P4 Name: clC74495 Date: 11/15/99
[ Carlos.Lucasius@Canada, November 15, 1999: for test case, see
"Attachments..." ]
NOTE THIS IS A PROBLEM FOR PLUGIN 1.1.1i
1. SUN Bug ID
2. Workarounds:
A number of suggested workaroduns have been tried
IME-95 is not a sufficent workaround - the problem still occurs but less frequently. The end customer
is not willing to except IME-95.
3. Test Case and Failure Data
System - Japanese 95 OSR2 - IME 98 - Netscape 4.6 Japanese or 4.61 English. Plugin 1.1.1i with default JRE
A simple applet is being run inside the Plugin 1.1.1i This applet consists of a text field
and button. When the button is pressed then, showDocument is called to transfer the
web page to the one entered in the text field. The original test case orignally used swing but
we removed this and the problem still exists.
I have also seen the problem is Netscape is closed when applet is being displayed. This seemed
to suggest is was some sort of shut down procedure rather than a fault connected with showDocument.
This then will generate a GPF. This always occurs in the same place in USER.dll.
This occurs on the majority of attempts. (at least 1 in 2). We
have been unable to gerenate a stack trace for this probkem. We do have BugTrapper log files
if they would be useful. Dr Watson dumps (included) have been generated. (NB I have not been able
to read these myself - I will attempt to regenerate them in case they are corrupt).
Running the test case as a applet using the browsers native VM does not cause any problems.
Running with Plugin 1.1.3 and the default Sun JRE 118 with Netscape 4.6/4.7 does produce the
same problems.
3.1 CRASH:
Attatched are the Dr Watson dumps that a crash this morning produced. These cam from the machine
when we were running Plugin 1.1.3 vith the default 1.1.8 JVM and Netsacpe 4.6.
The development team who raised this problem. generated the following analysis.
<Start of Analysis>
My customer is having a problem that a general protection fault of
Netscape Navigator occurs when the method AppletContext#showDocument is
called. We have tested some cases and this problem occurs under the specific
combination of an OS,a browser and Java Plugin.
Combination:
Windows 95 OSR2/98 (Japanese Edition)
MS-IME 97/98/2000 (IME : Input Method Editor)
Netscape Communicator 4.6(Japanese)/4.61(English)
Java Plugin 1.1.1i
This problem doesn't occur when Windows NT 4.0,Internet Explorer or MS-IME
95 is being used.
We've now suspected that IME (Input Method Editor) which is used to input
Japanese language is having a trouble,because behaviours are different
as to whether the tool bar of MS-IME hides under the windows task bar or not,
so this problem may not occur under English vesion of Windows 95/98.
ISEL,Yamato Lab, have looked into this situation and noticed :
1. Windows Handles when this problem occures are
below.
---------------------------------------------------
:hwnd netscape
Window Handle hQueue SZ QOwner Class Name Window
Procedure
0390(1) 2D97 32 NETSCAPE AwtFrame
1397:0000072E
(omitting)
1397:000005B8
0364(1) 2D97 32 NETSCAPE IME
175F:00000000
0368(1) 2D97 32 NETSCAPE msime95main
1397:0000012A
0228(1) 3027 32 NETSCAPE Afx:400000:b:1416
1397:0000067E
022C(2) 3027 32 NETSCAPE Afx:400000:3028
1397:000005B8
0384(3) 3027 32 NETSCAPE aPluginWinClass
1397:00000744
0388(4) 2D97 32 NETSCAPE AwtFrame
1397:0000072E
038C(5) 2D97 32 NETSCAPE AwtCanvas
1397:0000072E
0398(6) 2D97 32 NETSCAPE AwtCanvas
1397:0000072E
039C(7) 2D97 32 NETSCAPE AwtCanvas
1397:0000072E
0234(2) 3027 32 NETSCAPE Afx:400000:808:14
1397:000005B8
029C(3) 3027 32 NETSCAPE Afx:400000:809:14
(omitting)
1607:0000549C
0360(1) 2D97 32 NETSCAPE AwtToolkit
1397:00000702
---------------------------------------------------
2. You can find an aPluginWinClass(0384) handle and it has a child handle
AwtFrame(0388) and AwtFrame(0388) has a child AwtCanvas(038C) and so
on...
3. When the problem occurs, the main thread of Netscape sends
DestoryWindow() to AwtCanvas(039c),AwtCanvas(0398),AwtCanvas(0389c) and
AwtFrame(0388) from offset 0x016c6c of winawt.dll. But before completing
DestoryWindow() API sending to AwtFrame(0388) , somehow the main thread
takes the controll again and sends DestoryWindow() to aPluginWinClass(0384)
from offset 0x2e0edf of netscape.exe. So windows(user.exe) invokes a GPF
because DestoryWindow is not re-entrant.
<end of analysis>
4. Targeted FCS Release
The customer is locked into the 1.1.1 Plug-in do the dependancy on Swing-1.0.3, so ideally we
would want a code fix (diff) based upon the 1.1.1 platform.
5. Operational/Business Justification
The development is locked into swing-1.0.3 and cannnot change at this stage in their product -it
is due to ship early in 2000.
This defect would prevent them from deploying on the system. This piece of code is used frequently in
the product - made up of over 200 applets.
I believe they are wanting to enter testing in Decemeber, and this problem is holding them up.
6. Suggested Fix:
None
==== [ Carlos.Lucasius@Canada: Some additional info on this bug follows: ] ====
Date: Mon, 15 Nov 1999 10:29:04 +0000 (GMT)
From: Michelle Devereux <###@###.###>
Subject: Re: (Review ID: 97785) GPF Raised with Plug-in on Netscape
To: ###@###.###
Cc: ###@###.###, ###@###.###
MIME-Version: 1.0
Hi Carlos,
Below is the information from Matthew White in IBM for review id
97785. If you need any further information just let me know.
Michelle
------------- Begin Forwarded Message -------------
X-Unix-From: ###@###.### Thu Oct 28 15:43:05 1999
From: ###@###.###
X-Lotus-FromDomain: IBMGB
To: undisclosed-recipients:;
To: ###@###.###
cc: ###@###.###, ###@###.###
Date: Thu, 28 Oct 1999 15:42:45 +0100
Subject: Our Defect 11766 - GPF In Plug-in 1.1.1
Mime-Version: 1.0
Content-Disposition: inline
Michelle
Please find below the complete information we have about this problem.
Should an escaltion amount from this we would of course forward a
template with all this information in, plus business case as usual.
1 - Test Case. Attatched in file testcase.zip are the instructions
and binary for the testcase, The rate of failure is now being observed
as at least 1 in 2. Swing has been removed from the equation, the
test case is pure AWT. Running the same test case as a normal applet
does not show the problem, using the Plug-in does. I do not believe
the failure is realted to the code of showDocument rather that it is
caused by the fact that this causes a web page change - more info
below. (See attached file: TestCase.zip)
2- Stack Trace. I have attempted to get a strack trace, but every
time when Netscape exits, the machine locks when transferring control
to MSDEV. I do have a BugTrapper log file. Currently this only shows
method calls inside the NPJava32.dll so its evidence is not
conclusive. Work is continuing in this area - I want to try and get
it to look at methods inside Netscape and Winawt.dll. However this
clearly shows that there is not problem with the showDocument call,
the problem does not occur until later.
However below is an analysis that has come from the development team.
We are asking how the have obtained this information.
<Start of Analysis> My customer is having a problem that a general
protection fault of Netscape Navigator occurs when the method
AppletContext#showDocument is called. We have tested some cases and
this problem occurs under the specific combination of an OS,a browser
and Java Plugin.
Combination:
Windows 95 OSR2/98 (Japanese Edition)
MS-IME 97/98/2000 (IME : Input Method Editor)
Netscape Communicator 4.6(Japanese)/4.61(English)
Java Plugin 1.1.1i
This problem doesn't occur when Windows NT 4.0,Internet Explorer or
MS-IME 95 is being used.
We've now suspected that IME (Input Method Editor) which is used to
input
Japanese language is having a trouble,because behaviours are different
as to whether the tool bar of MS-IME hides under the windows task bar
or not, so this problem may not occur under English vesion of Windows
95/98.
ISEL,Yamato Lab, have looked into this situation and noticed :
1. Windows Handles when this problem occures are
below.
---------------------------------------------------
:hwnd netscape
Window Handle hQueue SZ QOwner Class Name Window
Procedure
0390(1) 2D97 32 NETSCAPE AwtFrame
1397:0000072E
(omitting)
1397:000005B8
0364(1) 2D97 32 NETSCAPE IME
175F:00000000
0368(1) 2D97 32 NETSCAPE msime95main
1397:0000012A
0228(1) 3027 32 NETSCAPE Afx:400000:b:1416
1397:0000067E
022C(2) 3027 32 NETSCAPE Afx:400000:3028
1397:000005B8
0384(3) 3027 32 NETSCAPE aPluginWinClass
1397:00000744
0388(4) 2D97 32 NETSCAPE AwtFrame
1397:0000072E
038C(5) 2D97 32 NETSCAPE AwtCanvas
1397:0000072E
0398(6) 2D97 32 NETSCAPE AwtCanvas
1397:0000072E
039C(7) 2D97 32 NETSCAPE AwtCanvas
1397:0000072E
0234(2) 3027 32 NETSCAPE Afx:400000:808:14
1397:000005B8
029C(3) 3027 32 NETSCAPE Afx:400000:809:14
(omitting)
1607:0000549C
0360(1) 2D97 32 NETSCAPE AwtToolkit
1397:00000702
---------------------------------------------------
2. You can find an aPluginWinClass(0384) handle and it has a child
handle
AwtFrame(0388) and AwtFrame(0388) has a child AwtCanvas(038C) and so
on...
3. When the problem occurs, the main thread of Netscape sends
DestoryWindow() to AwtCanvas(039c),AwtCanvas(0398),AwtCanvas(0389c)
and AwtFrame(0388) from offset 0x016c6c of winawt.dll. But before
completing
DestoryWindow() API sending to AwtFrame(0388) , somehow the main
thread takes the controll again and sends DestoryWindow() to
aPluginWinClass(0384)
from offset 0x2e0edf of netscape.exe. So windows(user.exe) invokes a
GPF because DestoryWindow is not re-entrant.
<end of analysis>
This is the extent of out information at present.
Regards,
Matthew
Matthew B White
JTC Service
IBM UK Ltd, Hursley Park, Winchester, Hants. SO21 2JN.
e-mail: ###@###.### or Matthew White/UK/IBM@IBMGB
Tel : +44 (0) 1962 817653 (International) 247653 (Internal)
------------- End Forwarded Message -------------
(Review ID: 97785)
======================================================================