United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
JDK-7073337 : Crash after playing Java game on Pogo

Details
Type:
Bug
Submit Date:
2011-07-31
Status:
Resolved
Updated Date:
2014-11-17
Project Name:
JDK
Resolved Date:
2011-10-18
Component:
client-libs
OS:
generic,other,windows_nt,windows_xp,windows_vista,windows_7
Sub-Component:
java.awt
CPU:
other,x86
Priority:
P3
Resolution:
Fixed
Affected Versions:
6,6u25,6u26,6u27,6u29,7
Fixed Versions:

Related Reports
Backport:
Backport:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:
Duplicate:

Sub Tasks

Description
FULL PRODUCT VERSION :
Internet Explorer
 1.Launch Internet Explorer browser.
 2.Click on the Help tab at the top.
 3.Select About Internet Explorer which will bring up an information window.
 If version of IE displays 64-bit Edition, then it is 64-bit IE, otherwise it is a 32-bit browser.
 

A DESCRIPTION OF THE PROBLEM :
I play pogo on Internet explorer and the message as shown below show on my desktop as notepad.  I exit any java game and this message show up.  I have tried numberous times to get help with you and Pogo.  They resolved that I use google chrome to play.  I did that and got no message and its run perfectly.  But the fact is I don't want another browser when I already have Microsoft as my default

ERROR MESSAGES/STACK TRACES THAT OCCUR :
hs_err_pid3...



# A fatal error has been detected by the Java Runtime Environment:
 
#
 
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x80000000, pid=3652, tid=2764
 
#
 
# JRE version: 6.0_26-b03
 
# Java VM: Java HotSpot(TM) Client VM (20.1-b02 mixed mode, sharing windows-x86 )
 
# Problematic frame:
 
# C  0x80000000
 
#
 
# If you would like to submit a bug report, please visit:
 
#   http://java.sun.com/webapps/bugreport/crash.jsp
 
# The crash happened outside the Java Virtual Machine in native code.
 
# See problematic frame for where to report the bug.
 
#
 
 
 
---------------  T H R E A D  ---------------
 
 
 
Current thread (0x04e0c800):  JavaThread "AWT-Windows" daemon [_thread_in_native, id=2764, stack(0x052b0000,0x05300000)]
 
 
 
siginfo: ExceptionCode=0xc0000005, reading address 0x80000000
 
 
 
Registers:
 
EAX=0x6d0cffff, EBX=0x00000001, ECX=0x09b1c380, EDX=0x00000004
 
ESP=0x052ff9c0, EBP=0x052ff9ec, ESI=0x04e0c928, EDI=0x09b1c380
 
EIP=0x80000000, EFLAGS=0x00010293
 
 
 
  Top of Stack: (sp=0x052ff9c0)
 
0x052ff9c0:   6d09cb90 00000000 6d09c650 00000000
 
0x052ff9d0:   052ffa68 00000000 04e0c928 052ff9c4
 
0x052ff9e0:   052ffa80 6d0c04a8 00000001 052ffa18
 
0x052ff9f0:   74cb62fa 00020472 0000981a 09b1c380
 
0x052ffa00:   00000000 6d09c650 dcbaabcd 00000000
 
0x052ffa10:   00000000 6d09c650 052ffa90 74cb6d3a
 
0x052ffa20:   6d09c650 00020472 0000981a 09b1c380
 
0x052ffa30:   00000000 79e41b45 052ffb24 052ffb1c

 
 
Instructions: (pc=0x80000000)
 
0x7fffffe0:

[error occurred during error reporting (printing registers, top of stack, instructions near pc), id 0xc0000005]
 
 
 
Register to memory mapping:
 
 
 
EAX=0x6d0cffff is an unknown value
 
EBX=0x00000001 is an unknown value
 
ECX=0x09b1c380 is an unknown value
 
EDX=0x00000004 is an unknown value
 
ESP=0x052ff9c0 is pointing into the stack for thread: 0x04e0c800
 
EBP=0x052ff9ec is pointing into the stack for thread: 0x04e0c800
 
ESI=0x04e0c928 is an unknown value
 
EDI=0x09b1c380 is an unknown value

 
 
 
 
Stack: [0x052b0000,0x05300000],  sp=0x052ff9c0,  free space=318k
 
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
 
C  0x80000000
 
C  [USER32.dll+0x162fa]  gapfnScSendMessage+0x332
 
C  [USER32.dll+0x16d3a]  GetThreadDesktop+0xd7
 
C  [USER32.dll+0x177c4]  CharPrevW+0x138
 
C  [USER32.dll+0x1788a]  DispatchMessageW+0xf
 
 
 
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
 
j  sun.awt.windows.WToolkit.eventLoop()V+0
 
j  sun.awt.windows.WToolkit.run()V+52
 
j  java.lang.Thread.run()V+11
 
v  ~StubRoutines::call_stub
 
 
 
---------------  P R O C E S S  ---------------
 
 
 
Java Threads: ( => current thread )
 
  0x04fbd000 JavaThread "Image Animator 0" daemon [_thread_blocked, id=6876, stack(0x05b90000,0x05be0000)]
 
  0x0bc59400 JavaThread "TickTimer" daemon [_thread_blocked, id=5080, stack(0x0d1a0000,0x0d1f0000)]
 
  0x04fbdc00 JavaThread "ITimer" daemon [_thread_blocked, id=4252, stack(0x0b590000,0x0b5e0000)]
 
  0x04e2c000 JavaThread "ScrollBar" daemon [_thread_blocked, id=6624, stack(0x0c750000,0x0c7a0000)]
 
  0x04e2b800 JavaThread "TextField" daemon [_thread_blocked, id=6576, stack(0x0c6c0000,0x0c710000)]
 
  0x04e2b400 JavaThread "ScrollBar" daemon [_thread_blocked, id=6448, stack(0x0c630000,0x0c680000)]
 
  0x04e2ac00 JavaThread "ScrollBar" daemon [_thread_blocked, id=6020, stack(0x0c5a0000,0x0c5f0000)]
 
  0x04e2a400 JavaThread "ScrollBar" daemon [_thread_blocked, id=6684, stack(0x0c510000,0x0c560000)]
 
  0x04e2a000 JavaThread "ScrollBar" daemon [_thread_blocked, id=2004, stack(0x0c480000,0x0c4d0000)]
 
  0x04e29800 JavaThread "ScrollBar" daemon [_thread_blocked, id=4284, stack(0x0c3f0000,0x0c440000)]
 
  0x04e29400 JavaThread "TickTimer" daemon [_thread_blocked, id=6496, stack(0x0c360000,0x0c3b0000)]
 
  0x04e18400 JavaThread "ScrollBar" daemon [_thread_blocked, id=1000, stack(0x0a030000,0x0a080000)]
 
  0x04e1cc00 JavaThread "BadgeStorage" daemon [_thread_blocked, id=6308, stack(0x09f10000,0x09f60000)]
 
  0x04e19c00 JavaThread "SocketConnection" daemon [_thread_blocked, id=6112, stack(0x05b00000,0x05b50000)]
 
  0x04fbd400 JavaThread "Applet-EventThread" daemon [_thread_blocked, id=3584, stack(0x0b500000,0x0b550000)]
 
  0x04fbc800 JavaThread "Direct Clip" daemon [_thread_blocked, id=7160, stack(0x0b2c0000,0x0b310000)]
 
  0x04fbc400 JavaThread "AsynchRasterManager.avatar" daemon [_thread_blocked, id=4216, stack(0x0b010000,0x0b060000)]
 
  0x04fbbc00 JavaThread "Thread-31" daemon [_thread_blocked, id=6920, stack(0x0aef0000,0x0af40000)]
 
  0x04fbb800 JavaThread "Thread-30" daemon [_thread_blocked, id=6424, stack(0x0ae60000,0x0aeb0000)]
 
  0x04fbb000 JavaThread "Thread-29" daemon [_thread_blocked, id=6788, stack(0x0add0000,0x0ae20000)]
 
  0x04e1e000 JavaThread "Java Sound Event Dispatcher" daemon [_thread_blocked, id=872, stack(0x0ad40000,0x0ad90000)]
 
  0x04e1d400 JavaThread "thread applet-com.pogo.game.client2.wordjong.WordjongApplet-5" [_thread_in_native, id=3752, stack(0x09fa0000,0x09ff0000)]
 
  0x04e1c800 JavaThread "thread applet-com.pogo.game.client2.shell.ShellApplet-4" [_thread_blocked, id=5972, stack(0x09e80000,0x09ed0000)]
 
  0x04e1a800 JavaThread "Applet 4 LiveConnect Worker Thread" [_thread_blocked, id=6652, stack(0x088e0000,0x08930000)]
 
  0x04e1c000 JavaThread "thread applet-com.pogo.game.client2.shell.ShellApplet-3" [_thread_blocked, id=5660, stack(0x085a0000,0x085f0000)]
 
  0x04e19400 JavaThread "AWT-EventQueue-4" [_thread_blocked, id=1288, stack(0x08730000,0x08780000)]
 
  0x04e19000 JavaThread "Applet 3 LiveConnect Worker Thread" [_thread_blocked, id=5356, stack(0x05340000,0x05390000)]
 
  0x04e16800 JavaThread "D3D Screen Updater" daemon [_thread_blocked, id=2808, stack(0x055f0000,0x05640000)]
 
  0x04e1b400 JavaThread "ConsoleWriterThread" daemon [_thread_blocked, id=6168, stack(0x08d40000,0x08d90000)]
 
  0x04e1b000 JavaThread "TimerQueue" daemon [_thread_blocked, id=836, stack(0x08cb0000,0x08d00000)]
 
  0x04e1a000 JavaThread "Windows Tray Icon Thread" [_thread_in_native, id=6936, stack(0x08850000,0x088a0000)]
 
  0x04e18800 JavaThread "AWT-EventQueue-1" [_thread_in_native, id=6000, stack(0x05c70000,0x05cc0000)]
 
  0x04e17c00 JavaThread "Browser Side Object Cleanup Thread" [_thread_blocked, id=6160, stack(0x05a20000,0x05a70000)]
 
  0x04e17400 JavaThread "CacheCleanUpThread" daemon [_thread_blocked, id=6044, stack(0x05710000,0x05760000)]
 
  0x04e17000 JavaThread "CacheMemoryCleanUpThread" daemon [_thread_blocked, id=2884, stack(0x05680000,0x056d0000)]
 
  0x01eba800 JavaThread "SysExecutionTheadCreator" daemon [_thread_blocked, id=1448, stack(0x04d30000,0x04d80000)]
 
  0x04e10000 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=6732, stack(0x05560000,0x055b0000)]
 
  0x04e0f800 JavaThread "Java Plug-In Heartbeat Thread" [_thread_blocked, id=7092, stack(0x054d0000,0x05520000)]
 
=>0x04e0c800 JavaThread "AWT-Windows" daemon [_thread_in_native, id=2764, stack(0x052b0000,0x05300000)]
 
  0x04e0c000 JavaThread "AWT-Shutdown" [_thread_blocked, id=6460, stack(0x05220000,0x05270000)]
 
  0x04e0b800 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=6696, stack(0x05160000,0x051b0000)]
 
  0x01ebf400 JavaThread "Java Plug-In Pipe Worker Thread (Client-Side)" daemon [_thread_in_native, id=5968, stack(0x05010000,0x05060000)]
 
  0x01e98800 JavaThread "Timer-0" [_thread_blocked, id=6772, stack(0x04ca0000,0x04cf0000)]
 
  0x01e8d400 JavaThread "traceMsgQueueThread" daemon [_thread_blocked, id=3788, stack(0x04a00000,0x04a50000)]
 
  0x01e56000 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=1108, stack(0x048e0000,0x04930000)]
 
  0x01e46800 JavaThread "C1 CompilerThread0" daemon [_thread_blocked, id=2284, stack(0x04850000,0x048a0000)]
 
  0x01e45800 JavaThread "Attach Listener" daemon [_thread_blocked, id=4484, stack(0x047c0000,0x04810000)]
 
  0x01e42800 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=6392, stack(0x04730000,0x04780000)]
 
  0x01e3f800 JavaThread "Finalizer" daemon [_thread_blocked, id=6856, stack(0x046a0000,0x046f0000)]
 
  0x01e3ac00 JavaThread "Reference Handler" daemon [_thread_blocked, id=6268, stack(0x04610000,0x04660000)]
 
  0x0027a800 JavaThread "main" [_thread_blocked, id=2640, stack(0x00310000,0x00360000)]
 
 
 
Other Threads:
 
  0x01dfe000 VMThread [stack: 0x01f50000,0x01fa0000] [id=3432]
 
  0x01e5f000 WatcherThread [stack: 0x04970000,0x049c0000] [id=6540]
 
 
 
VM state:not at safepoint (normal execution)
 
 
 
VM Mutex/Monitor currently owned by a thread: None
 
 
 
Heap
 
def new generation   total 8704K, used 3812K [0x2c5e0000, 0x2cf50000, 0x2f080000)
 
  eden space 7744K,  41% used [0x2c5e0000, 0x2c9084a8, 0x2cd70000)
 
  from space 960K,  60% used [0x2ce60000, 0x2cef0e60, 0x2cf50000)
 
  to   space 960K,   0% used [0x2cd70000, 0x2cd70000, 0x2ce60000)
 
tenured generation   total 19180K, used 16929K [0x2f080000, 0x3033b000, 0x345e0000)
 
   the space 19180K,  88% used [0x2f080000, 0x30108748, 0x30108800, 0x3033b000)
 
compacting perm gen  total 12288K, used 5384K [0x345e0000, 0x351e0000, 0x385e0000)
 
   the space 12288K,  43% used [0x345e0000, 0x34b22058, 0x34b22200, 0x351e0000)
 
    ro space 10240K,  51% used [0x385e0000, 0x38b0dff8, 0x38b0e000, 0x38fe0000)
 
    rw space 12288K,  55% used [0x38fe0000, 0x3967c208, 0x3967c400, 0x39be0000)
 
 
 
Code Cache  [0x025d0000, 0x028e0000, 0x045d0000)
 
total_blobs=1865 nmethods=1611 adapters=188 free_code_cache=30364224 largest_free_block=192
 
 
 
Dynamic libraries:
 
0x00400000 - 0x00424000     C:\Program Files (x86)\Java\jre6\bin\java.exe
 
0x77550000 - 0x776d0000     C:\Windows\SysWOW64\ntdll.dll
 
0x76440000 - 0x76550000     C:\Windows\syswow64\kernel32.dll
 
0x762e0000 - 0x76326000     C:\Windows\syswow64\KERNELBASE.dll
 
0x76860000 - 0x76900000     C:\Windows\syswow64\ADVAPI32.dll
 
0x769c0000 - 0x76a6c000     C:\Windows\syswow64\msvcrt.dll
 
0x76350000 - 0x76369000     C:\Windows\SysWOW64\sechost.dll
 
0x75220000 - 0x75310000     C:\Windows\syswow64\RPCRT4.dll
 
0x74c40000 - 0x74ca0000     C:\Windows\syswow64\SspiCli.dll
 
0x74c30000 - 0x74c3c000     C:\Windows\syswow64\CRYPTBASE.dll
 
0x72510000 - 0x7255c000     C:\Windows\system32\apphelp.dll
 
0x72430000 - 0x724bd000     C:\Windows\AppPatch\AcLayers.DLL
 
0x74ca0000 - 0x74da0000     C:\Windows\syswow64\USER32.dll
 
0x75390000 - 0x75420000     C:\Windows\syswow64\GDI32.dll
 
0x77520000 - 0x7752a000     C:\Windows\syswow64\LPK.dll
 
0x76550000 - 0x765ed000     C:\Windows\syswow64\USP10.dll
 
0x75600000 - 0x7624a000     C:\Windows\syswow64\SHELL32.dll
 
0x74da0000 - 0x74df7000     C:\Windows\syswow64\SHLWAPI.dll
 
0x76a70000 - 0x76bcc000     C:\Windows\syswow64\ole32.dll
 
0x76c00000 - 0x76c8f000     C:\Windows\syswow64\OLEAUT32.dll
 
0x72960000 - 0x72977000     C:\Windows\system32\USERENV.dll
 
0x72c60000 - 0x72c6b000     C:\Windows\system32\profapi.dll
 
0x72150000 - 0x721a1000     C:\Windows\system32\WINSPOOL.DRV
 
0x72410000 - 0x72422000     C:\Windows\system32\MPR.dll
 
0x75540000 - 0x755a0000     C:\Windows\system32\IMM32.DLL
 
0x76370000 - 0x7643c000     C:\Windows\syswow64\MSCTF.dll
 
0x7c340000 - 0x7c396000     C:\Program Files (x86)\Java\jre6\bin\msvcr71.dll
 
0x6d7f0000 - 0x6da9f000     C:\Program Files (x86)\Java\jre6\bin\client\jvm.dll
 
0x71640000 - 0x71672000     C:\Windows\system32\WINMM.dll
 
0x6d7a0000 - 0x6d7ac000     C:\Program Files (x86)\Java\jre6\bin\verify.dll
 
0x6d320000 - 0x6d33f000     C:\Program Files (x86)\Java\jre6\bin\java.dll
 
0x76340000 - 0x76345000     C:\Windows\system32\PSAPI.DLL
 
0x6d7e0000 - 0x6d7ef000     C:\Program Files (x86)\Java\jre6\bin\zip.dll
 
0x6d420000 - 0x6d426000     C:\Program Files (x86)\Java\jre6\bin\jp2native.dll
 
0x6d1d0000 - 0x6d1e3000     C:\Program Files (x86)\Java\jre6\bin\deploy.dll
 
0x76620000 - 0x7673d000     C:\Windows\syswow64\CRYPT32.dll
 
0x76900000 - 0x7690c000     C:\Windows\syswow64\MSASN1.dll
 
0x76740000 - 0x7685a000     C:\Windows\syswow64\WININET.dll
 
0x75530000 - 0x75533000     C:\Windows\syswow64\Normaliz.dll
 
0x75060000 - 0x75216000     C:\Windows\syswow64\iertutil.dll
 
0x75420000 - 0x75530000     C:\Windows\syswow64\urlmon.dll
 
0x6d6a0000 - 0x6d6e6000     C:\Program Files (x86)\Java\jre6\bin\regutils.dll
 
0x72980000 - 0x72989000     C:\Windows\system32\VERSION.dll
 
0x6d600000 - 0x6d613000     C:\Program Files (x86)\Java\jre6\bin\net.dll
 
0x74e80000 - 0x74eb5000     C:\Windows\syswow64\WS2_32.dll
 
0x76330000 - 0x76336000     C:\Windows\syswow64\NSI.dll
 
0x6f880000 - 0x6f8bc000     C:\Windows\system32\mswsock.dll
 
0x6f860000 - 0x6f866000     C:\Windows\System32\wship6.dll
 
0x6d620000 - 0x6d629000     C:\Program Files (x86)\Java\jre6\bin\nio.dll
 
0x6d000000 - 0x6d14b000     C:\Program Files (x86)\Java\jre6\bin\awt.dll
 
0x71490000 - 0x7162e000     C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll
 
0x72620000 - 0x726a4000     C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
 
0x71a80000 - 0x71a93000     C:\Windows\system32\DWMAPI.DLL
 
0x10000000 - 0x10008000     c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll
 
0x72610000 - 0x72618000     C:\Windows\system32\Secur32.dll
 
0x72c80000 - 0x72cc4000     C:\Windows\system32\dnsapi.DLL
 
0x72ce0000 - 0x72cfc000     C:\Windows\system32\iphlpapi.DLL
 
0x72cd0000 - 0x72cd7000     C:\Windows\system32\WINNSI.DLL
 
0x729e0000 - 0x729f6000     C:\Windows\system32\CRYPTSP.dll
 
0x729a0000 - 0x729db000     C:\Windows\system32\rsaenh.dll
 
0x67a50000 - 0x67a60000     C:\Windows\system32\NLAapi.dll
 
0x66580000 - 0x66590000     C:\Windows\system32\napinsp.dll
 
0x6d230000 - 0x6d27f000     C:\Program Files (x86)\Java\jre6\bin\fontmanager.dll
 
0x66560000 - 0x66572000     C:\Windows\system32\pnrpnsp.dll
 
0x6f830000 - 0x6f857000     C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
 
0x66550000 - 0x66558000     C:\Windows\System32\winrnr.dll
 
0x6f870000 - 0x6f875000     C:\Windows\System32\wshtcpip.dll
 
0x6f820000 - 0x6f826000     C:\Windows\system32\rasadhlp.dll
 
0x6f7e0000 - 0x6f818000     C:\Windows\System32\fwpuclnt.dll
 
0x6b9a0000 - 0x6bb63000     C:\Windows\system32\d3d9.dll
 
0x6b990000 - 0x6b996000     C:\Windows\system32\d3d8thk.dll
 
0x6b900000 - 0x6b981000     C:\Windows\system32\aticfx32.dll
 
0x6b8f0000 - 0x6b8f9000     C:\Windows\system32\atiu9pag.dll
 
0x6b540000 - 0x6b8e9000     C:\Windows\system32\atiumdag.dll
 
0x6b240000 - 0x6b539000     C:\Windows\system32\atiumdva.dll
 
0x6d790000 - 0x6d79f000     C:\Program Files (x86)\Java\jre6\bin\unpack.dll
 
0x6d510000 - 0x6d535000     C:\Program Files (x86)\Java\jre6\bin\jsound.dll
 
0x6d540000 - 0x6d548000     C:\Program Files (x86)\Java\jre6\bin\jsoundds.dll
 
0x670e0000 - 0x67152000     C:\Windows\system32\DSOUND.dll
 
0x670b0000 - 0x670d5000     C:\Windows\system32\POWRPROF.dll
 
0x74ec0000 - 0x7505d000     C:\Windows\syswow64\SETUPAPI.dll
 
0x76bd0000 - 0x76bf7000     C:\Windows\syswow64\CFGMGR32.dll
 
0x769a0000 - 0x769b2000     C:\Windows\syswow64\DEVOBJ.dll
 
0x66ea0000 - 0x66ed9000     C:\Windows\system32\MMDevAPI.DLL
 
0x71370000 - 0x71465000     


( This report has more than 16,000 characters and has been truncated. )
Seems like the root cause of problems is WM_DESTROY sent during cascade window destruction.

At the moment this case is not handled by AWT properly. The reason is that WM_DESTROY is sent via Toolkit thread,
but Java code works in EDT in parallel. So we have the situation during WM_DESTROY handling when Java code still use some native resources created in Toolkit thread. It means that we must wait until Java code frees the resources to be able free/destroy them otherwise we get invalid links to these resources and in some cases - crash. 

Moreover WM_DESTROY handler is called twice: by the System and from the AwtComponent's destructor after (DestroyHWnd method) trying to release the resources that was released before.
I wrote the test (attached) that creates and destroys two applets by turns. That caused WM_DESTROY sent each time.
Applets had also a long cycling in 'paint' method. In most cases that caused the crash.

                                    

Comments
It's impossible to write any test due to race condition case, needed for crash reproduction.
                                     
2013-09-06
SUGGESTED FIX

http://hg.openjdk.java.net/jdk8/awt/jdk/rev/cfe25bac6951
                                     
2011-09-27
EVALUATION

It seems we try to use a released global reference. In WindowProc we release the reference to peer.

     awt.dll!AwtToolkit::WndProc(HWND__ * hWnd, unsigned int message, unsigned int wParam, long lParam)  Line 776 + 0x32 bytes    C++

After that we delete our native object. This leads to destruction of objects.

     awt.dll!AwtComponent::~AwtComponent()  Line 272    C++
     awt.dll!AwtCanvas::~AwtCanvas()  Line 51 + 0x8 bytes    C++
     awt.dll!AwtWindow::~AwtWindow()  Line 235 + 0xf bytes    C++
     awt.dll!AwtFrame::~AwtFrame()  Line 125 + 0x8 bytes    C++
     awt.dll!AwtFrame::`scalar deleting destructor'()  + 0xf bytes    C++

In the destructor of AWTComponent we invoke AWTComponent::UnlinkObjects() method.

>    awt.dll!AwtComponent::UnlinkObjects()  Line 5270    C++

The methods tries to set fields on peer but the reference is not valid anymore and could be spoiled.

This is why the particular issue is not reproducible on powerful hosts and could be solved by increasing java memory (I saw it as a solution on pogo forum).

I removed the first DeleteGlobalRef from WndProc and could not reproduce the crash again. So I see it as a solution.
                                     
2011-08-19
EVALUATION

I reproduced the crash that has been reported by pogo with jdk7 build 148.

  ntdll.dll!_KiFastSystemCallRet@0()     
     ntdll.dll!_NtRaiseHardError@24()  + 0xc bytes    
     user32.dll!_ServiceMessageBox@16()  + 0x145 bytes    
     user32.dll!_MessageBoxWorker@4()  + 0xef5d bytes    
     user32.dll!_MessageBoxTimeoutW@24()  + 0x7a bytes    
     user32.dll!_MessageBoxTimeoutA@24()  + 0x9c bytes    
     user32.dll!_MessageBoxExA@20()  + 0x1b bytes    
     user32.dll!_MessageBoxA@16()  + 0x45 bytes    
     jvm.dll!os::message_box(const char * title, const char * message)  Line 3374    C++
     jvm.dll!VMError::show_message_box(char * buf, int buflen)  Line 47 + 0xb bytes    C++
     jvm.dll!VMError::report_and_die()  Line 810    C++
     jvm.dll!report_vm_error(const char * file, int line, const char * error_msg, const char * detail_msg)  Line 216 + 0x8 bytes    C++
     jvm.dll!JNIHandles::resolve_non_null(_jobject * handle)  Line 206 + 0x21 bytes    C++
     jvm.dll!jni_SetLongField(JNIEnv_ * env, _jobject * obj, _jfieldID * fieldID, __int64 value)  Line 1867 + 0x1d5 bytes    C++
     awt.dll!JNIEnv_::SetLongField(_jobject * obj, _jfieldID * fieldID, __int64 val)  Line 1336    C++
>    awt.dll!AwtComponent::UnlinkObjects()  Line 5270    C++
     awt.dll!AwtComponent::~AwtComponent()  Line 272    C++
     awt.dll!AwtCanvas::~AwtCanvas()  Line 51 + 0x8 bytes    C++
     awt.dll!AwtWindow::~AwtWindow()  Line 235 + 0xf bytes    C++
     awt.dll!AwtFrame::~AwtFrame()  Line 125 + 0x8 bytes    C++
     awt.dll!AwtFrame::`scalar deleting destructor'()  + 0xf bytes    C++
     awt.dll!AwtToolkit::WndProc(HWND__ * hWnd, unsigned int message, unsigned int wParam, long lParam)  Line 776 + 0x32 bytes    C++
     user32.dll!_InternalCallWinProc@20()  + 0x28 bytes    
     user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes    
     user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes    
     user32.dll!_DispatchMessageW@4()  + 0xf bytes    
     awt.dll!AwtToolkit::PumpWaitingMessages(int (tagMSG &)* lpPeekMessageFunc)  Line 1360    C++
     awt.dll!AwtToolkit::MessageLoop(void (void)* lpIdleFunc, int (tagMSG &)* lpPeekMessageFunc)  Line 1251    C++
     awt.dll!Java_sun_awt_windows_WToolkit_eventLoop(JNIEnv_ * env, _jobject * self)  Line 2205    C++
     00b5d093()    
     jvm.dll!JavaCalls::call_helper(JavaValue * result, methodHandle * m, JavaCallArguments * args, Thread * __the_thread__)  Line 412 + 0x3e bytes    C++
     jvm.dll!os::os_exception_wrapper(void (JavaValue *, methodHandle *, JavaCallArguments *, Thread *)* f, JavaValue * value, methodHandle * method, JavaCallArguments * args, Thread * thread)  Line 119 + 0x10 bytes    C++
     jvm.dll!JavaCalls::call_virtual(JavaValue * result, KlassHandle spec_klass, Symbol * name, Symbol * signature, JavaCallArguments * args, Thread * __the_thread__)  Line 214 + 0x44 bytes    C++
     jvm.dll!JavaCalls::call_virtual(JavaValue * result, Handle receiver, KlassHandle spec_klass, Symbol * name, Symbol * signature, Thread * __the_thread__)  Line 221    C++
     jvm.dll!thread_entry(JavaThread * thread, Thread * __the_thread__)  Line 2633 + 0xa0 bytes    C++
     jvm.dll!JavaThread::thread_main_inner()  Line 1504 + 0xa bytes    C++
     jvm.dll!java_start(Thread * thread)  Line 422    C++
     msvcr100.dll!_callthreadstartex()  Line 314 + 0x6 bytes    C
     msvcr100.dll!_threadstartex(void * ptd)  Line 292 + 0x5 bytes    C
     kernel32.dll!_BaseThreadStart@8()  + 0x37 bytes
                                     
2011-08-17
EVALUATION

Note that CR 7024749 has the same adres on the stack so it could be the same issue.
                                     
2011-08-16
EVALUATION

At the same time I have found crash reports

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x006e0065, pid=5416, tid=5812
#
# JRE version: 6.0_26-b03
# Java VM: Java HotSpot(TM) Client VM (20.1-b02 mixed mode, sharing windows-x86 )
# Problematic frame:
# C  0x006e0065
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

---------------  T H R E A D  ---------------

Current thread (0x0317dc00):  JavaThread "AWT-Windows" daemon [_thread_in_native, id=5812, stack(0x034d0000,0x03520000)]

siginfo: ExceptionCode=0xc0000005, reading address 0x006e0065

Registers:
EAX=0x065b7c38, EBX=0x00000001, ECX=0x07340bd0, EDX=0x00000004
ESP=0x0351f800, EBP=0x0351f82c, ESI=0x0317dd28, EDI=0x07340bd0
EIP=0x006e0065, EFLAGS=0x00010293

Top of Stack: (sp=0x0351f800)
0x0351f800:   6d09cb90 0351f894 6d09c650 00000000
0x0351f810:   00000000 00000001 0317dd28 0351f804
0x0351f820:   0351f8b0 6d0c04a8 00000001 0351f858
0x0351f830:   7e418734 000705d0 0000981a 07340bd0
0x0351f840:   00000000 6d09c650 dcbaabcd 00000000
0x0351f850:   0351f894 6d09c650 0351f8c0 7e418816
0x0351f860:   6d09c650 000705d0 0000981a 07340bd0
0x0351f870:   00000000 0351f954 0351f94c 00600298 

Instructions: (pc=0x006e0065)
0x006e0045:   
[error occurred during error reporting (printing registers, top of stack, instructions near pc), id 0xc0000005]

Register to memory mapping:

EAX=0x065b7c38 is an unknown value
EBX=0x00000001 is an unknown value
ECX=0x07340bd0 is an unknown value
EDX=0x00000004 is an unknown value
ESP=0x0351f800 is pointing into the stack for thread: 0x0317dc00
EBP=0x0351f82c is pointing into the stack for thread: 0x0317dc00
ESI=0x0317dd28 is an unknown value
EDI=0x07340bd0 is an unknown value


Stack: [0x034d0000,0x03520000],  sp=0x0351f800,  free space=318k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  0x006e0065
C  [USER32.dll+0x8734]  GetDC+0x6d
C  [USER32.dll+0x8816]  GetDC+0x14f
C  [USER32.dll+0x89cd]  GetWindowLongW+0x127
C  [USER32.dll+0x8a10]  DispatchMessageW+0xf
                                     
2011-08-16
EVALUATION

Stack trace:

     ntdll.dll!_KiFastSystemCallRet@0()    
     ntdll.dll!_NtRaiseHardError@24()  + 0xc bytes   
     user32.dll!_ServiceMessageBox@16()  + 0x145 bytes   
     user32.dll!_MessageBoxWorker@4()  + 0xef5d bytes   
     user32.dll!_MessageBoxTimeoutW@24()  + 0x7a bytes   
     user32.dll!_MessageBoxTimeoutA@24()  + 0x9c bytes   
     user32.dll!_MessageBoxExA@20()  + 0x1b bytes   
     user32.dll!_MessageBoxA@16()  + 0x45 bytes   
     jvm.dll!6d92db08()    
     [Frames below may be incorrect and/or missing, no symbols loaded for jvm.dll]   
     jvm.dll!6d932c6a()    
     jvm.dll!6d923405()    
     jvm.dll!6d92d441()    
     jvm.dll!6d930c08()    
     jvm.dll!6d97c53f()    
     msvcr71.dll!_except_handler3()  + 0x61 bytes    Asm
     ntdll.dll!ExecuteHandler2@20()  + 0x26 bytes   
     ntdll.dll!ExecuteHandler@20()  + 0x24 bytes   
     ntdll.dll!_KiUserExceptionDispatcher@8()  + 0xe bytes   
     006e0065()   
     awt.dll!6d09cb90()    
     user32.dll!_InternalCallWinProc@20()  + 0x28 bytes   
     user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes   
     user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes   
     user32.dll!_DispatchMessageW@4()  + 0xf bytes   
     awt.dll!6d09a05d()    
     awt.dll!6d09bdac()    
     awt.dll!6d09d08e()    
     jvm.dll!6d8eae4b()    
     jvm.dll!6d97c531()    
     jvm.dll!6d8eaff1()    
     jvm.dll!6d8eb04b()    
>    msvcr71.dll!_heap_alloc(unsigned int size)  Line 212    C
     ffffff90()
                                     
2011-08-16
EVALUATION

I reproduced the problem with the described scenario.

(jdk6u26 IE8 Windows XP)

OUTPUT FROM PLUGIN:

top = 451, bottom = 854)
IExplorerPlugin.SetObjectRects(cAxControl = 0xb0d5d18, left = 2, right = 762, t
p = 451, bottom = 474)
  Attempting to start applet
Seeking suitable JRE version IDs: null
1 active JVM(s)
Considering 1.6.0.26 JVM for reuse
  (chosen)
Considering 1.6.0.26 JVM for launch
  (chosen)
Considering 1.6.0.26 JVM for launch
  (rejected)
Reusing JVM instance with product version 1.6.0.26; best available product vers
on 1.6.0.26
JVMManager reusing JVMInstance for product version 1.6.0.26
JVMInstance for 1.6.0.26 sending start applet message
  isRelaunch: false
  Parameters:
    height=23
    applet-version=12.0.9.14
    java_arguments=-Xmx128m
    width=760
    name=dash
    cache_option=Plugin
    code=com.pogo.game.client2.shell.ShellApplet
    cache_archive=monopoly-en_US.jar
    cache_version=12.0.9.14
    codebase=/v/12.0.9.14/applet/monopoly/
JVMInstance.registerApplet for applet ID 19, plugin sun.plugin2.main.server.IEx
lorerPlugin@19b5393
JVMManager: applet launch (ID [AppletID 19]) succeeded
  Received applet ID [AppletID 19]
  Attempting to start applet
Seeking suitable JRE version IDs: null
1 active JVM(s)
Considering 1.6.0.26 JVM for reuse
  (chosen)
Considering 1.6.0.26 JVM for launch
  (chosen)
Considering 1.6.0.26 JVM for launch
  (rejected)
Reusing JVM instance with product version 1.6.0.26; best available product vers
on 1.6.0.26
JVMManager reusing JVMInstance for product version 1.6.0.26
JVMInstance for 1.6.0.26 sending start applet message
  isRelaunch: false
  Parameters:
    height=403
    applet-version=12.0.9.14
    java_arguments=-Xmx128m
    width=584
    name=game
    cache_option=Plugin
    code=com.pogo.game.client2.shell.ShellApplet
    cache_archive=monopoly-en_US.jar
    cache_version=12.0.9.14
    codebase=/v/12.0.9.14/applet/monopoly/
JVMInstance.registerApplet for applet ID 20, plugin sun.plugin2.main.server.IEx
lorerPlugin@8bdcd2
JVMManager: applet launch (ID [AppletID 20]) succeeded
  Received applet ID [AppletID 20]
  Attempting to start applet
Seeking suitable JRE version IDs: null
1 active JVM(s)
Considering 1.6.0.26 JVM for reuse
  (chosen)
Considering 1.6.0.26 JVM for launch
  (chosen)
Considering 1.6.0.26 JVM for launch
  (rejected)
Reusing JVM instance with product version 1.6.0.26; best available product vers
on 1.6.0.26
JVMManager reusing JVMInstance for product version 1.6.0.26
JVMInstance for 1.6.0.26 sending start applet message
  isRelaunch: false
  Parameters:
    height=23
    applet-version=12.0.9.14
    java_arguments=-Xmx128m
    width=760
    name=controls
    cache_option=Plugin
    code=com.pogo.game.client2.shell.ShellApplet
    cache_archive=monopoly-en_US.jar
    cache_version=12.0.9.14
    codebase=/v/12.0.9.14/applet/monopoly/
JVMInstance.registerApplet for applet ID 21, plugin sun.plugin2.main.server.IEx
lorerPlugin@4e79f1
JVMManager: applet launch (ID [AppletID 21]) succeeded
  Received applet ID [AppletID 21]
  Attempting to start applet
Seeking suitable JRE version IDs: null
1 active JVM(s)
Considering 1.6.0.26 JVM for reuse
  (chosen)
Considering 1.6.0.26 JVM for launch
  (chosen)
Considering 1.6.0.26 JVM for launch
  (rejected)
Reusing JVM instance with product version 1.6.0.26; best available product vers
on 1.6.0.26
JVMManager reusing JVMInstance for product version 1.6.0.26
JVMInstance for 1.6.0.26 sending start applet message
  isRelaunch: false
  Parameters:
    height=403
    applet-version=12.0.9.14
    java_arguments=-Xmx128m
    width=176
    name=chat
    cache_option=Plugin
    code=com.pogo.game.client2.shell.ShellApplet
    cache_archive=monopoly-en_US.jar
    cache_version=12.0.9.14
    codebase=/v/12.0.9.14/applet/monopoly/
    ugifts=0
JVMInstance.registerApplet for applet ID 22, plugin sun.plugin2.main.server.IEx
lorerPlugin@27e353
JVMManager: applet launch (ID [AppletID 22]) succeeded
  Received applet ID [AppletID 22]
  Attempting to start applet
Seeking suitable JRE version IDs: null
1 active JVM(s)
Considering 1.6.0.26 JVM for reuse
  (chosen)
Considering 1.6.0.26 JVM for launch
  (chosen)
Considering 1.6.0.26 JVM for launch
  (rejected)
Reusing JVM instance with product version 1.6.0.26; best available product vers
on 1.6.0.26
JVMManager reusing JVMInstance for product version 1.6.0.26
JVMInstance for 1.6.0.26 sending start applet message
  isRelaunch: false
  Parameters:
    clientabtestgroup=
    errorprefix=http://uk.pogo.com/error/
    launchparams=&site=pogop-uk&game=monopoly&lkey=0ylZ0gAAAAAKbjbsCnggWAAAK8s.
    java_arguments=-Xmx128m
    intermissiongamebannerurl=/exhibit/game/liveness.jsp?site=pogop-uk&game=mon
poly&lkey=0ylZ0gAAAAAKbjbsCnggWAAAK8s.
    unid=6624591917356558
    height=403
    hascontrolshell=true
    config=/util/client-props.jsp?file=gf2%2Ftable%2Fmonopoly%2Fdef.properties
    ruleid=pogo
    kw=am41
    launchpage=/room/util/urlopen.jsp
    rkey=monopoly-plmonopolysf51087
    width=760
    intermissiongameframe=gameShell
    cache_archive=monopoly-en_US.jar
    code=com.pogo.game.client2.monopoly.MonopolyApplet
    ahst=game3.pogo.com
    intermissionintermissionurl=/exhibit/intermission.jsp?game=monopoly&vers=12
0.9.34&site=pogop-uk&background=-13408564&vmtype=sun&foreground=-1&install=true
    issingleapplet=false
    cache_version=12.0.9.14
    port=0
    errorclosepage=http://game3.pogo.com/room/util/silentclosepage.html
    gametitlename=MONOPOLY The World Edition
    locale=en_US_pogop-uk
    maxtables=120
    hasdashshell=true
    rspt=16684
    browserinfo=Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
.NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4
0E)
    errorframe=Main
    rhst=uk.pogo.com
    intermissiongameurl=/room/game/gameshell.jsp?tabl=2&site=pogop-uk&scrn=getj
va10&rkey=monopoly-plmonopolysf51087&anam=Temporary+Members+Room+50085&install=
rue&port=0&ahst=game3.pogo.com&rspt=16684&ugifts=0&vmtype=sun&lcod=4&rhst=uk.po
o.com&vmver=1.6.0_26&game=monopoly
    applet-version=12.0.9.14
    maxseats=4
    loadingmsg=Please wait, loading...
    name=game
    intermissionbannerframe=aad
    hasratings=false
    intermissionintermissionbannerurl=/exhibit/game/liveness.jsp?site=pogop-uk&
ame=monopoly&lkey=0ylZ0gAAAAAKbjbsCnggWAAAK8s.&pause=1
    site=pogop-uk
    errorsuffix=.jsp?site=pogop-uk&game=monopoly&lkey=0ylZ0gAAAAAKbjbsCnggWAAAK
s.&rkey=monopoly-plmonopolysf51087&install=true&vmtype=sun&vmver=1.6.0_26&autoa
id=
    lkey=0ylZ0gAAAAAKbjbsCnggWAAAK8s.
    cache_option=Plugin
    game=monopoly
    launchframe=Launch
    useliveconnect=true
    browserversion=8 0 0 Microsoft
    tabl=2
    scrn=getjava10
    cnid=505173
    anam=Temporary Members Room 50085
    codebase=/v/12.0.9.14/applet/monopoly/
JVMInstance.registerApplet for applet ID 23, plugin sun.plugin2.main.server.IEx
lorerPlugin@bd928a
JVMManager: applet launch (ID [AppletID 23]) succeeded
  Received applet ID [AppletID 23]
JVMInstance (1.6.0.26) processing StartAppletAckMessage with:
        appletID: 20JVMInstance (1.6.0.26) processing StartAppletAckMessage wit
:
        appletID: 23JVMInstance (1.6.0.26) processing StartAppletAckMessage wit
:
        appletID: 21JVMInstance (1.6.0.26) processing StartAppletAckMessage wit
:
        appletID: 19JVMInstance (1.6.0.26) processing StartAppletAckMessage wit
:
        appletID: 22JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing JavaScriptGetWindowMessage
  LiveConnectSupport: retained [BrowserSideObject 0x6709e14] for applet 23
JVMInstance (1.6.0.26) processing JavaScriptMemberOpMessage
  LiveConnectSupport: retained [BrowserSideObject 0x407f548] for applet 23
JVMInstance (1.6.0.26) processing JavaScriptCallMessage
LiveConnectSupport.PerPluginInfo.javaScriptCall:
  methodName: showPageBannerAd
  args: null
JVMInstance (1.6.0.26) processing ShowDocumentMessage
JVMInstance (1.6.0.26) processing JavaScriptGetWindowMessage
JVMInstance (1.6.0.26) processing JavaScriptEvalMessage
IExplorerPlugin.SetObjectRects(cAxControl = 0xa762c80, left = 2, right = 762, t
p = 2, bottom = 25)
IExplorerPlugin.SetObjectRects(cAxControl = 0xb0c8428, left = 2, right = 586, t
p = 25, bottom = 428)
IExplorerPlugin.SetObjectRects(cAxControl = 0xb098c20, left = 586, right = 762,
top = 25, bottom = 428)
IExplorerPlugin.SetObjectRects(cAxControl = 0xb0d5d18, left = 2, right = 762, t
p = 428, bottom = 451)
IExplorerPlugin.SetObjectRects(cAxControl = 0xb0c8428, left = 2, right = 586, t
p = 25, bottom = 428)
JVMInstance sending request for applet ID 20 with result ID 5
AbstractPlugin.getScriptingObjectForApplet starting to wait for result ID 5
JVMInstance (1.6.0.26) processing JavaReplyMessage
JVMInstance received JavaReplyMessage with result ID 5
AbstractPlugin.getScriptingObjectForApplet ending wait for result ID 5
LiveConnectSupport: result [ResultID 5] = [RemoteJavaObject jvmID=1 appletID=20
objectID=3 isApplet=true]
AbstractPlugin.getScriptingObjectForApplet([AppletID 20]) returning 0xb08123c
LiveConnectSupport.sendRemoteJavaObjectOp: HAS_FIELD_OR_METHOD "unselectable"
AbstractPlugin.doJavaObjectOp starting to wait for result ID 6
JVMInstance (1.6.0.26) processing JavaReplyMessage
JVMInstance received JavaReplyMessage with result ID 6
AbstractPlugin.doJavaObjectOp ending wait for result ID 6
LiveConnectSupport: result [ResultID 6] = false
IExplorerPlugin.OnSetFocus(cAxControl = 0xb0c8428)
IExplorerPlugin.InPlaceActivate(cAxControl = 0xb0c8428) entered
IExplorerPlugin.InPlaceActivate(cAxControl = 0xb0c8428) exited
IExplorerPlugin.OnFrameWindowActivate(cAxControl = 0xb0c8428, true)
IExplorerPlugin.OnFrameWindowActivate(cAxControl = 0xb0c8428, false)
IExplorerPlugin.OnFrameWindowActivate(cAxControl = 0xb0c8428, true)
IExplorerPlugin.OnSetFocus(cAxControl = 0xb0c8428)
IExplorerPlugin.OnFrameWindowActivate(cAxControl = 0xb0c8428, true)
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
JVMInstance (1.6.0.26) processing GetProxyMessage
JVMInstance (1.6.0.26) processing CookieOpMessage
IExplorerPlugin.OnFrameWindowActivate(cAxControl = 0x22b4c58, true)
IExplorerPlugin.InPlaceDeactivate(cAxControl = 0xa762e48)
  Stopping applet ID [AppletID 23]
JVMInstance for 1.6.0.26 sending stop applet message for applet ID 23
JVMInstance (1.6.0.26) processing StopAppletAckMessage for applet ID 23
JVMInstance.unregisterApplet for applet ID 23
  LiveConnectSupport.shutdown(23)
  LiveConnectSupport: released [BrowserSideObject 0x407f548] for applet 23
  LiveConnectSupport: released [BrowserSideObject 0x6709e14] for applet 23
IExplorerPlugin.OnDestroy(cAxControl = 0xa762e48)
IExplorerPlugin.InPlaceDeactivate(cAxControl = 0xa762c80)
  Stopping applet ID [AppletID 19]
JVMInstance for 1.6.0.26 sending stop applet message for applet ID 19
JVMInstance (1.6.0.26) processing JavaScriptGetWindowMessage
JVMInstance (1.6.0.26) processing JavaScriptMemberOpMessage
JVMInstance (1.6.0.26) processing ShowDocumentMessage
JVMInstance (1.6.0.26) processing StopAppletAckMessage for applet ID 19
JVMInstance.unregisterApplet for applet ID 19
  LiveConnectSupport.shutdown(19)
IExplorerPlugin.OnDestroy(cAxControl = 0xa762c80)
                                     
2011-08-16
EVALUATION

When  I executed Pogo monopoly with debug jdk 6u26 build 03, I got the next crash. I cannot continue to work with the application after the crash.

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (c:\build_area\jdk6_26\hotspot\src\share\vm\runtime/thread.hpp:627), pid=6092, tid=4436
#  assert(thread != NULL) failed: just checking
#
# JRE version: (uninitialized)
# Java VM: Java HotSpot(TM) Client VM (20.1-b02-fastdebug mixed mode, sharing windows-x86 )
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
#

---------------  T H R E A D  ---------------

Current thread is native thread

Stack: [0x00040000,0x00090000],  sp=0x0008f224,  free space=316k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [jvm.dll+0x208152]
V  [jvm.dll+0x200b25]
V  [jvm.dll+0x1b3512]
V  [jvm.dll+0x1b3ff2]
C  [awt.dll+0x84932]  Java_sun_awt_DebugHelperImpl_setCTracingOn__ZLjava_lang_String_2I+0xe2
C  [awt.dll+0x83807]  Java_java_awt_image_DataBufferInt_initIDs+0x147
C  [awt.dll+0xb840c]  Java_sun_awt_windows_WToolkitThreadBlockedHandler_startSecondaryEventLoop+0x39c
C  [awt.dll+0x1211cd]  Java_sun_awt_DefaultMouseInfoPeer_fillPointWithCoords+0x461d
C  [msvcr71.dll+0x1cd6]  initterm+0x18
C  [ntdll.dll+0x118a]  LdrInitializeThunk+0x24
C  [ntdll.dll+0x1b5d2]  LdrFindResourceDirectory_U+0x28d
C  [ntdll.dll+0x162db]  RtlValidateUnicodeString+0x511
C  [ntdll.dll+0x1643d]  LdrLoadDll+0x110
C  [kernel32.dll+0x1bbd]  LoadLibraryExW+0xc8
C  [kernel32.dll+0x1d72]  LoadLibraryExA+0x1f
C  [kernel32.dll+0x1da8]  LoadLibraryA+0x2d
C  [AcLayers.DLL+0x29f3a]
C  [java.exe+0x5cc8]
C  [java.exe+0x5b56]
C  [java.exe+0x130d]
C  [java.exe+0xe232]
C  [kernel32.dll+0x17077]  RegisterWaitForInputIdle+0x49
                                     
2011-08-16
EVALUATION

I could not reproduce the crash at all on Windows 7 with IE 9. I used jdk 6u26. I followed the instraction from pogo.
                                     
2011-08-16
EVALUATION

There is no AWT code on stack. IE heap is corrupted. I cannot continue debugging here.
                                     
2011-08-16
EVALUATION

Stack trace is the next.

>    ntdll.dll!@RtlpLowFragHeapFree@8()  - 0xf3 bytes   
     ntdll.dll!_RtlFreeHeap@12()  + 0x26e8f bytes   
     ole32.dll!CRetailMalloc_Free()  + 0x1c bytes   
     oleaut32.dll!APP_DATA::FreeCachedMem()  + 0x88 bytes   
     oleaut32.dll!_SysFreeString@4()  + 0x35 bytes   
     oleaut32.dll!_VariantClear@4()  + 0x1d3 bytes   
     ieframe.dll!Detour_VariantClear()  + 0x2f bytes   
     jscript.dll!VAR::Clear()  + 0x52 bytes   
     jscript.dll!GcAlloc::ReclaimGarbage()  + 0xa2 bytes   
     jscript.dll!GcContext::Reclaim()  + 0x8d bytes   
     jscript.dll!GcContext::CollectCore()  + 0xd7 bytes   
     jscript.dll!GcContext::Collect()  + 0x34 bytes   
     jscript.dll!CScriptRuntime::Run()  - 0x1565a bytes   
     jscript.dll!ScrFncObj::CallWithFrameOnStack()  + 0x9f bytes   
     jscript.dll!ScrFncObj::Call()  - 0x3e4d7 bytes   
     jscript.dll!NameTbl::InvokeInternal()  + 0xb1 bytes   
     jscript.dll!VAR::InvokeByDispID()  + 0x5cd bytes   
     jscript.dll!VAR::InvokeJSObj<SYM *>()  + 0x136a bytes   
     jscript.dll!VAR::InvokeByName()  + 0x64 bytes   
     jscript.dll!VAR::InvokeDispName()  + 0x73 bytes   
     jscript.dll!VAR::InvokeByDispID()  + 0x1f3d bytes   
     jscript.dll!CScriptRuntime::Run()  + 0x233e bytes   
     jscript.dll!ScrFncObj::CallWithFrameOnStack()  + 0x9f bytes   
     jscript.dll!ScrFncObj::Call()  - 0x3e4d7 bytes   
     jscript.dll!NameTbl::InvokeInternal()  + 0xb1 bytes   
     jscript.dll!VAR::InvokeByDispID()  + 0x5cd bytes   
     jscript.dll!VAR::InvokeJSObj<SYM *>()  + 0x136a bytes   
     jscript.dll!VAR::InvokeByName()  + 0x64 bytes   
     jscript.dll!VAR::InvokeDispName()  + 0x73 bytes   
     jscript.dll!VAR::InvokeByDispID()  + 0x1f3d bytes   
     jscript.dll!CScriptRuntime::Run()  + 0x233e bytes   
     jscript.dll!ScrFncObj::CallWithFrameOnStack()  + 0x9f bytes   
     jscript.dll!ScrFncObj::Call()  - 0x3e4d7 bytes   
     jscript.dll!NameTbl::InvokeInternal()  + 0xb1 bytes   
     jscript.dll!VAR::InvokeByDispID()  + 0x5cd bytes   
     jscript.dll!VAR::InvokeJSObj<SYM *>()  + 0x136a bytes   
     jscript.dll!VAR::InvokeByName()  + 0x64 bytes   
     jscript.dll!VAR::InvokeDispName()  + 0x73 bytes   
     jscript.dll!VAR::InvokeByDispID()  + 0x1f3d bytes   
     jscript.dll!CScriptRuntime::Run()  + 0x233e bytes   
     jscript.dll!ScrFncObj::CallWithFrameOnStack()  + 0x9f bytes   
     jscript.dll!ScrFncObj::Call()  - 0x3e4d7 bytes   
     jscript.dll!CSession::Execute()  + 0x14a bytes   
     jscript.dll!COleScript::ExecutePendingScripts()  + 0x1a0 bytes   
     jscript.dll!COleScript::ParseScriptTextCore()  + 0x1e9 bytes   
     jscript.dll!COleScript::ParseScriptText()  + 0x30 bytes   
     mshtml.dll!CScriptCollection::ParseScriptText()  + 0x18d bytes   
     mshtml.dll!CScriptElement::CommitCode()  - 0x42 bytes   
     mshtml.dll!CScriptElement::Execute()  + 0x8f bytes   
     mshtml.dll!CHtmParse::Execute()  + 0x577b bytes   
     mshtml.dll!CHtmPost::Broadcast()  + 0xf bytes   
     mshtml.dll!CHtmPost::Exec()  + 0x16a bytes   
     mshtml.dll!CHtmPost::Run()  + 0x15 bytes   
     mshtml.dll!PostManExecute()  + 0x90 bytes   
     mshtml.dll!PostManResume()  + 0x92 bytes   
     mshtml.dll!CHtmPost::OnDwnChanCallback()  + 0x10 bytes   
     mshtml.dll!CDwnChan::OnMethodCall()  + 0x19 bytes   
     mshtml.dll!GlobalWndOnMethodCall()  + 0xcc bytes   
     mshtml.dll!GlobalWndProc()  + 0xae bytes   
     user32.dll!_InternalCallWinProc@20()  + 0x28 bytes   
     user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes   
     user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes   
     user32.dll!_DispatchMessageW@4()  + 0xf bytes   
     ieframe.dll!CTabWindow::_TabWindowThreadProc()  - 0x3216a bytes   
     ieframe.dll!LCIETab_ThreadProc()  + 0x4423 bytes   
     iertutil.dll!CIsoScope::RegisterThread()  - 0x3223 bytes   
     kernel32.dll!_BaseThreadStart@8()  + 0x37 bytes
                                     
2011-08-16
EVALUATION

Debugger showed the next output.

'iexplore.exe': Loaded 'C:\Program Files\Internet Explorer\iexplore.exe', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ntdll.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\kernel32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\advapi32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\rpcrt4.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\secur32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\user32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\gdi32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msvcrt.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\shlwapi.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\shell32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ole32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\iertutil.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\urlmon.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\oleaut32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\shimeng.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\AppPatch\aclayers.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\userenv.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\winspool.drv', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\imm32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\lpk.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\usp10.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\comctl32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ieframe.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\comdlg32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\Program Files\Internet Explorer\xpshims.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\uxtheme.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\xpsp2res.dll', Binary was not built with debug information.
'iexplore.exe': Loaded 'C:\WINDOWS\system32\clbcatq.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\comres.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\version.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\Program Files\Internet Explorer\ieproxy.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\setupapi.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\wininet.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\normaliz.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ws2_32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ws2help.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\mswsock.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\apphelp.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\dnsapi.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\iphlpapi.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\system32\mlang.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\rasadhlp.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msctfime.ime', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4027_x-ww_e69378d0\msvcr80.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4027_x-ww_e69378d0\msvcp80.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\Program Files\Java\jre6\bin\jp2ssv.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\Program Files\Java\jre6\bin\msvcr71.dll', Symbols loaded.
'iexplore.exe': Loaded 'C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\system32\hnetcfg.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\wshtcpip.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\mshtml.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msls31.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\psapi.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ieapfltr.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\crypt32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msasn1.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\sxs.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\rasapi32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\rasman.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\netapi32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\tapi32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\rtutils.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\winmm.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\serwvdrv.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\umdmxfrm.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msv1_0.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\cryptdll.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\sensapi.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msi.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\system32\actxprxy.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msimtf.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msctf.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\iepeers.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\jscript.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx', Binary was not built with debug information.
'iexplore.exe': Loaded 'C:\WINDOWS\system32\wsock32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\wintrust.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\imagehlp.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\wdmaud.drv', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msacm32.drv', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msacm32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\midimap.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\deployJava1.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\system32\imgutil.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\pngfilt.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\dxtrans.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\atl.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ddrawex.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\ddraw.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\dciman32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\dxtmsft.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\Program Files\Skype\Toolbars\Shared\SkypePnr.dll', Cannot find or open the PDB file
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msxml3.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\msimg32.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023\GdiPlus.dll', Symbols loaded (source information stripped).
'iexplore.exe': Loaded 'C:\WINDOWS\system32\d3dim700.dll', Symbols loaded (source information stripped).
The thread 'Win32 Thread' (0xca0) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x10d8) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x1204) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x12d8) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x152c) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x17e8) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x8a0) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x17c8) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x155c) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x141c) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x122c) has exited with code 0 (0x0).
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c936cf3 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
First-chance exception at 0x7c937073 (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0x09d6d110.
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489D8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489C8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489C8
Heap corruption detected at 09D489D8
Heap corruption detected at 09D489C8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489F8
Heap corruption detected at 09D489A8
Heap corruption detected at 09D49FB8
Heap corruption detected at 09D489C8
Heap corruption detected at 09D489A8
Heap corruption detected at 09D48D38
Heap corruption detected at 09D48A10
Heap corruption detected at 09D489A8
Heap corruption detected at 09D49F68
Heap corruption detected at 09D489F8
First-chance exception at 0x7c93717b (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0xff000109.
Unhandled exception at 0x7c93717b (ntdll.dll) in iexplore.exe: 0xC0000005: Access violation reading location 0xff000109.

You can notice multiple heap corruptions.
                                     
2011-08-16
EVALUATION

I tryed to reproduce the problem on Windows XP. I used IE8 and followed instructions.

In deploy console (SPI_PLUGIN2_DEBUG and SPI_PLUGIN2_VERBOSE)

IExplorerPlugin.InPlaceDeactivate(cAxControl = 0xcaa2d40)
  Stopping applet ID [AppletID 41]
JVMInstance.unregisterApplet for applet ID 41
  LiveConnectSupport.shutdown(41)
IExplorerPlugin.OnDestroy(cAxControl = 0xcaa2d40)
Exception in thread "Thread-5" netscape.javascript.JSException: Plugin instance
for applet ID 41 was already released
        at sun.plugin2.main.server.LiveConnectSupport.getInfo(Unknown Source)
        at sun.plugin2.main.server.LiveConnectSupport.shutdown(Unknown Source)
        at sun.plugin2.main.server.JVMInstance.unregisterApplet(Unknown Source)
        at sun.plugin2.main.server.JVMInstance.recycleAppletID(Unknown Source)
        at sun.plugin2.main.server.JVMManager.recycleAppletID(Unknown Source)
        at sun.plugin2.main.server.IExplorerPlugin.stopApplet(Unknown Source)
        at sun.plugin2.main.server.IExplorerPlugin.cancelBackgroundStarter(Unkno
wn Source)
        at sun.plugin2.main.server.IExplorerPlugin.InPlaceDeactivate(Unknown Sou
rce)
IExplorerPlugin.InPlaceDeactivate(cAxControl = 0xcaa2560)
  Stopping applet ID [AppletID 42]
JVMInstance.unregisterApplet for applet ID 42
  LiveConnectSupport.shutdown(42)
IExplorerPlugin.OnDestroy(cAxControl = 0xcaa2560)
Exception in thread "Thread-5" netscape.javascript.JSException: Plugin instance
for applet ID 42 was already released
        at sun.plugin2.main.server.LiveConnectSupport.getInfo(Unknown Source)
        at sun.plugin2.main.server.LiveConnectSupport.shutdown(Unknown Source)
        at sun.plugin2.main.server.JVMInstance.unregisterApplet(Unknown Source)
        at sun.plugin2.main.server.JVMInstance.recycleAppletID(Unknown Source)
        at sun.plugin2.main.server.JVMManager.recycleAppletID(Unknown Source)
        at sun.plugin2.main.server.IExplorerPlugin.stopApplet(Unknown Source)
        at sun.plugin2.main.server.IExplorerPlugin.cancelBackgroundStarter(Unkno
wn Source)
        at sun.plugin2.main.server.IExplorerPlugin.InPlaceDeactivate(Unknown Sou
rce)
IExplorerPlugin.InPlaceDeactivate(cAxControl = 0xc19a560)
  Stopping applet ID [AppletID 43]
JVMInstance.unregisterApplet for applet ID 43
  LiveConnectSupport.shutdown(43)
IExplorerPlugin.OnDestroy(cAxControl = 0xc19a560)
Exception in thread "Thread-5" netscape.javascript.JSException: Plugin instance
for applet ID 43 was already released
        at sun.plugin2.main.server.LiveConnectSupport.getInfo(Unknown Source)
        at sun.plugin2.main.server.LiveConnectSupport.shutdown(Unknown Source)
        at sun.plugin2.main.server.JVMInstance.unregisterApplet(Unknown Source)
        at sun.plugin2.main.server.JVMInstance.recycleAppletID(Unknown Source)
        at sun.plugin2.main.server.JVMManager.recycleAppletID(Unknown Source)
        at sun.plugin2.main.server.IExplorerPlugin.stopApplet(Unknown Source)
        at sun.plugin2.main.server.IExplorerPlugin.cancelBackgroundStarter(Unkno
wn Source)
        at sun.plugin2.main.server.IExplorerPlugin.InPlaceDeactivate(Unknown Sou
rce)
IExplorerPlugin.SetClientSite(cAxControl = 0xc199360, oleClientSite = 0x0, scrip
tDispatch = 0x0)
IExplorerPlugin.FinalRelease(cAxControl = 0xc199360)
IExplorerPlugin.SetClientSite(cAxControl = 0xcaa2bd8, oleClientSite = 0x0, scrip
tDispatch = 0x0)
IExplorerPlugin.FinalRelease(cAxControl = 0xcaa2bd8)
IExplorerPlugin.SetClientSite(cAxControl = 0xc21f9a0, oleClientSite = 0x0, scrip
tDispatch = 0x0)
IExplorerPlugin.SetClientSite(cAxControl = 0xcaa2d40, oleClientSite = 0x0, scrip
tDispatch = 0x0)
IExplorerPlugin.FinalRelease(cAxControl = 0xcaa2d40)
IExplorerPlugin.SetClientSite(cAxControl = 0xcaa2560, oleClientSite = 0x0, scrip
tDispatch = 0x0)
IExplorerPlugin.FinalRelease(cAxControl = 0xcaa2560)
IExplorerPlugin.SetClientSite(cAxControl = 0xc19a560, oleClientSite = 0x0, scrip
tDispatch = 0x0)
IExplorerPlugin.FinalRelease(cAxControl = 0xc19a560)

<==== here crash happened
                                     
2011-08-16
EVALUATION

I did not get how to reproduce the problem. More information is needed.

Please, specify the game that was played.
                                     
2011-08-04
PUBLIC COMMENTS

There are large number of reports being submitted with this issue. With the keywords: Pogo & 6.0_26-b03 & "AWT-Windows" the number of reports as on 7/26/2011 are: 
Year 	Month 	Count
2011 	6 	1129
2011 	7 	1951

Am posting this to AWT for first review. This map be related to the plugin as well since the submitter has indicated that the game worked without issues on Chrome.
                                     
2011-08-01



Hardware and Software, Engineered to Work Together