iexplore.exe crash in AwtWindow::IsFocusableWindow() in file awt_Window.cpp(1185)

Customer keeps getting crashes of iexplore.exe when running Java applets
on Windows XP Build 2600 Service Pack 2 (IE 6.0 with SP2).
The problem is not reproducible and happens intermittently.
Customer is running 1.4.2_06, however problem also occurred with
1.5.0_09.


From hs_err_pid.log files we can see where the crash occurs.
Please find "50400961_13012007_hs_err_pid3776.log" file attached.


Stack: [0x083b0000,0x084b0000), sp=0x084afa5c, free space=1022k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [awt.dll+0xe9299]
J sun.awt.windows.WComponentPeer.nativeHandleEvent(Ljava/awt/AWTEvent;)V
J sun.awt.windows.WComponentPeer.handleEvent(Ljava/awt/AWTEvent;)V
J java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V
v ~RuntimeStub::alignment_frame_return Runtime1 stub
j java.awt.Container.dispatchEventImpl(Ljava/awt/AWTEvent;)V+42
J java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V
J java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z
v ~RuntimeStub::alignment_frame_return Runtime1 stub
j java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V+26
j java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
j java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
j java.awt.EventDispatchThread.run()V+9
v ~StubRoutines::call_stub
V [jvm.dll+0x86e84]
V [jvm.dll+0xddead]
V [jvm.dll+0x86d55]
V [jvm.dll+0x86ab2]
V [jvm.dll+0xa16b2]
V [jvm.dll+0x10f4ac]
V [jvm.dll+0x10f47a]
C [msvcrt.dll+0x2a3b0]
C [kernel32.dll+0xb683]

 Using 1.5.0_09 symbol files allows to translate address awt.dll+0xe9299
 back:

0:000> ln awt+0xe9299
../../../src/windows/native/sun/windows/awt_Window.cpp(1185)
(6d0e9270) awt!AwtWindow::IsFocusableWindow+0x29 | (6d0e9320)
awt!AwtWindow::_SetModalExcludedNativeProp
0:000>

 Looking into source code gives:

1180 BOOL AwtWindow::IsFocusableWindow() {
1181 JNIEnv *env = (JNIEnv *)JNU_GetEnv(jvm, JNI_VERSION_1_2);
1182 if (env->EnsureLocalCapacity(2) < 0) {
1183 return FALSE;
1184 }
1185 jobject target = GetTarget(env); <=========================== !!!
1186 static jfieldID FocusableWindowStateID = 0;
1187 if (FocusableWindowStateID == 0) {
1188 jclass windowClass = env->GetObjectClass(target);
1189 FocusableWindowStateID = env->GetFieldID(windowClass, "focusableWindowState", "Z");
1190 env->DeleteLocalRef(windowClass);
1191 }
1192
1193 BOOL focusability = env->GetBooleanField(target, FocusableWindowStateID);
1194 env->DeleteLocalRef(target);
1195 return focusability;
1196 }