United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-6744951 Applets not correctly destroyed after LiveConnect interactions
JDK-6744951 : Applets not correctly destroyed after LiveConnect interactions

Details
Type:
Bug
Submit Date:
2008-09-04
Status:
Closed
Updated Date:
2013-01-09
Project Name:
JDK
Resolved Date:
2008-10-02
Component:
deploy
OS:
windows_xp
Sub-Component:
plugin
CPU:
x86
Priority:
P3
Resolution:
Fixed
Affected Versions:
6u10
Fixed Versions:
6u10 (b33)

Related Reports

Sub Tasks

Description
FULL PRODUCT VERSION :
Java(TM) SE Runtime Environment (build 1.6.0_10-rc-b28)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]

EXTRA RELEVANT SYSTEM CONFIGURATION :
Mozilla Firefox 3.0.1

A DESCRIPTION OF THE PROBLEM :
Java applets are not always cleaned up after a LiveConnect interaction in Mozilla Firefox 3.0.1.  This is more noticeable with large applets, but I was able to recreate the problem using the test case below.  I used Yourkit Java Profiler to capture memory state, and the trace suggests that references to the applets are stored in the exportedObjectMap of the sun.plugin2.main.client.LiveConnectSupport class even after I have navigated away from the page.
  I can provide memory dumps from Yourkit if they would be helpful.  The applet references are sometimes cleared with no problem, however, with larger applets, I have found that the applets are often left even after browsing away from the page.  These references eventually cause OutOfMemory exceptions after loading the applet pages several times in one browser session.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Use the applet in the attached test case
Navigate to the included test.html
Click the "Change size" button
Navigate to test2.html
Navigate to test.html
Repeat this back and forth processing (do not use the browsers back button).

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Only the current page applet shows up in the memory output.
ACTUAL -
After 20 or so back and forth cycles, I had 5 applets "stuck" in the exportedObjectMap of the LiveConnectSupport class.  These applets are never removed from memory.

REPRODUCIBILITY :
This bug can be reproduced often.

---------- BEGIN SOURCE ----------
------------------------------TestApplet.java-----------------------------
import javax.swing.JApplet;
public class TestApplet extends JApplet {
	private double[] big_array = new double[100000];
}
------------------------------test2.html----------------------------------
<html>
<head>
<title>
LiveConnect Test
</title>
</head>
<body>
  <div style='border:3px;border-style:solid'>
	<object id="test_applet" height="100" width="100" name="test_applet" >
	  <param value="application/x-java-applet;version=1.6" name="type"/>
	  <param value="true" name="scriptable"/>
	  <param value="TestApplet.class" name="code"/>
	  <comment>
	    <embed
	     id="test_applet"
	     height="100"
	     width="100"
	     mayscript="true"
	     code="TestApplet.class"
	     type="application/x-java-applet;version=1.6"
	     name="test_applet" />
	    <noembed>No Java Plug-in Support</noembed>
	  </comment>
	</object>
  </div>
	No Livescript interaction on this page.
</body>
</html>
---------------------------------test.html--------------------------------
<html>
<head>
  <script type='application/javascript' language='JavaScript'>
	function ResizeMe() {
		document.embeds['test_applet'].height = '500';
	}
  </script>
  <title>LiveConnect Test -- with resize</title>
</head>
<body>
  <div style='border:3px;border-style:solid'>
	<object id="test_applet" height="100" width="100" name="test_applet" >
	  <param value="application/x-java-applet;version=1.6" name="type"/>
	  <param value="true" name="scriptable"/>
	  <param value="TestApplet.class" name="code"/>
	  <comment>
	    <embed
	     id="test_applet"
	     height="100"
	     width="100"
	     mayscript="true"
	     code="TestApplet.class"
	     type="application/x-java-applet;version=1.6"
	     name="test_applet" />
	    <noembed>No Java Plug-in Support</noembed>
	  </comment>
	</object>
  </div>
  <button onclick="ResizeMe();">Change Size</button>
</body>
</html>

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Restarting the browser is the only way I have found to clear the memory.

                                    

Comments
EVALUATION

The lifecycle of Java objects returned to the web browser is an area that has never been well specified. Currently we rely on the web browser to provide notifications that each individual JavaScript object referring to a Java object has been released. Instead, upon destruction of a particular applet instance, we should probably forcibly break the references from the JavaScript engine to any Java objects returned from the scope of that instance.
                                     
2008-09-09
SUGGESTED FIX

webrev: http://sa.sfbay.sun.com/projects/deployment_data/6u10/6744951.1
testcase: http://j2se.east.sun.com/deployment/www/tests/1.6.0_10/6744951/
                                     
2008-09-22
EVALUATION

It appears that we occasionally aren't receiving notifications from
the web browser that a given reference from the JavaScript engine to a
Java object has been released.

Once an applet has been shut down, all references from the JavaScript
engine to objects exposed from that applet's scope are conceptually
dead. This change enforces this lifecycle by releasing all references
from the LiveConnect subsystem to objects exported from that applet's
scope when the applet is shut down.
                                     
2008-09-22



Hardware and Software, Engineered to Work Together