[Bug 1000885] [NEW] ff crashes on xslt transformation when using oracle java plugin

[Ritesh Khadgaray]

Public bug reported:

Firefox crashes when performing an XSLT transformation when also loading
any <applet> stanza when the Oracle java plugin is used.

= Environment =

* oracle jre 6u31 (*any* oracle/sun java plugin)
* Firefox (any version)
* Ubuntu 10.04 LTS , 11.04, 11.10 or 12.04 LTS 32-bit
* Web page containing xslt reproducer (attached)

= Reproducible =
100% (see attachment reproducer) but only with the Oracle Java plugin, not the iced tea plugins in the archive.

= Workaround =
Use the OpenJDK/IcedTea plugin - this is not a viable option due to the customers application certification.


= Further Information =
Reproducing on Ubuntu 12.04 LTS 32-bit with Firefox (11.0+build1-0ubuntu4)

1. Download the two JRE's from:
http://www.oracle.com/technetwork/java/javase/downloads/index.html

2. Extract both Oracle JRE's:
$ bash ./jre-6u31-linux-i586.bin
$ tar -xvf jre-7u3-linux-i586.tar.gz
$ sudo mv jre1.* /usr/lib/jvm

3. Install the plugins into the alternatives system to switch easily:
$ sudo update-alternatives --install /usr/lib/mozilla/plugins/libjavaplugin.so mozilla-javaplugin.so /usr/lib/jvm/jre1.6.0_31/lib/i386/libnpjp2.so 1059
$ sudo update-alternatives --install /usr/lib/mozilla/plugins/libjavaplugin.so mozilla-javaplugin.so /usr/lib/jvm/jre1.7.0_03/lib/i386/libnpjp2.so 1058

4. Unpack the xslt-crash-reproducer.zip
$ unzip xslt-crash-reproducer.zip

5. Open Firefox and check "about:plugins", open file:///path/to/test1.html  . Repeat with alternating   java plugins using alternatives to reconfiure which plugin is active:
sudo update-alternatives --config mozilla-javaplugin.so


= backtrace  =

[Thread 0xa38a7b40 (LWP 2384) exited]
nsPluginNativeWindowGtk2: call SetWindow with xid=0x3e00291
--DOMWINDOW == 14 (0x811f4368) [serial = 14] [outer = 0x811e7e58] [url = about:blank]

Program received signal SIGSEGV, Segmentation fault.
0xb5fd9fbb in AssertActivityIsLegal ()
    at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:167
167	/tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp: No such file or directory.
(gdb) bt
#0  0xb5fd9fbb in AssertActivityIsLegal ()
    at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:167
#1  0xb5fdc8d2 in NS_LogDtor_P (aPtr=0x81405fe0, 
    aType=0xb6a941ab "txInstruction", aInstanceSize=8)
    at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/xpcom/base/nsTraceRefcntImpl.cpp:1148
#2  0xb5232e0e in txInstruction::~txInstruction (this=0x81405fe0, 
    __in_chrg=<optimized out>)
    at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/content/xslt/src/xslt/txInstructions.h:64
#3  0xb5237966 in txStartLREElement::~txStartLREElement (this=0x81405fe0, 
    __in_chrg=<optimized out>)
    at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/content/xslt/src/xslt/txInstructions.h:388
#4  0xb52379a7 in txStartLREElement::~txStartLREElement (this=0x81405fe0, 
    __in_chrg=<optimized out>)
    at /tmp/buildd/firefox-12.0+build1/build-tree/mozilla/content/xslt/src/xslt/txInstructions.h:388
#5  0xb5237187 in nsAutoPtr<txInstruction>::~nsAutoPtr (this=0x81405fc4, 
    __in_chrg=<optimized out>) at ../../../../dist/include/nsAutoPtr.h:105
#6  0xb5232e1c in txInstruction::~txInstruction (this=0x81405fc0, 
    __in_chrg=<optimized out>)

** Affects: firefox (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to firefox in Ubuntu.
https://bugs.launchpad.net/bugs/1000885

Title:
  ff crashes on xslt transformation when using oracle java plugin

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1000885/+subscriptions