This is sort of similar to the fixed bug 52827. It shows up in talkback: http://beckett.mcom.com/talkback/ns6rtmanalysis.html#js_AllocRawStack steps to reproduce: 1) remove the JavaVM plugin files if present. 2) start mozilla or netscape6 3) go to http://javasoft.com/ (or any page with a Java applet) 4) click on the "Click to get the plugin" icon. You should see a "Plugin not loaded" dialog for mime type:"application/x-java-vm". For some pages with applets I've seen this dialog be skipped and it goes directly to the next dialog. 5) Click on the "Get the plugin" button. The dialog will go away and another dialog should appear. This dialog has text reading "Java 2.0 Plug-in for Netscape 6" and three buttons: "Java 2.0 Windows plugin", "Java 2.0 Linux plugin", and "Cancel" (NOTE: when I tried to find this bug I happened to have my fonts set fairly large and this last button was not visible.) 6) Click on the "Java 2.0 Windows plugin" button. The dialog with text: "Items to install" will appear. 7) Click "OK". The "Items to install" dialog will go away and a "Downloading" dialog will appear. 8) while the download progresses (but before it finishes) press the "Cancel" button on the "Java 2.0 Plug-in for Netscape 6" (NOT the "Downloading" dialog). 9) then press "cancel" on the "Downloading" dialog. At this point I see it crash. The JSContext being used in js_AllocRawStack holds garbage. I assume it cooresonds to the closed dialog. It looks like the fix in bug 52827 had to do with tracking the parent window. Perhaps the downloading dialog should be made a child of the "Java 2.0 Plug-in for Netscape 6" window such that the "Java 2.0 Plug-in for Netscape 6" can not be closed? Anyway, I'm seeing this on Win98 and NT with branch and trunk builds. CLearly others see it since it is high in the talkback list. I expect that this problem will occur for users who cancel in this order for any of many sorts of xpi installs. I'll attach a stack. A couple of minor points while I have your attention... - it is odd that the "Java 2.0 Plug-in for Netscape 6" does not size to show all the content when I have large fonts. It does not seem to be user resizable. - The "Downloading" dialog does not have any changing text to indicate progress. On a slower connection with a big file the progress meter is not at all obvious - I bet a lot of people will be cancelling as they think nothing is really happening.

For talkback tracking purpose. [@js_AllocRawStack]

This is a topcrash with the official RTM build. Adding topcrash keyword and [@ js_AllocRawStack] for tracking. Here is the latest stack trace: Incident ID 22061420 js_AllocRawStack [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 355] js_AllocStack [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 387] JS_PushArgumentsVA [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 296] JS_PushArguments [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 270] handleTriggerEvent [d:\builds\seamonkey\mozilla\xpinstall\src\nsXPITriggerInfo.cpp, line 137] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 581] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 517] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 1051] KERNEL32.DLL + 0x248f7 (0xbff848f7) 0x00658b52 And the source file, a few URLs and comments from users that submitted talkback entries: Source File : http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line : 355 URL: http://www.philzone.com/index2.html URL: netscape.com URL: www.netscape.net URL: www.wwfwcw.com Comment: page fault Comment: I wasn't doing anything....the page was loading Comment: Everytime I clik on a link and it connects to Netscape Comment: download of a java medis viewer Comment: I was just completing a netscape plugin download when I got the dreaded "PERFORMED AN ILLEGAL ACT" message Comment: Installing download files Comment: I haven`t been able to send any email when it wasn`t locking up because I didn`t know I had to configure it Comment: downloading Java for netxcape 6 Comment: surfing the music section on netcenter Comment: downloading a file Comment: Downloading Java plugin

Reassigning to Don

Moz 0.9 tasks

*** Bug 66957 has been marked as a duplicate of this bug. ***

*** Bug 66957 has been marked as a duplicate of this bug. ***

Working on bug 66957, I backtracked the nightly's to see when this started occuring, and on my system 2001012606 is the last one that installs correctly. Hope this helps

r=sgehani

sr=mscott

She's a-fixed.

Build: 2001-02-16-09-Mtrunk(WIN) Looks good to me. Marking a-Verified!

Updating summary with N601 since this is a topcrasher for that release. Leaving status unchanged since this has been fixed in the trunk.

Early talkback report on M091 Stack Trace: js_AllocRawStack [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 342] js_AllocStack [d:\builds\seamonkey\mozilla\js\src\jsinterp.c line 374] JS_PushArgumentsVA [d:\builds\seamonkey\mozilla\js\src\jsapi.c line 293] JS_PushArguments [d:\builds\seamonkey\mozilla\js\src\jsapi.c line 267] handleTriggerEvent [d:\builds\seamonkey\mozilla\xpinstall\src\nsXPITriggerInfo.cpp line 148] PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 591] PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 524] _md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c line 1072] KERNEL32.DLL + 0x2222f (0xbff9222f) 0x00688b60 js_AllocRawStack ac8aeb98 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 342 Build: 2001060713 CrashDate: 2001-06-07 UptimeMinutes: 15 Total: 15 OS: Windows 95 4.0 build 67306684 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31468934 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31468934 (31468934) Comments: Downloading and installing Java 2 js_AllocRawStack 197ce55f http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 342 Build: 2001060713 CrashDate: 2001-06-07 UptimeMinutes: 19 Total: 19 OS: Windows 98 4.10 build 67766222 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31468704 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31468704 (31468704) URL: www.hardocp.com (31468704) Comments: i was downloading and installing java js_AllocRawStack 3289eaec http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 349 Build: 2001060713 CrashDate: 2001-06-07 UptimeMinutes: 58 Total: 58 OS: Windows NT 5.0 build 2195 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31468670 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31468670 js_AllocRawStack 4625eaad http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 342 Build: 2001060713 CrashDate: 2001-06-07 UptimeMinutes: 9 Total: 18 OS: Windows 98 4.10 build 67766446 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31466867 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31466867 (31466867) Comments: trying to install java 2 plugin js_AllocRawStack 97b48fe8 http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 342 Build: 2001060713 CrashDate: 2001-06-07 UptimeMinutes: 8 Total: 8 OS: Windows 98 4.90 build 73010104 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31466528 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31466528 js_AllocRawStack 3289eaec http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 342 Build: 2001060713 CrashDate: 2001-06-07 UptimeMinutes: 35 Total: 35 OS: Windows NT 5.0 build 2195 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31466080 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31466080 (31466080) Comments: browsing js_AllocRawStack 2cf5c9da http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/js/src/jsinterp.c line 342 Build: 2001060511 CrashDate: 2001-06-07 UptimeMinutes: 24 Total: 163 OS: Windows NT 5.0 build 2195 Detailed : http://climate/reports/incidenttemplate.cfm?bbid=31447569 StackTrace: http://climate/reports/stackcommentemail.cfm?dynamicBBID=31447569 (31447569) URL: nspolar (31447569) Comments: these days it's been crashing when i do a smart update. hopefully it's like last time (31447569) Comments: install from scratch.

This is a topcrash in M091 Here are comments from recent crashes: (31561805) Comments: Crashed during installation of Java 2 plugin (31556542) Comments: Installing Java 2 Runtime (31551964) Comments: Installing java plugin (31541369) Comments: Downloading the JRE (31538506) Comments: plugin for jave finished downloading.Installation was startet after crash.seemed to work (31537995) Comments: Using mozilla (31533590) Comments: Installing the JRE under Windows ME (31530512) Comments: tried to download java plugin for windows (which never works for me on w2k) (31520492) URL: mozilla.org (31520492) Comments: Running IE5.5 with mozilla.org (31515849) Comments: After D/L the SUN JRE (31514975) URL: http://www.foxsports.com/ (31514975) Comments: New window opened for ads.x10.com while software installation was downloading the java plugin. tvguide listings were still open in the original window. (31509504) Comments: automagically downloading the JRE via smartupdate (or whatever).installer said Not enough free space on C: & then mozilla died. (31508783) Comments: Downoading and installing JRE 1.3.0_01 (31496223) Comments: installing Java Runtime Environment 1.3 (31489018) Comments: Installing the Java 2 Plugin (31478032) Comments: Downloading the windows java machine (31468934) Comments: Downloading and installing Java 2 (31468704) URL: www.hardocp.com (31468704) Comments: i was downloading and installing java (31466867) Comments: trying to install java 2 plugin (31466080) Comments: browsing Stack trace from 2001060713 Incident ID 31561805 js_AllocRawStack() js_AllocStack() JS_PushArgumentsVA() JS_PushArguments() handleTriggerEvent() PL_HandleEvent() PL_ProcessPendingEvents() nsEventQueueImpl::ProcessPendingEvents() event_processor_callback() our_gdk_io_invoke() libglib-1.2.so.0 + 0xf380 (0x4036a380) libglib-1.2.so.0 + 0x10c16 (0x4036bc16) libglib-1.2.so.0 + 0x11243 (0x4036c243) libglib-1.2.so.0 + 0x1140c (0x4036c40c) libgtk-1.2.so.0 + 0x98ddc (0x40277ddc) nsAppShell::Run() nsAppShellService::Run() main1() main() libc.so.6 + 0x18a5e (0x4046ba5e)

The identical stack trace appears in Linux, failing one step earlier in js_AllocStack. platform --> All. Adding M091 and [@ js_AllocStack] to the summary.

Hmm. I just can't reproduce this in a debug build anyway. I just did a trunk build (6/12/01) and then went to http://javasoft.com then clicked on the "click to get plug in" puzzle piece. It brought up the plugin finder and eventually the dialog box with Java 2 Plug-in Version 1.3 title. I clicked on Java 2 Windows Plug-in and then OK in the xpinstall "Items to Install" confirm dialog. When the download started I clicked cancel. It worked just like it's supposed to. I did this test 5 times with no problems. Are we sure that all these crashes are using the xpi file? Or perhaps some other installer method.

Still trying to reproduce this. Is there anyone in QA who can reproduce it?

Ok, further testing with the "shipping" beta Windows version and a debug Unix version (of the latest tip) also shows no problems. I've done the start/cancel thing 5 times on both the Unix tip build and Windows beta version and let it complete the install twice on both versions. I cannot make the program crash. I don't know when the topcrash data was gathered but jband did some work in JS code to fix bug 78428 right before we branched for beta 1. If the data was gathered before that time this may have been fixed by that work.

This stack trace shows up a lot in the 091 release, but is not in todays trunk reports at all.

This continues to be a topcrasher for recent milestones/releases we have had. The latest milestone Mozilla 0.9.2 is showing a good number of these crashes: js_AllocRawStack 48 58573 REOP dbragg@netscape.com mozilla0.9 First BBID :32373689 Last BBID :32723642 Min Runtime :81 Max Runtime :100804 First Appearance Date : 2001-06-30 Last Appearance Date : 2001-07-10 First BuildID : 2001062817 Last BuildID : 2001062823 Stack Trace: js_AllocRawStack() js_AllocStack() JS_PushArgumentsVA() JS_PushArguments() handleTriggerEvent() PL_HandleEvent() PL_ProcessPendingEvents() nsEventQueueImpl::ProcessPendingEvents() event_processor_callback() our_gdk_io_invoke() libglib-1.2.so.0 + 0xeaca (0x40345aca) libglib-1.2.so.0 + 0x10186 (0x40347186) libglib-1.2.so.0 + 0x10751 (0x40347751) libglib-1.2.so.0 + 0x108f1 (0x403478f1) libgtk-1.2.so.0 + 0x8c5b9 (0x4026b5b9) nsAppShell::Run() nsAppShellService::Run() main1() main() libc.so.6 + 0x189cb (0x404419cb) (32701220) URL: http://www.hama.co.uk (32701220) Comments: The JRE plugin just finished downloading (32696696) Comments: tried to load a page where a java-applet was included...the java plug-in wasn't installed yet. when i stopped the plug-in download (32657676) Comments: I clicked a button on a webpage to download the jre-plugin (click here to get the plugin). After downloading Mozilla crashed (32610541) Comments: The browser was up but was not being actively used.The Java VM was being downloaded though and likely finished upwhen Mozilla "crashed." (32601204) Comments: Trying to install JDK 1.3.0 for Linux (automatic installation from Netscape site) (32600457) Comments: Installing JRE (32564583) Comments: installing java (32555745) Comments: Attempting to download the Java VM plugin in one page (through an auto-download/configure program within mozilla) (32516887) URL: ftp.netscape.com (32516887) Comments: terminated download of java runtime. (32462388) Comments: reeading (32426842) URL: ftp.netscape.com (32426842) Comments: trying to download java runtime 1.3 (32419812) Comments: ftp://ftp.netscape.com/pub/netscape6/english/6.0/unix/linux22/xpi/jre.xpi (32418753) Comments: I downloaded JAVA2 and in the moment installation starts Mozilla crashes. (32405338) URL: http://home.netscape.com/plugins/jvm.html (32405338) Comments: Attempting to install the JRE (32379321) URL: ftp.netscape.com (32379321) Comments: downloading java2 plugin (32377083) URL: http://www.mozilla.org (32377083) Comments: trying to install the Java 1.3.1 plug-in (32374357) Comments: I was just viewing a simple page and js_AllocStack 23 58573 REOP dbragg@netscape.com mozilla0.9 50942 VERI FIXE dbragg@netscape.com --- First BBID :32359102 Last BBID :32721538 Min Runtime :90 Max Runtime :32663 First Appearance Date : 2001-06-30 Last Appearance Date : 2001-07-10 First BuildID : 2001062817 Last BuildID : 2001062823 Stack Trace: js_AllocStack() JS_PushArgumentsVA() JS_PushArguments() handleTriggerEvent() PL_HandleEvent() PL_ProcessPendingEvents() nsEventQueueImpl::ProcessPendingEvents() event_processor_callback() our_gdk_io_invoke() (32655790) Comments: Installing Java (but it did finish installing it). (32546046) URL: www.mozilla.org / home.netscape.com/plugin (32546046) Comments: Trying to download the java plugin for mozilla 0.9.2 (32520074) URL: http://www.tvguide.com/ (32520074) Comments: Browser. (32502075) URL: java.sun.com (32502075) Comments: I cancelled the software download window when mozilla tried to download java (32489752) Comments: closing it. (32416473) URL: downloading java component from ftp.netscape.com (32416473) Comments: trying to watch streaming video with a java applet (32397695) URL: www.india-today.com (32397695) Comments: I tried to download the Java2 plugin - and hit cancel as the download was too slow but the dialog box would not go away. Then I tried to edit preferences to change the font quality from 96dpi to "system default"... (32385916) Comments: waiting for download (32359102) Comments: tried to install java 1.2 Adding M092 to summary for tracking.

Ignore the "Cancel" part of this bug summary -- the reopened bug is different than the original (none of the comments mention cancelling). Still a js memory crash and thus the same stack trace, but the cause of corruption is obviously different. Probably now related to bug 78442

Marking dupe of 78442 per discussion with PDT. (Hopefully it's a dupe.) For all those that can reproduce this bug please try is on the branch. 78442 was just checked in (5:00 on 7/13/01). *** This bug has been marked as a duplicate of 78442 ***

Bug 78442 has been marked verified. Marking this one Verified.