94611 - Crash: App crashes while loading page

Status: VERIFIED DUPLICATE of bug 12367

(Core Graveyard :: Java: Live Connect, defect)

Description

[rubydoo123]

I have no doubt selected the wrong component

using the trunk build from 8/9/01 on win98, I crashed while loading the above
mentioned URL. The incident # is 33877658 

Stack Trace

js_SetProperty [d:\builds\seamonkey\mozilla\js\src\jsobj.c, line 2528] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2547] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 825] 
js_InternalInvoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 897] 
JS_CallFunctionValue [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3351] 
nsJSContext::CallEventHandler
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 949] 
nsJSEventListener::HandleEvent
[d:\builds\seamonkey\mozilla\dom\src\events\nsJSEventListener.cpp, line 140] 
nsEventListenerManager::HandleEventSubType
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1197] 
nsEventListenerManager::HandleEvent
[d:\builds\seamonkey\mozilla\content\events\src\nsEventListenerManager.cpp, line
1872] 
GlobalWindowImpl::HandleDOMEvent
[d:\builds\seamonkey\mozilla\dom\src\base\nsGlobalWindow.cpp, line 598] 
DocumentViewerImpl::LoadComplete
[d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1105] 
nsDocShell::EndPageLoad
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3743] 
nsWebShell::EndPageLoad
[d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 894] 
nsDocShell::OnStateChange
[d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3664] 
nsDocLoaderImpl::FireOnStateChange
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1095] 
nsDocLoaderImpl::doStopDocumentLoad
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 734] 
nsDocLoaderImpl::DocLoaderIsEmpty
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 632] 
nsDocLoaderImpl::OnStopRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 563] 
nsLoadGroup::RemoveRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 517] 
imgRequestProxy::OnStopRequest
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequestProxy.cpp, line 389] 
imgRequest::OnStopRequest
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgRequest.cpp, line 639] 
ProxyListener::OnStopRequest
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgLoader.cpp, line 391] 
nsStreamListenerTee::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 25] 
nsHttpChannel::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line
2146] 
nsOnStopRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 161] 
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591] 
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524] 
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072] 
KERNEL32.DLL + 0x24407 (0xbff94407) 
0x00688b5e

Comment 1

[rubydoo123]

i am going to reassign this to brendan so it will hopefully get the correct
engineer looking at this

Comment 2

[Igor Kushnirskiy]

this bug has nothing to do with "java implemented plugins"

Comment 3

[Brendan Eich [:brendan]]

This bug has little to do with JS, either -- not that I am default component
owner for the JS Engine, either again!  jst, got a clue?

/be

Comment 4

[rubydoo123]

the reason I assigned to you Brendan, you were the last to touch the code where
the error occurs

and as I said when I submitted the bug, I had no clue what component to put it to

Comment 5

[timeless]

could you crash in purify?
2522     if (!sprop) {
2527     } else {
2528         attrs = sprop->attrs;
browser general has no interest in this bug, instead of saying nimby it would 
be nice if people took a second to move the bug to a reasonable component so it 
could get help from a qa contact.

Comment 6

[timeless]

the bug is probably in DOM Events, so hopefully someone will step up ...

Comment 7

[Brendan Eich [:brendan]]

timeless, you are barking up the wrong tree. I'm saying "not a JS engine bug",
not NIMBY, and you damn well know the difference.  If this bug is probably in
DOM events, then why did you leave it assigned to rogerl?  You did not fix
either QA-contact or assignee, so spare me the pontification and crypic code
quoting.  If you want to give it to the DOM Events default component owner, you,
know the drill.  But is that really the best home?

Is anyone reproducing this or seeing it intermittently?  Including asa, again.
jst, you're it.

/be

Comment 8

[Phil Schwartau]

Setting default QA

Comment 9

[Johnny Stenback (:jst)]

The crash on this page is probably a Live Connect problem, we're crashing when
executing this line of code:

  document.UpperNavApplet.frame_height = frameHeight;

(in SetFrameHeight() which is called from the onload handler in the top banner
frame)

document.UpperNavApplet is a XPConnect wrapped applet element that has the Live
Connect wrapped Java applet as it's prototype, we crash trying to set the
frame_height property on the applet. The JS engine calls js_SetProperty(), which
ends up calling JavaObject_lookupProperty() in Live Connect,
JavaObject_lookupProperty() calls into Java to find the property and it does
find it, then JavaObject_lookupProperty() passes back the object where the
property was found (the same object that was passed in) and it returns a
JSProperty pointing to 1:

        *propp = (JSProperty*)1;

Later on, js_SetProperty() tries to access this pointer (sprop) and we crash.

I don't know how to fix this w/o digging into this, reassigning to beard who
owns LiveConnect.

Comment 10

[Brendan Eich [:brendan]]

For cryin' out loud!  fur's hack continues to haunt us.  Patrick, if you want to
take that bug off my hands, please do.  I can certainly fix it, I don't have a
problem hacking in liveconnect code.

/be

*** This bug has been marked as a duplicate of 12367 ***

Comment 11

[Brendan Eich [:brendan]]

Attachment: simple, safe, symmetric (see js_GetProperty, and others) fix

Comment 12

[Brendan Eich [:brendan]]

Er, see bug 12367.

/be

Comment 13

[Vladimir Ermakov]

verifying duplicate