash shows up but it shows the "about flash player 4 " thing
In the about:plugins i get all plugins, with correct versions

Comment 25

[shrirang khanzode]

reopening based on bug 88479

Comment 26

[Peter Lubczynski]

nominating and cc:ing a some of people...
If this is still happening, it's a topcrash on a top100 site.

dupping and copying comments from bug 88479:

This bug is a topcrasher for trunk & M092.
Here are some URLs & Comments that might help repro this crash:

M092:
 (32294315)	URL: onepunch.com
     (32294315)	Comments: if a virgin version of plugins is found
     (32294315)	Comments:  sun.java.com
     (32294315)	Comments:  would stop the mozilla .9.2.After restarting the machine and then X
     (32294315)	Comments:  work as plugins or external apps on eitherthe build of 9.1 or 9.2
I have on my box now. Mime types are listedand the files are downloaded
     (32294315)	Comments:  Please list this as a bug.
     (32292919)	URL: onepunch.com
     (32292919)	Comments: had just copyed flash plugins into plugins directory.Restarted
mozilla .9.2
     (32231638)	Comments: visited CNN news to watch video with realplayer plugin installed

trunk:
 (32303854)	URL: http://intertulia.iamnet.com:8080
(32303854)
Comments: Using java 1.3.1 from sun. This should be the problem
     (32269371)	URL: http://espn.go.com
(32269371)
Comments: I had about:plugins open and the clicked on the ESPN.com link in my
bookmarks
     (32264564)	URL: http://www.a-kuei.com.tw/
(32264564)
Comments: crash when flash plugin load
     (32170865)	URL: http://java.sun.com/
(32170865)
Comments: Started Mozilla.Went to about:plugins via typing it in in the
URLbar.Went to http://java.sun.com/ via typing half in
     (32170299)	URL: http://java.sun.com/
(32170299)
Comments: Loading the site.  I had just installed the JRE and wanted to test it.
Obviously
     (32105352)	URL: www.methosq.com
(32105352)
Comments: choosing page from url bar after fresh install of java plugin
     (32097217)	URL: mail.yahoo.com
     (32097217)	Comments: Mozilla seems to be having difficulties with the Sun JDK plugin -
the latest nightly build
     (32097052)	URL: mail.yahoo.com
     (32097052)	Comments: When I logged into my Yahoo mail account
     (32082470)	URL: www.persiankitty.com
(32082470)
Comments: waiting for page to load
     (32058938)	Comments: Tried accessing some page with a java applet.
     (31991298)	URL: www.real.com/download/
(31991298)
Comments: On the real download site


Here is a recent stack trace from build 2001062706:

Incident ID 32294315
libjavaplugin_oji.so + 0x1d18d (0x40fee18d)
libjavaplugin_oji.so + 0x1d7a9 (0x40fee7a9)
libjavaplugin_oji.so + 0x1bfd2 (0x40fecfd2)
libjavaplugin_oji.so + 0x1ba8e (0x40feca8e)
libjavaplugin_oji.so + 0x1c3b1 (0x40fed3b1)
ProxyJNIEnv::ProxyJNIEnv()
CreateProxyJNI()
JVM_GetJNIEnv()
nsJVMManager::GetProxyJNI()
nsObjectFrame::InstantiatePlugin()
nsObjectFrame::Reflow()
nsLineLayout::ReflowFrame()
nsInlineFrame::ReflowInlineFrame()
nsInlineFrame::ReflowFrames()
nsInlineFrame::Reflow()
nsLineLayout::ReflowFrame()
nsBlockFrame::ReflowInlineFrame()
nsBlockFrame::DoReflowInlineFrames()
nsBlockFrame::DoReflowInlineFramesAuto()
nsBlockFrame::ReflowInlineFrames()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout()
nsBox::Layout()
nsScrollBoxFrame::DoLayout()
nsBox::Layout()
nsContainerBox::LayoutChildAt()
nsGfxScrollFrameInner::LayoutBox()
nsGfxScrollFrameInner::Layout()
nsGfxScrollFrame::DoLayout()
nsBox::Layout()
nsBoxFrame::Reflow()
nsGfxScrollFrame::Reflow()
nsContainerFrame::ReflowChild()
ViewportFrame::Reflow()
nsHTMLReflowCommand::Dispatch()
PresShell::ProcessReflowCommand()
PresShell::ProcessReflowCommands()
HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()



------- Additional Comments From [e-mail] 2001-06-29 19:07 -------

adding crash & topcrash keywords.



------- Additional Comments From Peter Lubczynski 2001-06-30 10:03 -------

I recall Ed Burns working on a crash in ProxyJNIEnv::ProxyJNIEnv(). Did the
patch make it to the branch?



------- Additional Comments From shrirang khanzode 2001-07-01 20:05 -------

is this s dup of 86591 ? that's resolved as WFM ....reopening 86591.



------- Additional Comments From Francisco León 2001-07-01 20:14 -------

I must say that http://intertulia.iamnet.com was supplied by me, and it only
crashed on the first time being loaded, the second time it worked fine, the
third the applet didn't load (??) and all times since then java and flash have
worked all right for me, all on my same 0.9.2 2001062823 build



------- Additional Comments From Francisco León 2001-07-02 18:13 -------

Weird. I go to http://astalavista.box.sk
Crashes everytime. It reports a bug in the java plugin , which i just reported
to Sun.
#
# HotSpot Virtual Machine Error : 11
# Error ID : 4F530E43505002CC
# Please report this error at
# http://java.sun.com/cgi-bin/bugreport.cgi
#
# Java VM: Java HotSpot(TM) Client VM (1.3.1-b24 mixed mode)

Just though you would like to see this. I have the full debug output of this



------- Additional Comments From [e-mail] 2001-07-11 15:15 -------

The site astalavista.box.sk asked me to download and install the flash plugin.  
When I did so, I can't run 0.9.2.  It crashes on startup.  How can I get around 
this?  I can't reproduce the bug.  Also, looking at the source of the page 
reveals no java is pulled in, only flash.

While it does crash in java, I think you're just seeing an artifact of a 
shockwave related crash.  Reassign to plugins.



------- Additional Comments From Francisco León 2001-07-11 15:56 -------

Weird, but astalavista does not crash anymore
Using 2001070608



*** This bug has been marked as a duplicate of 88479 ***

Comment 27

[Peter Lubczynski]

oops, wrong way.... happens on Solaris too, comments from another dup bug 90586:
----------------------------------
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:0.9.2) Gecko/20010705
BuildID:    0000000000

if the flash plugin (5.0r52) and the java plugin (1.3.1) are installed together
mozilla 0.9.2 crashes on every page with a flash animation. The stacktrace is:
#0  0xfd2b32cc in ProxyJNIEnv::ProxyJNIEnv (this=0xa6a4a8, jvmPlugin=0x3e70e8,
    secureEnv=0x0) at ProxyJNI.cpp:1554
1554            result = jvmPlugin->CreateSecureEnv(this, &mSecureEnv);
(gdb) bt
#0  0xfd2b32cc in ProxyJNIEnv::ProxyJNIEnv (this=0xa6a4a8, jvmPlugin=0x3e70e8,
    secureEnv=0x0) at ProxyJNI.cpp:1554
#1  0xfd2b33d0 in CreateProxyJNI (jvmPlugin=0x3e70e8, inSecureEnv=0x0)
    at ProxyJNI.cpp:1567
#2  0xfd2ae088 in JVM_GetJNIEnv () at jvmmgr.cpp:276
#3  0xfd2af454 in nsJVMManager::GetProxyJNI (this=0x270590,
    outProxyEnv=0xffbe991c) at nsJVMManager.cpp:145
#4  0xfcb92698 in nsObjectFrame::InstantiatePlugin ()
#5  0xfcb91bf4 in nsObjectFrame::Reflow ()
#6  0xfcb8c768 in nsLineLayout::ReflowFrame ()
#7  0xfcb887b8 in nsInlineFrame::ReflowInlineFrame ()
#8  0xfcb8831c in nsInlineFrame::ReflowFrames ()
#9  0xfcb88138 in nsInlineFrame::Reflow ()
#10 0xfcb8c768 in nsLineLayout::ReflowFrame ()
#11 0xfcb887b8 in nsInlineFrame::ReflowInlineFrame ()
#12 0xfcb8831c in nsInlineFrame::ReflowFrames ()
#13 0xfcb88138 in nsInlineFrame::Reflow ()
#14 0xfcb8c768 in nsLineLayout::ReflowFrame ()
#15 0xfcb60130 in nsBlockFrame::ReflowInlineFrame ()
#16 0xfcb5fed0 in nsBlockFrame::DoReflowInlineFrames ()
#17 0xfcb5fd28 in nsBlockFrame::DoReflowInlineFramesAuto ()
#18 0xfcb5fbf0 in nsBlockFrame::ReflowInlineFrames ()
#19 0xfcb5e5e8 in nsBlockFrame::ReflowLine ()
#20 0xfcb5dfd8 in nsBlockFrame::ReflowDirtyLines ()
#21 0xfcb5c8b8 in nsBlockFrame::Reflow ()
#22 0xfcb648f0 in nsBlockReflowContext::DoReflowBlock ()
#23 0xfcb64328 in nsBlockReflowContext::ReflowBlock ()
#24 0xfcb5f674 in nsBlockFrame::ReflowBlockFrame ()
#25 0xfcb5e400 in nsBlockFrame::ReflowLine ()
#26 0xfcb5dfd8 in nsBlockFrame::ReflowDirtyLines ()
#27 0xfcb5c8b8 in nsBlockFrame::Reflow ()
#28 0xfcb69778 in nsContainerFrame::ReflowChild ()
#29 0xfcc21cac in nsTableCellFrame::Reflow ()
#30 0xfcb69778 in nsContainerFrame::ReflowChild ()
#31 0xfcc32f64 in nsTableRowFrame::IR_TargetIsChild ()
#32 0xfcc32c40 in nsTableRowFrame::IncrementalReflow ()
#33 0xfcc333a4 in nsTableRowFrame::Reflow ()
#34 0xfcb69778 in nsContainerFrame::ReflowChild ()
#35 0xfcc366dc in nsTableRowGroupFrame::IR_TargetIsChild ()
#36 0xfcc35c3c in nsTableRowGroupFrame::IncrementalReflow ()
#37 0xfcc35a64 in nsTableRowGroupFrame::Reflow ()
....
and so on (94 entries).
The code around the crash place is:

(gdb) l
1549        if (theIDTable == NULL)
1550            theIDTable = new nsHashtable();
1551
1552        // Ask the JVM for a new nsISecureEnv, if none provided.
1553        if (secureEnv == NULL)
1554            result = jvmPlugin->CreateSecureEnv(this, &mSecureEnv);
1555    }
1556
1557    ProxyJNIEnv::~ProxyJNIEnv()
1558    {

If I remove the java plugin I can visit the flash pages without problems (but I
can't run java applets anymore which is bad).



Reproducible: Always
Steps to Reproduce:
1.install flash plugin an java plugin
2.go to some page which contains flash stuff
3.crash!!! (SEGV with core dump)

Actual Results:  SEGV with core dump

Expected Results:  well, at least it shouldn't drop a core.

It doesn't matter whether I run mozilla remotely or locally and it happens on
both Solaris 7 and 8.

Comment 28

[Peter Lubczynski]

*** Bug 90586 has been marked as a duplicate of this bug. ***

Comment 29

[Peter Lubczynski]

*** Bug 88479 has been marked as a duplicate of this bug. ***

Comment 30

[Francisco León]

*** Bug 88744 has been marked as a duplicate of this bug. ***

Comment 31

[Francisco León]

bug 88744 contains all the stack traces i have submitted through talkback
I am duping that one 

Comment 32

[edburns]

Hello Peter,

I can't get Mozilla trunk from today to work on Linux with the flash
player.  It crashes on startup.  This is preventing me from working on
the bug fix.  Can you please give me some guidance about how to
reproduce the bug?

Thanks,

Ed

Comment 33

[Peter Lubczynski]

Ed, 

I just tried a fresh branch install of Netscape 6.1 and did a symbolic link to
the flash in my 4.x install. Not only did it not crash, Flash seemed to be
working well on the few testsites I visited, including the one for this bug.

I will no attempt to install Java and see what happens. This is on RH Linux 7.1.

Comment 34

[Peter Lubczynski]

*** Bug 91253 has been marked as a duplicate of this bug. ***

Comment 35

[Peter Lubczynski]

cc:ing Patrick Beard as he is the author of line 1554 of ProxyJNI.cpp:

From that line:
  result = jvmPlugin->CreateSecureEnv(this, &mSecureEnv);
...it appears that jvmPlugin is a stale pointer.

Comment 36

[Peter Lubczynski]

*** Bug 91767 has been marked as a duplicate of this bug. ***

Comment 37

[greer]

Created attachment 44301 [details]
Comments from Trunk and M092 talkback reports

Comment 38

[greer]

Attaching comments from recent Trunk and M092 talkback reports of this crash 
(see stack in Peter L's 7/14 comments). Adjusting summary for talkback 
tracking, and adding 'Trunk'

Comment 39

[Alex Maneu]

The same happens to me. I am using release 0.9.3 (build id:2001080104) for
linux, and everytime I try to open a page which contains flash or java, the
whole application segfaults (not only navigator, but also mail and news).

I'd also vote for it as a blocker. You just cannot foresee if the page you are
going to open will contain flash or java. It is annoying when performing searchs
on google, for example; you do not know what you are opening until you are there.

Comment 40

[Matthias Dahl]

Using Mandrake 8 (upgraded to glibc 2.1.3, recent gcc 2.96 (<- unfortunately)
rpms) and I can confirm this bug too. Even though java works fine if there is no
flash involved. As soon as a site contains flash content and java is activated,
MOZILLA just hangs forever and consumes almost a third of the CPU time. (BUILD
ID: 2001080211) Yet I found a site today which even hangs MOZILLA if java is
deactivated (http://www.admox.de/) - works fine with Netscape 4.7x. Something
seems to be terribly wrong at the moment... I also vote for marking this as
blocker because it makes it really hard to surf with Mozilla... :-(

Comment 41

[Peter Lubczynski]

*** Bug 93469 has been marked as a duplicate of this bug. ***

Comment 42

[Corey Rogers]

*** Bug 92351 has been marked as a duplicate of this bug. ***

Comment 43

[Jacek Piskozub]

Marking mostfreq at 10 dups.

Comment 44

[Jeff Frost]

Hey folks, I have a core file to upload as an attachment to this bug, as I
consistently have a system which cores visiting http://www.coolrides.cc/, but
bugzilla won't let me upload it (too large - it's about 16mb).  If there is any
interest in it, I can email it or ftp it somewhere.

Comment 45

[Jeff Frost]

Talkback incident ID: TB33888890H

Comment 46

[Ken Foskey]

I work with cisco.netacad.net,  the first flash works well but the curiculum
locks Moz 0.9.3 solid,  right click to kill only, RH6.2, ximian gnome.  I have
loaded xpi from netscape6.1PR1 link,  when I download from the macromedia site I
get a corrupt tar.gz, I get a good tar.gz from NS 4.7.  (I have been assuming
that it was different for moz and kept trying...)

At least I can use some of the cisco site with Moz now, it is getting better.

Comment 47

[shrirang khanzode]

SPAM: reassigning all OJI bugs to new OJI QA, pmac ( 227 bugs)

Comment 48

[Peter Lubczynski]

*** Bug 95496 has been marked as a duplicate of this bug. ***

Comment 49

[serge (gone)]

I did some debugging...
to reproduce this:
 a) do not install flash plugin or remove it from plugins dir if it's in there
 b) install java plugin; my plugins looks like:
    -rwxr-xr-x    1 serge    wheel       18904 Jul 27 00:42 libnullplugin.so*
    drwxr-x---    6 serge    wheel        4096 Aug 28 11:38 java2/
    lrwxrwxrwx    1 serge    wheel          93 Aug 28 11:39 libjavaplugin_oji.so
-> ./java2/plugin/i386/ns600/libjavaplugin_oji.so*
 c) start mozilla with blank page; 
    type about:plugins
    java plugin should be in the list
 e) http://astalavista.box.sk, or probably any page with flash (I've tried
weather.com)
    SEGV after output "Internal error: Null plugin manager"
here is bt before fprintf:
(gdb) bt
#0  fprintf (stream=0x406be9c0, format=0x417f4f40 "Internal error: Null plugin
manager") at fprintf.c:31
#1  0x417e0187 in JavaVM5::AllocateEventWidget ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#2  0x417e07a9 in JavaVM5::StartJavaVM ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#3  0x417defd2 in JavaPluginFactory5::StartupJVM ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#4  0x417dea8e in JavaPluginFactory5::GetJavaVM ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#5  0x417df3b1 in JavaPluginFactory5::CreateSecureEnv ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#6  0x416552e7 in ProxyJNIEnv::ProxyJNIEnv (this=0x8565088, jvmPlugin=0x81c0500,
secureEnv=0x0) at ProxyJNI.cpp:1554
#7  0x41655385 in CreateProxyJNI (jvmPlugin=0x81c0500, inSecureEnv=0x0) at
ProxyJNI.cpp:1567
#8  0x41651aab in JVM_GetJNIEnv () at jvmmgr.cpp:276
#9  0x416527d7 in nsJVMManager::GetProxyJNI (this=0x81c3a38,
outProxyEnv=0xbfffaaf4) at nsJVMManager.cpp:145
#10 0x41aab774 in nsObjectFrame::InstantiatePlugin (this=0x87d456c,
aPresContext=0x87ed8e0, aMetrics=@0xbfffb130,
    aReflowState=@0xbfffb180, aPluginHost=0x81c4d04, aMimetype=0x86a1068
"application/x-shockwave-flash",
    aURI=0x876ebb8) at nsObjectFrame.cpp:1087
#11 0x41aaace7 in nsObjectFrame::Reflow (this=0x87d456c, aPresContext=0x87ed8e0,
aMetrics=@0xbfffb130,
    aReflowState=@0xbfffb180, aStatus=@0xbfffb798) at nsObjectFrame.cpp:910
#12 0x41aa38d0 in nsLineLayout::ReflowFrame (this=0xbfffb860, aFrame=0x87d456c,
aNextRCFrame=0xbfffb3e0,
    aReflowStatus=@0xbfffb798, aMetrics=0x0, aPushedFrame=@0xbfffb2e8) at
nsLineLayout.cpp:962
---
and  after SEGV
(gdb) c
Continuing.
Internal error: Null plugin manager
Program received signal SIGSEGV, Segmentation fault.
0x417e018d in JavaVM5::AllocateEventWidget ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
(gdb) bt
#0  0x417e018d in JavaVM5::AllocateEventWidget ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#1  0x417e07a9 in JavaVM5::StartJavaVM ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#2  0x417defd2 in JavaPluginFactory5::StartupJVM ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#3  0x417dea8e in JavaPluginFactory5::GetJavaVM ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#4  0x417df3b1 in JavaPluginFactory5::CreateSecureEnv ()
   from /plugins/java2/plugin/i386/ns600/libjavaplugin_oji.so
#5  0x416552e7 in ProxyJNIEnv::ProxyJNIEnv (this=0x8565088, jvmPlugin=0x81c0500,
secureEnv=0x0) at ProxyJNI.cpp:1554
#6  0x41655385 in CreateProxyJNI (jvmPlugin=0x81c0500, inSecureEnv=0x0) at
ProxyJNI.cpp:1567
#7  0x41651aab in JVM_GetJNIEnv () at jvmmgr.cpp:276
#8  0x416527d7 in nsJVMManager::GetProxyJNI (this=0x81c3a38,
outProxyEnv=0xbfffaaf4) at nsJVMManager.cpp:145
#9  0x41aab774 in nsObjectFrame::InstantiatePlugin (this=0x87d456c,
aPresContext=0x87ed8e0, aMetrics=@0xbfffb130,
    aReflowState=@0xbfffb180, aPluginHost=0x81c4d04, aMimetype=0x86a1068
"application/x-shockwave-flash",
    aURI=0x876ebb8) at nsObjectFrame.cpp:1087
#10 0x41aaace7 in nsObjectFrame::Reflow (this=0x87d456c, aPresContext=0x87ed8e0,
aMetrics=@0xbfffb130,
    aReflowState=@0xbfffb180, aStatus=@0xbfffb798) at nsObjectFrame.cpp:910
#11 0x41aa38d0 in nsLineLayout::ReflowFrame (this=0xbfffb860, aFrame=0x87d456c,
aNextRCFrame=0xbfffb3e0,
    aReflowStatus=@0xbfffb798, aMetrics=0x0, aPushedFrame=@0xbfffb2e8) at
nsLineLayout.cpp:962
#12 0x41a9dcef in nsInlineFrame::ReflowInlineFrame (this=0x87d43c0,
aPresContext=0x87ed8e0,
    aReflowState=@0xbfffb5f0, irs=@0xbfffb3e0, aFrame=0x87d456c,
aStatus=@0xbfffb798) at nsInlineFrame.cpp:612
---
maybe it'll help [e-mail] somehow

Comment 50

[edburns]

Serge, what plugin are you using?

Comment 51

[serge (gone)]

Java(TM) Plug-in 1.3.0_01
from 6.1rtm build

Comment 52

[edburns]

Woohoo, I can reproduce the bug, AND run it in the debugger under GDB!

nsObjectFrame::InstantiatePlugin() {

It looks like, for some reason, even though aMimetype is application/x-
shockwave-flash, we're instantiating java stuff.  My fix is to not instantiate 
the java stuff unless aMimetype contains the string "java"
}

Here's the fix:

Index: nsObjectFrame.cpp
===================================================================
RCS file: /cvsroot/mozilla/layout/html/base/src/nsObjectFrame.cpp,v
retrieving revision 1.248
diff -u -r1.248 nsObjectFrame.cpp
--- nsObjectFrame.cpp	2001/08/17 22:52:12	1.248
+++ nsObjectFrame.cpp	2001/08/30 19:31:59
@@ -1192,15 +1200,17 @@
   // browser, before plugin gets a chance.
   //
 
-  nsresult rv;
-  // If Java is installed, get proxy JNI. Otherwise (for other plugins) keep
-  // going.
-  nsCOMPtr<nsIJVMManager> jvmManager = do_GetService(nsIJVMManager::GetCID(),
-                                                     &rv);
-  if (NS_SUCCEEDED(rv)) {
-    JNIEnv* proxyEnv;
-    // Get proxy JNI, if not created yet, create it.
-    jvmManager->GetProxyJNI(&proxyEnv);
+  if (PL_strstr(aMimetype, "java")) {
+    nsresult rv;
+    // If Java is installed, get proxy JNI. Otherwise (for other plugins) keep
+    // going.
+    nsCOMPtr<nsIJVMManager> jvmManager = do_GetService(nsIJVMManager::GetCID(),
+                                                       &rv);
+    if (NS_SUCCEEDED(rv)) {
+      JNIEnv* proxyEnv;
+      // Get proxy JNI, if not created yet, create it.
+      jvmManager->GetProxyJNI(&proxyEnv);
+    }
   }
 #endif
   return aPluginHost->InstantiateEmbededPlugin(aMimetype, aURI, 
mInstanceOwner);

This looks something that should have been done as part of the original fix to 
bug 83698.

Comment 53

[Olivier Cahagne]

Sorry for the spam, I hope it can help. I found a 100% reproducible crasher with
the following URL: http://bienvenue.pagesjaunes.fr/public_html/home.htm
Build 2001083008 on Linux.

This page will lock/crash Mozilla on Linux only if Flash _and_ Java Plug-in are
present. (using JRE 1.3.0_01 and latest Flash 5.0r45). If it does not crash,
then closing Mozilla (via Ctrl-C) shows the Talkback window.
Mozilla won't lock/crash if:
 - only Flash plug-in is loaded.
 - only Java plug-in is loaded.
 - no plug-ins are loaded.
Talkback ID: TB34737221G.
BTW, there seems to be no Java on this page.

Comment 54

[serge (gone)]

edburns, did you try to access java.sun.com after about:plugins?
I do crash in there with the same stack trace, though there is java plugin with
"application/x-java-vm" mimetype.

Comment 55

[serge (gone)]

Oliver, the call stack signature for TB34737221G
is different (Signature = libc.so.6 + 0x5a26e (0x404b426e) 2069c02d)
 libc.so.6 + 0x5a26e (0x404b426e)
 libc.so.6 + 0x59fba (0x404b3fba)
 libX11.so.6 + 0x2023d (0x4038623d)
 libflashplayer.so + 0x39b36 (0x40f6bb3
 libXt.so.6 + 0x13f47 (0x40edef47)
 libXt.so.6 + 0x13e87 (0x40edee87)
 libXt.so.6 + 0x13e3e (0x40edee3e)
 libXt.so.6 + 0x14296 (0x40edf296)
 libXt.so.6 + 0x14440 (0x40edf440)
 libXt.so.6 + 0x145c6 (0x40edf5c6)
 gtk_xtbin_destroy()
 libgtk-1.2.so.0 + 0x8e25d (0x4026c25d)
 libgtk-1.2.so.0 + 0xbae6b (0x40298e6b)
 libgtk-1.2.so.0 + 0xb8f35 (0x40296f35)
 libgtk-1.2.so.0 + 0x9eb83 (0x4027cb83)
 libgtk-1.2.so.0 + 0xf1d80 (0x402cfd80)
 gtk_xtbin_shutdown()
 libgtk-1.2.so.0 + 0x9eb2b (0x4027cb2b)
 libgtk-1.2.so.0 + 0xead76 (0x402c8d76)
 ns4xPluginInstance::SetWindow()
....
so, it's libflashplayer.so or gtk_xtbin_destroy() problem

Comment 56

[Olivier Cahagne]

Serge,
Sorry, I thought that it was related to this bug, because it also only occurred
on Linux (not Win2k). I also tried Flash 5.0r12 and JRE 1.3.1 and they also lock
with latest build 2001083012. Should I file another bug report ?
I don't get any Talkback window but Mozilla locks and the console shows when
loading http://www.weather.com/ or
http://bienvenue.pagesjaunes.fr/public_html/home.htm :

INTERNAL ERROR on Browser End: Exec of "java_vm" failed: 2
<
System error?:: No such file or directory

I thought it would help here to have more Talkback IDs as there seems to have
trouble finding where the bug comes.

Comment 57

[Olivier Cahagne]

Sorry about that last post, it's late and I copied the libjavaplugin_oji.so
instead of syminking it. New Talkback ID with Mozilla 2001 083012 and JRE 1.3.1:
http://bienvenue.pagesjaunes.fr/public_html/home.htm : TB34742088X.
http://www.weather.com/ doesn't crash.

Comment 58

[edburns]

Wow, visiting java.sun.com after about:plugins still causes a crash.
Back to the drawing board.  Thanks serge.

Comment 59

[edburns]

I notice that if I start the Java console before doing about:plugins, then 
visiting java.sun.com, it does not crash.

It looks like the lazy loading fix is causing problems again.

Comment 60

[edburns]

This appears to have been caused by the fix to bug 83698.

Comment 61

[Joe Chou]

Created attachment 47908 [details] [diff] [review]
Patch for crash of "about:plugins" -> "java.sun.com"

Comment 62

[av (gone)]

Would not it be more natural and cleaner to check for null rather that for
success after getting the pointer and before dereferencing it?

Comment 63

[Joe Chou]

Success means Java is installed, then create proxyJNI and start JVM. Otherwise
it could be other plugins, then keep going.

Just created a patch, and it seemed to fix the crash of going from
"about:plugins" to "java.sun.com" (or any page with applets). 

The problem seems to be related to the change of lazy start of JVM. With the
patch, which starts JVM when "about:plugins" is loaded, the loading of Java
pages afterwards seem to be fine. 

The patch basically is an additional call to the fix of 83698, as Ed already
pointed out. "about:plugin" seems to be another case that requires JVM to be
started, and was overlooked when 83698 was being fixed. I hope we have covered
most such cases, if not all yet.   

Ed, please take a look at the patch, and see if it is OK (e.g., the spot I chose
to start JVM, in nsPluginHostImpl::ReloadPlugins(), etc.).

Comment 64

[Peter Lubczynski]

Looks fine to me, but maybe

+  if (NS_SUCCEEDED(rv)) {

...could be ...

+  if (NS_SUCCEEDED(rv) && jvmManager) {

Comment 65

[av (gone)]

That's exactly I was talking about in my last comment. I can imagine the
situation when in general case having something not installed is not an error
but perfectly legal case.

Comment 66

[Joe Chou]

I see, AV, I thought you meant not to use NS_SUCCEEDED(). The change seems  more
protective than my original. But is it possible that do_GetService() has a
successful rv and yet return a null? In other words, if Java is not installed,
will do_GetService() return a null pointer, but passed back a successful rv?
Just try to understand how the code works. I tried to find the code of
do_GetService() from lxr, but could not find it. 

Comment 67

[av (gone)]

lxr does not work well with inlines. I think it is all in nsIServiceManager.h

Comment 68

[Joe Chou]

When I did some more testing, I saw some problem. Need to investigate if related
to the patch.

Comment 69

[edburns]

*** Bug 98035 has been marked as a duplicate of this bug. ***

Comment 70

[edburns]

Hi Joe,
please note that modules/plugins/nglsrc no longer exists.  The new directory is 
modules/plugins/base/src.

Comment 71

[edburns]

Hi Joe,

I've tested this patch out on linux, with the additional check for null 
jvmManager, and it works.  However, I'm concerned about your statement that you 
found some additional problems.  How can I test for these problems?

Thanks,

Ed

Comment 72

[Joe Chou]

The problem I saw was that: if I went to about:plugins, then a page with applet
(i.e., java.sun.com), then back to about:plugins, then java.sun.com.... The
browser would crash. I also tried it without the patch (java.sun.com ->
about:plugins -> java.sun.com ...), and the problem also seemed to be there. So
it looked like a seperate bug.

Comment 73

[edburns]

Here's what I do, after applying your patch (with the jvmManager check):

1. start browser
2. about:plugins
3. java.sun.com

back and forth between 2 and 3...no problem

1. start browser
2. about:plugins
3. Visit a liveconnect testcase

crash.

Comment 74

[lchiang]

We'd like to take this fix on the 0.9.4 branch if we can get it ready for the 
release.  per PDT

Comment 75

[Joe Chou]

When is the branch freezing date for 0.9.4? The end of September? If so, I think
it can make it. Right now I am trying to find out why the browser cashed in the
case going from about:plugins  to a liveconnect page. It seems to be a different
problem, but if the cause can be identified soon, to fix both would be better.

Comment 76

[Asa Dotzler [:asa]]

0.9.4 is out the door.

Comment 77

[Alex Maneu]

First of all, I do NOT have java plugin installed, but didn't know where this
info could exactly fit.

I'm using Mozilla 0.9.4 (build 2001091311) on Linux (Debian 2.4.9).

To install flash, I follow the instructions and copy 
ShockwaveFlash.class  libflashplayer.so
to the plugins dir.

When mozilla tries to read the .class file, it says ELF headers are incorrect
(that's bug #97362). It seems I can remove this file and the flash plugin still
appears in about:plugins.

In any case, if I visit a page that contains flash, mozilla crashes. 

Here's the output I get:

/usr/local/mozilla/run-mozilla.sh /usr/local/mozilla/mozilla-bin
MOZILLA_FIVE_HOME=/usr/local/mozilla
  LD_LIBRARY_PATH=/usr/local/mozilla:/usr/local/mozilla/plugins
     LIBRARY_PATH=/usr/local/mozilla:/usr/local/mozilla/components
       SHLIB_PATH=/usr/local/mozilla
          LIBPATH=/usr/local/mozilla
       ADDON_PATH=/usr/local/mozilla
      MOZ_PROGRAM=/usr/local/mozilla/mozilla-bin
      MOZ_TOOLKIT=
        moz_debug=0
     moz_debugger=
LoadPlugin: failed to initialize shared library
/usr/local/mozilla/plugins/ShockwaveFlash.class
[/usr/local/mozilla/plugins/ShockwaveFlash.class: invalid ELF
header]
ProfileManager : StartApprunner
profileName passed in: default
 I am inside the initialize
 Hey : You are in QFA Startup 
(QFA)Talkback loaded Ok.
Error: Object "drawingArea" does not have windowed ancestor

(for example when visiting http://www.flash.com). 

Comment 78

[Peter Lubczynski]

*** Bug 99950 has been marked as a duplicate of this bug. ***

Comment 79

[Jay Patel [:jay]]

Created attachment 49685 [details]
user comments and urls from M094 Talkback topcrash report

Comment 80

[Jay Patel [:jay]]

This is the #1 topcrasher for Mozilla 0.9.4 thus far.  Here is the most recent
entry with stack trace:

Incident ID 35504262
Stack Signature libjavaplugin_oji.so + 0x1d331 (0x40fa8331) b93416ac
Bug ID
Trigger Time 2001-09-17 11:25:12
Email Address [e-mail]
User Comments Trying out the Java plug-in after upgrading from 0.9.3 to 0.9.4
and recreating the "plugins" link.
Build ID 2001091311
Product ID Netscape6.20
Platform ID LinuxIntel
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
libjavaplugin_oji.so + 0x1d331 (0x40fa8331)
libjavaplugin_oji.so + 0x1d949 (0x40fa8949)
libjavaplugin_oji.so + 0x1c142 (0x40fa7142)
libjavaplugin_oji.so + 0x1bbfe (0x40fa6bfe)
libjavaplugin_oji.so + 0x1c521 (0x40fa7521)
ProxyJNIEnv::ProxyJNIEnv()
CreateProxyJNI()
JVM_GetJNIEnv()
nsJVMManager::GetProxyJNI()
nsObjectFrame::InstantiatePlugin()
nsObjectFrame::Reflow()
nsLineLayout::ReflowFrame()
nsBlockFrame::ReflowInlineFrame()
nsBlockFrame::DoReflowInlineFrames()
nsBlockFrame::DoReflowInlineFramesAuto()
nsBlockFrame::ReflowInlineFrames()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableCellFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowFrame::ReflowChildren()
nsTableRowFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableRowGroupFrame::ReflowChildren()
nsTableRowGroupFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableFrame::ReflowChildren()
nsTableFrame::Reflow()
nsContainerFrame::ReflowChild()
nsTableOuterFrame::OuterReflowChild()
nsTableOuterFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsBlockReflowContext::DoReflowBlock()
nsBlockReflowContext::ReflowBlock()
nsBlockFrame::ReflowBlockFrame()
nsBlockFrame::ReflowLine()
nsBlockFrame::ReflowDirtyLines()
nsBlockFrame::Reflow()
nsContainerFrame::ReflowChild()
CanvasFrame::Reflow()
nsBoxToBlockAdaptor::Reflow()
nsBoxToBlockAdaptor::DoLayout()
nsBox::Layout()
nsScrollBoxFrame::DoLayout()
nsBox::Layout()
nsContainerBox::LayoutChildAt()
nsGfxScrollFrameInner::LayoutBox()
nsGfxScrollFrameInner::Layout()
nsGfxScrollFrame::DoLayout()
nsBox::Layout()
nsBoxFrame::Reflow()
nsGfxScrollFrame::Reflow()
nsContainerFrame::ReflowChild()
ViewportFrame::Reflow()
nsHTMLReflowCommand::Dispatch()
PresShell::ProcessReflowCommand()
PresShell::ProcessReflowCommands()
HandlePLEvent()
PL_HandleEvent()
PL_ProcessPendingEvents()
nsEventQueueImpl::ProcessPendingEvents()
event_processor_callback()
our_gdk_io_invoke()
libglib-1.2.so.0 + 0xec40 (0x4035bc40)
libglib-1.2.so.0 + 0x10309 (0x4035d309)
libglib-1.2.so.0 + 0x10913 (0x4035d913)
libglib-1.2.so.0 + 0x10aac (0x4035daac)
libgtk-1.2.so.0 + 0x93c57 (0x40271c57)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1d64f (0x4049964f) 

Comment 81

[R.K.Aa.]

*** Bug 100285 has been marked as a duplicate of this bug. ***

Comment 82

[R.K.Aa.]

from dup: a second visit to http://www.warnerbros.com will cause this crash.
TB35554062W. warnerbros is another top100 i believe.

Comment 83

[av (gone)]

*** Bug 100120 has been marked as a duplicate of this bug. ***

Comment 84

[Jan Carpenter]

Created attachment 49825 [details]
Comments from talkback crash reports

Comment 85

[Jan Carpenter]

This is still the #1 topcrash for M094.

Comment 86

[Joe Chou]

This seems to be the cause of the problem:
When going to "about:plugins", ReloadPlugins() is called. In there, if a plugin
is not running, it is deleted, which caused the plugin manager be released. Now,
if going to "about:plugins" right after the browser is launched, since at that
time, Java plugin is not yet running (due to lazy start of JVM), Java plugin tag
is released, which caused Java plugin manager become null. Then when going to a
Java page next, which tries to create proxyJNI (to start JVM) by calling Java
plugin manager. Since the plugin manager was already null, it crashes.

This seems to fix the problem (attached as the second patch):
Before deleting a plugin tag when reloading plugins, instead of deleting all
stopped plugins, only delete the non-java ones.

Comment 87

[Joe Chou]

Created attachment 50030 [details] [diff] [review]
Second patch

Comment 88

[Peter Lubczynski]

Does that last patch do the trick? This will prevent calling Shutdown and
PR_UnloadLibrary for Java, only in the plugins.refresh case. That sounds
reasonable as once Java is loaded, it was never designed to be unloaded during
runtime.

I really don't like the string comparison. How about something like this:

nsCOMPtr<nsIJVMPlugin> jpi;
if (p->mEntryPoint && (jpi = do_QueryInterface(p->mEntryPoint)) != nsnull)
  0;
else // this is not a Java plugin
  delete p;

Comment 89

[serge (gone)]

Should it be ALL platform problem? 
though I never be able to reproduce it on window, why?

Comment 90

[R.K.Aa.]

*** Bug 100605 has been marked as a duplicate of this bug. ***

Comment 91

[Joe Chou]

I adopted Peter's suggestion (reverse the if condition to make it simpler), and
tried it, it seemed working OK too. Attaching the third patch.

The reason that Windows does not have this problem is that in Windows'
implementation it does not create proxyJNI, like Unix. Should I make this patch
Unix-only? I think I should.

Comment 92

[Joe Chou]

Created attachment 50168 [details] [diff] [review]
Third Patch

Comment 93

[Peter Lubczynski]

Comment on attachment 50168 [details] [diff] [review]
Third Patch

looks good to me. r=peterl

Comment 94

[Joe Chou]

Ed, could you try the third patch on Linux, and see if it works for you now?
Thanks.

Comment 95

[Julio Garcia Sacristan]

Maybe this will help locate the problem.
I was installing my plugins simply by copying the contents of the plugins folder
from my netscape 6.1 to mozilla. Mozilla would recognize the plugins but it
would crash every time it found a page with java or flash content.
So what I did, is delete all the content of the mozilla/plugin folder, installed
the flash player manually and installed the java plugins by making a symbolic
link to the java libjavaplugin_oji.so which now resides inside my
/java/jdk1.3.1/jre path, outside the mozilla path. And now everything is working
correctly, I am able to open pages with flash and java content with no problem. 
I did had to make a symbolik link to libXext.so.6.4 as mentioned on bug 79108
which I thought was solved with 094. 
I am using build 2001091311

There is a file called core inside the netscape plugins folder which may have
been causing problems. 

I am still geting the error about the invalid ELF header when trying to
initillize the shared library ShockwaveFlash.class

Comment 96

[edburns]

Ressign to Joe Chou, as I am no longer working officially on OJI.

Comment 97

[Peter Lubczynski]

Joe Chou,

What's the status on this? I think PDT would really like this for the branch. Do
you need some help?

Comment 98

[Joe Chou]

I tested the third patch on Solaris wiht JRE1.4, and it seemed working OK. 
Going from about:plugin to java.sun.com or liveconnect page without problems. 
But when I tried it on my Linux box with JRE1.3.1 or JRE1.3.0_01, whenever I 
went from about:plugins to a liveconnect page, the browser crashed. I am going 
to try with JRE1.4 on my linux box today, and see what hapens.

Comment 99

[Jan Carpenter]

Adding M094 to summary line.

Comment 100

[Joe Chou]

Tried the patch with JRE1.4 (downloaded from java.sun.com/j2se/1.4/jre) on
Linux, and it worked fine. In JRE1.4, Java plugin has made some changes to adapt
the lazy start of JVM, and some of the changes seems to fix this bug's problem
on the Java plugin side.

Comment 101

[Peter Lubczynski]

*** Bug 101859 has been marked as a duplicate of this bug. ***

Comment 102

[Joe Chou]

Requesting for sr=.

Comment 103

[Joe Chou]

I've sent the request for sr= to [e-mail] couple days ago, so far I
have not receive any response yet. Can someone on the list give me some
feedback, please? 

Comment 104

[Christopher Blizzard (:blizzard)]

This is a work around, not a patch.  This will happen with any XPCOM plugin, not
just with the Java VM.  Please find the right way to fix this.

Comment 105

[TaylorToddK]

Are these bugs for the linux os, specific to RedHat installations?  
I have installed RH 7.1, done all of their RH updates, and tried both linking to
the jdk's file and using the Netscape delivered java plug-in package. I was able
to produce the freeze with any of these configurations.  
However, I was not able to produce this problem on SUSE 7.2 Professional
installation on the same machine, regardless of which oji I used.

Another related bug:
http://bugzilla.mozilla.org/show_bug.cgi?id=100792

Comment 106

[Christopher Blizzard (:blizzard)]

It does show up on Red Hat systems with a certain version of the kernel, glibc
and a specific version of the JVM from sun.

Comment 107

[Joe Chou]

This is a Unix (maybe OS2 too) problem, due to the different implementation on
Unix (create proxy JNI before starting JVM). The problem was reproduced on
Solaris, besides Red Hat Linux.

The crash happens because: First when going to "about:plugins", Reloadplugins()
was called, in which plugin manager was deleted if not running (as in this
case). Then when going to a java page (i.e., "java.sun.com"), create proxy JNI
was called to lazily start JVM, in which the null plugin manager was called, and
crashed. 

Chris,
This seems to be a Java plugin on Unix specific problem, due to its specific
implementation. Can you explain a little more on "this can happen to any xpcom
plugins"?

Question:
Do we really need to call ReloadPlunins() when going to "about:plugins"? Or do
we ever need to reload Java plugins, since it is registerred at startup already?
I tried to skip ReloadPlugins(), and it seemed working fine, with different Java
plugin versions (1.4, 1.3.1, etc.).

Comment 108

[Peter Lubczynski]

> This is a work around, not a patch.  This will happen with any XPCOM plugin, not
> just with the Java VM.  Please find the right way to fix this.

This crash (and this bug) is only about a crash with Java when going causing a
navigator.plugins.refresh(). The problem is we should never call
nsIPlugin::Shutdown on the Java plugin because it was never designed for that
and I think this fix is the right way to do that.

There is another bug about not calling PR_UnloadLibrary on all XPCOM plugins but
that's another issue that does not have a PDT nomination.

Comment 109

[Marc Attinasi]

Comment on attachment 50168 [details] [diff] [review]
Third Patch

sr=attinasi - special casing for the Java plugin on UNIX smells bad, but a crash smells worse. I think it is worth some effort to try and figure out a generic way to let a plugin decide if it wants to be deleted. Checking if it implements the nsIJVMPlugin interface is not right, we need o ask the plugin 'should I delete you?' and if it says NO, then don't delete it. That way any plugin that has the same semantics as the current java plugin can be treated correctly. Anyway, time is ticking by and the crash is bad...

Comment 110

[Jaime Rodriguez, Jr.]

pls check it in to the branch - PDT+

Comment 111

[Joe Chou]

I need at least one more day to finish some more testing.

Comment 112

[Peter Lubczynski]

Joe, in your testing, be sure you update your patch to point to the correct
version of nsPluginHostImpl.cpp. The one in the patch is obsolete and may have
hampered previous test results. Actually, you may want to check out the
MOZILLA_0_9_4_BRANCH   tag if you have not already.

Comment 113

[Christopher Blizzard (:blizzard)]

> This crash (and this bug) is only about a crash with Java when going causing a
> navigator.plugins.refresh(). The problem is we should never call
> nsIPlugin::Shutdown on the Java plugin because it was never designed for that
> and I think this fix is the right way to do that.

So is it expected that Shutdown on any XPCOM plugins will work?  If so are we
just working around a bug in the Sun JVM?  This does smell bad and I don't want
even more Sun JVM-related baggage if possible.

Comment 114

[Jeff Williams]

I don't think this is a Sun-specific problem--I ran into it with IBM's JVM.

Comment 115

[Peter Lubczynski]

Created attachment 52055 [details] [diff] [review]
patch to keep ALL XPCOM plugins in plugin tag list during plugins.refresh()

Comment 116

[Peter Lubczynski]

That last patch should keep all XPCOM-type plugins around during a
plugins.refresh() and not call nsIPlugin::Shutdown() on any of them until exit
time. No bias to Java. Chris reminded me that dynamic update doesn't work for
any XPCOM plugin, not only Java, and the spec says Shutdown() should only be
called once, before the library is unloaded.

Some testing still needs to be done, but if nobody objects, can I get some reviews?

Comment 117

[Christopher Blizzard (:blizzard)]

Comment on attachment 52055 [details] [diff] [review]
patch to keep ALL XPCOM plugins in plugin tag list during plugins.refresh()

r/sr=blizzard

Comment 118

[av (gone)]

Comment on attachment 52055 [details] [diff] [review]
patch to keep ALL XPCOM plugins in plugin tag list during plugins.refresh()

r=av

Comment 119

[Joe Chou]

I tried PeterL's patch on my linux machine (Redhat7.1) with JRE1.3.1. After
going from "about:plugins", and then "java.sun.com", the Java VM crashed, which
caused the browser to exit/crashed. The same thing happened when I tried my
third patch with JRE1.3.1 on my machine. I am trying to get another Linux box to
give it another try.

On the other hand, PeterL said his patch worked on several linux machines, then
the crash I have may be machine dependant.

Since this new patch will affect all plugins and all platform now, have we done
some testing to cover them?

Comment 120

[Joe Chou]

I found out that my linux machine is a two processor machine with kernel 2.4.
The previous owner of the machine said it had various problems with Java plugin.
Therefore, I believe the crash I saw is related to the machine's configuration. 
(I am seting up a different linux machine now.)

Since PeterL already tested on numerous linux machines, and Windows machine,
plus other plugins, the patch should be OK.



 

Comment 121

[Peter Lubczynski]

I spent the day testing on numerious linux machines plus Windows/Mac with other
plugins. Need drivers approval to land on trunk.

Comment 122

[Peter Lubczynski]

patch in branch, awaiting a= from drivers

Comment 123

[Patty Mac]

Thanks Peter. Yes, I just tested on the Linux redhat 6.2 (Custom install),
branch build: 2001-10-05-04-0.94, it works fine, no crash.

Comment 124

[Peter Lubczynski]

Created attachment 52291 [details] [diff] [review]
patch with comments and slight Mac fix

Comment 125

[Peter Lubczynski]

That last patch adds some comments and fixes one last problem I noticed only on
the Mac. Even though the plugins functioned okay, one could more easily than
before see the results of bug 103393 in about:plugins. It is not valid to check
for NS_PLUGIN_FLAG_OLDSCHOOL unless mEntryPoint is set.

Comment 126

[Peter Lubczynski]

Created attachment 52294 [details] [diff] [review]
correct patch

Comment 127

[av (gone)]

Comment on attachment 52294 [details] [diff] [review]
correct patch

good catch, the flag itself may not
be an indication as it is only set 
when pEntryPoints set.
r=av

Comment 128

[Asa Dotzler [:asa]]

Comment on attachment 52294 [details] [diff] [review]
correct patch

a=asa (on behalf of drivers) for checkin to 0.9.5 branch.

Comment 129

[Peter Lubczynski]

Chris, could you sr= the updated patch? Thanks!

Comment 130

[Marc Attinasi]

Comment on attachment 52294 [details] [diff] [review]
correct patch

sr=attinasi

Comment 131

[Peter Lubczynski]

patch checked in everywhere, marking FIXED...

Comment 132

[Patty Mac]

Verified the patch.

Comment 133

[R.K.Aa.]

*** Bug 103970 has been marked as a duplicate of this bug. ***

Comment 134

[Ian Wehrman]

has this made it into the nightlies yet? i am still hanging on java load with
2001101008 linux... 

Comment 135

[Scott Kester]

I to am still seeing a crash/hang on any page with Java or Flash, but only on my
RH 7.1 box. I have never seen it on my RH 7.0 machine.  Should this be opened as
a new bug, or should the bug be re-opened?

Comment 136

[Peter Lubczynski]

There is a known compatibility problem between mozilla, the Sun
JRE 1.3.0 plugin and the 2.4 kernel with RH 7.1. For details, see:
http://bugzilla.mozilla.org/show_bug.cgi?id=84093 

Workaround: Upgrade your Java plugin to at least JRE 1.3.1 or set this enviornment
variable before starting mozilla: LD_ASSUME_KERNEL=2.2.5

Comment 137

[Patty Mac]

Scott, last week if I tried on the commercial trunk builds, it crashed on my
linux redhat 6.2.
In order to see this crash, if you install Java while the browser is running,
you must restart the browser in order to see this bug. Then visit about:plugins
and then www.javasoft.com. Then it immediately crashes. Now, this is already fixed
and I just verified again on the commercial trunk build (2001-10-10-08-trunk)
with jre 1.31.

I don't have a redhat 7.0 or 7.1, could anyone try this for me to see whether it
crashes or not please? Thanks very much!

Comment 138

[Scott Kester]

Peter,

Thanks for pointing me to bug 84093, that has fixed my java crash on RH 7.1.

Patty,

I can also verify that the about:plugins/java.sun.com problem is fixed on RH 7.1.

Comment 139

[Peter Lubczynski]

*** Bug 105545 has been marked as a duplicate of this bug. ***

Comment 140

[serge (gone)]

*** Bug 100278 has been marked as a duplicate of this bug. ***