SHORT SUMMARY:
IE crashes from time to time in jp2iexp.dll when the customer's web
application tries to load an applet. The root cause is in
IDispatchPtr CAxControl::getAppletIDispatch(EXCEPINFO* pei)
method - it prematurely releases a CJavaDispatch instance when is re-entered
from a nested event processing loop if called during the applet
initialization time. The fix is to modify the method in a way that prevents
such misbehavior.
INDICATORS:
IE crashes with the following stack trace:
jp2iexp!CAxControl::getAppletIDispatch+0x47
[deploysrcpluginwin32plugin2jp2iexpaxcontrol.cpp @ 2308]
jp2iexp!CAxControl::GetIDsOfNames+0xe9
[deploysrcpluginwin32plugin2jp2iexpaxcontrol.cpp @ 1736]
MSHTML!COleSite::GetDispIDFromControl+0x7c
MSHTML!COleSite::GetCustomDispID+0x60
...
TRIGGERS:
The customer's application heavily uses JS <-> Java calls in both directions.
Some of these calls are made even when the Java applet is not initialized
yet.
KNOWN WORKAROUND:
The application should not issue any JS -> Java calls while the corresponding
Java applet is initializing.
PRESENT SINCE:
According to the customer, the crash happens at least since 6u32 and 7u7.
HOW TO VERIFY:
Use the account provided by the customer to login to their application and
reproduce the sequence of actions described in the original issue report.
REGRESSION:
To be confirmed.
}
***