Bug 506692

Summary: Crash when closing tab with Java remote management applet
Product: [Fedora] Fedora Reporter: Jakub Hrozek <jhrozek>
Component: firefoxAssignee: Gecko Maintainer <gecko-bugs-nobody>
Status: CLOSED UPSTREAM QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 11CC: chipi_vk, denis.brodsky, doctore, gecko-bugs-nobody, jan.teichmann, mcepl, sharma_vibs, stransky, walters
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-06-19 13:20:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Core file
none
complete backtrace none

Description Jakub Hrozek 2009-06-18 11:44:57 UTC
Created attachment 348417 [details]
Core file

Description of problem:
When I close a tab containing an IBM server remote management applet, firefox segfaults.

This may be specific to the particular applet as I tested some tests applets at sun.com and FF did survive..but anyway, it shouldn't crash.

Core file is attached.

Version-Release number of selected component (if applicable):
firefox-3.5-0.20.beta4.fc11.x86_64
xulrunner-1.9.1-0.20.beta4.fc11.x86_64
nspluginwrapper-1.3.0-5.fc11.x86_64
java-1.6.0-openjdk-1.6.0.0-22.b16.fc11.x86_64
java-1.6.0-openjdk-plugin-1.6.0.0-22.b16.fc11.x86_64


How reproducible:
always

Steps to Reproduce:
1. login into the IBM remote server web tool
2. use their applet
3. close the tab with the applet
4. Kaboooom
  
Actual results:
crash

Expected results:
no crash

Additional info:
did not happen in F10, so I suspect it's actually a regression in Firefox.

Comment 1 Matěj Cepl 2009-06-18 20:24:14 UTC
Created attachment 348553 [details]
complete backtrace

Comment 2 Martin Stransky 2009-06-19 07:14:39 UTC
It's here:

rv = mOwner->GetDocument(getter_AddRefs(document));

so i suppose the mOwner is null or some bogus value. Matej, can you attach the mOwner value and some extended bactrace with local variables?

Comment 3 Matěj Cepl 2009-06-19 11:20:21 UTC
That's better answered by Jakub ... I have never seen that IBM Java thing in my life.

Comment 4 Jakub Hrozek 2009-06-19 11:39:20 UTC
The mOwner value indeed is NULL:

---
805	  rv = mOwner->GetDocument(getter_AddRefs(document));
(gdb) print mOwner
$1 = (class nsIPluginInstanceOwner *) 0x0
---

Comment 5 Matěj Cepl 2009-06-19 13:20:10 UTC
We filed this bug in the upstream database (https://bugzilla.mozilla.org/show_bug.cgi?id=499295) and believe that it is more appropriate to let it be resolved upstream.

We will continue to track the issue in the centralized upstream bug tracker, and will review any bug fixes that become available for consideration in future updates.

Thank you for the bug report.

Comment 6 Matěj Cepl 2009-12-10 01:07:49 UTC
*** Bug 542763 has been marked as a duplicate of this bug. ***

Comment 7 Chris Campbell 2009-12-18 14:59:48 UTC
*** Bug 548737 has been marked as a duplicate of this bug. ***

Comment 8 Chris Campbell 2009-12-18 15:01:00 UTC
*** Bug 548741 has been marked as a duplicate of this bug. ***

Comment 9 Chris Campbell 2010-01-13 12:49:53 UTC
*** Bug 554955 has been marked as a duplicate of this bug. ***

Comment 10 Chris Campbell 2010-03-02 19:25:59 UTC
*** Bug 569291 has been marked as a duplicate of this bug. ***

Comment 11 Chris Campbell 2010-03-05 15:00:16 UTC
*** Bug 569068 has been marked as a duplicate of this bug. ***