FULL PRODUCT VERSION :
java 1.6.0_018 and above (used 1.6.0_020 for tests)

ADDITIONAL OS VERSION INFORMATION :
Windows 6.1.7600
Windows xp 5.1.2600


EXTRA RELEVANT SYSTEM CONFIGURATION :
IE 8.0.7600.16385 (on windows 7)
IE 6.0.2900.2180.xpsp_sp2_gdr.090804-1412 (on windows xp)

A DESCRIPTION OF THE PROBLEM :
With java version 1.6.0_018 and later (update 20 was used for our testing) on a windows computer, our applet will load but after loading IE crashes often. It does not happen all the time, but happens often enough (at least 1 in 10). When it crashes the file that is indicated that crashed is jp2iexp.dll, which I think is the java plugin for IE. This seems to happen on different versions of windows (xp, 7, maybe others), and different versions of IE (6-8).
Here is a link to crash reports and java trace logs for crashes on windows 7 and windows xp: http://betamail.netopia.com/windowsjavacrashes.zip


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. On a Windows computer with 1.6.0_018 and later, use IE (6 through 8) and navigate to http://ecare6.netopia.com/sunflower
2. eCare will start the applet loading, and bring up a trusted dialog

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The result should have been the same as the result with previous versions of java. The applet should load, not crash the browser and the user should come to an eCare welcome screen to enter information.

ACTUAL -
The browser crashes and the user can not use eCare.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
See http://betamail.netopia.com/windowsjavacrashes.zip for crash dump and logs, as well as below:

Windows 7 crash dump:
Log Name: Application
Source: Application Error
Date: 4/16/2010 11:10:50 AM
Event ID: 1000
Task Category: (100)
Level: Error
  Keywords: Classic
  User: N/A
Computer: MacbookPro
  Description:
Faulting application name: iexplore.exe, version: 8.0.7600.16385, time stamp: 0x4a5bc69e
Faulting module name: jp2iexp.dll, version: 6.0.200.2, time stamp: 0x4bc3c8e3
Exception code: 0xc0000005
Fault offset: 0x00002911
Faulting process id: 0xfd0
Faulting application start time: 0x01cadd7f5b12db60
Faulting application path: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Faulting module path: C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll
Report Id: 9f47f220-4972-11df-84fd-60fb428131f6
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-04-16T16:10:50.000000000Z" />
    <EventRecordID>2095</EventRecordID>
    <Channel>Application</Channel>
    <Computer>MacbookPro</Computer>
    <Security />
  </System>
  <EventData>
    <Data>iexplore.exe</Data>
    <Data>8.0.7600.16385</Data>
    <Data>4a5bc69e</Data>
    <Data>jp2iexp.dll</Data>
    <Data>6.0.200.2</Data>
    <Data>4bc3c8e3</Data>
    <Data>c0000005</Data>
    <Data>00002911</Data>
    <Data>fd0</Data>
    <Data>01cadd7f5b12db60</Data>
    <Data>C:\Program Files (x86)\Internet Explorer\iexplore.exe</Data>
    <Data>C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll</Data>
    <Data>9f47f220-4972-11df-84fd-60fb428131f6</Data>
  </EventData>
</Event>

Log Name: Application
Source: Windows Error Reporting
Date: 4/16/2010 11:10:54 AM
Event ID: 1001
Task Category: None
Level: Information
  Keywords: Classic
  User: N/A
Computer: MacbookPro
  Description:
Fault bucket 1811341591, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: iexplore.exe
P2: 8.0.7600.16385
P3: 4a5bc69e
P4: jp2iexp.dll
P5: 6.0.200.2
P6: 4bc3c8e3
P7: c0000005
P8: 00002911
P9:
P10:

Attached files:
C:\Users\Mike\AppData\Local\Temp\WER3218.tmp.WERInternalMetadata.xml

These files may be available here:
C:\Users\Mike\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_iexplore.exe_9119d79964fee5bd131f63d3bbf8639abb12616c_0b2b40f6

Analysis symbol:
Rechecking for solution: 0
Report Id: 9f47f220-4972-11df-84fd-60fb428131f6
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-04-16T16:10:54.000000000Z" />
    <EventRecordID>2096</EventRecordID>
    <Channel>Application</Channel>
    <Computer>MacbookPro</Computer>
    <Security />
  </System>
  <EventData>
    <Data>1811341591</Data>
    <Data>1</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>iexplore.exe</Data>
    <Data>8.0.7600.16385</Data>
    <Data>4a5bc69e</Data>
    <Data>jp2iexp.dll</Data>
    <Data>6.0.200.2</Data>
    <Data>4bc3c8e3</Data>
    <Data>c0000005</Data>
    <Data>00002911</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Users\Mike\AppData\Local\Temp\WER3218.tmp.WERInternalMetadata.xml</Data>
    <Data>C:\Users\Mike\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_iexplore.exe_9119d79964fee5bd131f63d3bbf8639abb12616c_0b2b40f6</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>9f47f220-4972-11df-84fd-60fb428131f6</Data>
    <Data>0</Data>
  </EventData>
</Event>







REPRODUCIBILITY :
This bug can be reproduced often.

CUSTOMER SUBMITTED WORKAROUND :
The only thing we found to bypass the bug was to use an older version of java.

Release Regression From : 6u17
The above release value was the last known release where this
bug was not reproducible. Since then there has been a regression.

Release Regression From : 6u17
The above release value was the last known release where this
bug was not reproducible. Since then there has been a regression.
New info from the submitter:
----------------------------

After some work we have been able to isolate the problem, and reproduce
it outside of our product.
Here is the way to reproduce:

1. make an applet, for example the following source file
testApplet.java:
import java.applet.Applet;

public class testApplet extends Applet
{
    public void init ()
    {
        System.out.println("test");
    }
}


2. create an html file with the following contents:

<html>
<head>
<script>
function checkJava()
{
var isJavaPresent = false;

var plugin;
try {
plugin = new ActiveXObject("JavaPlugin");
if(plugin)
isJavaPresent = true;
else
alert("java is not present");
}
catch (e)
{
alert("exception");
}

if(isJavaPresent==true)
alert("java present");
}


checkJava();
setTimeout("alert('now
crashing');window.location='http://www.google.com&#39;;",10000);
</script>


</head>

<body>
<applet code='testApplet.class'
         codebase= '.'
            name='Java' id='java'
            archive='testApplet.jar'
            >
              
        </applet>
</body>

 </html>

3. place the applet jar file and the html in a web server of some kind.
   Now on a windows computer with java 1.6 update 18 through 20
installed, navigate to the HTML page using IE.
Expected results:
1. an alert indicating that java in installed.
2. the applet loads
3. after 10 seconds an alert indicating it is about to crash
   Hit "ok" and the browser will crash.

A theory on why it crashes:
>From the error message, it looks like the java plugin is accessing
memory that it should not. Either the pointer was not set right, or
maybe more likely the java ActiveXObject plugin and the applet are
referencing the same memory, while one decides to free the memory. The
other accesses and causes the crash.
Same issue reported by a CAP member -

the code causing the crash is pretty simple and looks something like:
    <SCRIPT language="VBScript">
            on error resume next
            hasJRE_JavaPlugin = not IsNull(CreateObject("JavaPlugin")) <---- cause the crash
            hasJRE_JavaBeansBridge = not IsNull(CreateObject("JavaSoft.JavaBeansBridge"))
            hasJRE_JavaWebStart = not IsNull(CreateObject("JavaWebStart.isInstalled"))
            hasJRE = (hasJRE_JavaPlugin Or hasJRE_JavaBeansBridge Or hasJRE_JavaWebStart)
    </SCRIPT>


It works fine with 6u18, but fail on 6u19, 6u20 and 6u21