JDK-7148803 : access violation in axbridge.dll since JRE 7
  • Type: Bug
  • Component: deploy
  • Sub-Component: plugin
  • Affected Version: 7
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: generic,windows_xp
  • CPU: generic,x86
  • Submitted: 2012-02-25
  • Updated: 2013-09-12
  • Resolved: 2012-04-12
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7 JDK 8
7u4Fixed 8 b28Fixed
Related Reports
Duplicate :  
JDK-7148818 - Access violation in jre 7.0's axbridge.dll - avbridge is broken with java 7
Description
Access violation in axbridge.dll when running a axbridge demo such as JCalendarPanel.
Customer also reported similar crash issue.

call stack as follows:

ChildEBP RetAddr  Args to Child              
07f6f6d4 6bd4bb8a 00000437 00004000 0ed07a98 axbridge!CAxBridge::OnNotifyEvent+0x76 (FPO: [Non-Fpo]) (CONV: thiscall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\axbridge\core\axbridge.cpp @ 375]
07f6f6fc 6bd49a2c 000104bc 00000437 00004000 axbridge!CAxBridge::ProcessWindowMessage+0x117 (FPO: [Non-Fpo]) (CONV: thiscall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\axbridge\core\axbridge.h @ 202]
07f6f74c 75ec6238 00000000 00000000 00004000 axbridge!ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<1442840576,0> >::WindowProc+0x48 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\program files\microsoft visual studio 10.0\vc\atlmfc\include\atlwin.h @ 3508]
07f6f778 75ec68ea 08e70fe0 000104bc 00000437 user32!InternalCallWinProc+0x23
07f6f7f0 75ec7d31 005ebe3c 08e70fe0 000104bc user32!UserCallWinProcCheckWow+0x109 (FPO: [SEH])
07f6f850 75ec7dfa 08e70fe0 00000000 07f6f88c user32!DispatchMessageWorker+0x3bc (FPO: [SEH])
07f6f860 75ee2292 07f6f8d4 00000001 07f6f8d4 user32!DispatchMessageW+0xf (FPO: [1,0,0])
07f6f88c 75ee70a9 000104bc 00000000 00000000 user32!IsDialogMessageW+0x5f6 (FPO: [2,5,4])
Unable to load image C:\Program Files (x86)\Java\jre7\bin\jpicom.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for jpicom.dll
07f6f8b4 6b6c9d89 000104bc 07f6f8d4 a1bef72f user32!IsDialogMessageA+0x199 (FPO: [2,3,4])
07f6f914 6b6ca40b 077115b0 0000093c ffffffff jpicom!CJavaAdapter::WaitForJS+0x12b (FPO: [Non-Fpo]) (CONV: cdecl) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\dispatch\javaadapter.cpp @ 483]
07f6f98c 6bd43745 077115b4 00008008 6b0b30b4 jpicom!CJavaAdapter::Invoke+0x1a5 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\dispatch\javaadapter.cpp @ 267]
Unable to load image C:\Windows\System32\mfc100u.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfc100u.dll
07f6f9c8 6b2c9004 077115b4 00008008 6b0b30b4 axbridge!CAxBridge::Invoke+0xe8 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\axbridge\core\axbridge.cpp @ 1034]
07f6fa94 07f6fab8 6b2c938d 00008008 00000001 mfc100u!COleDispatchDriver::InvokeHelperV+0x324 (FPO: [6,37,0])
WARNING: Frame IP not in any known module. Following frames may be wrong.
07f6fab0 07f6fad8 07f6fb00 0f981c9c 07f6fb40 0x7f6fab8
00000000 00000000 00000000 00000000 00000000 0x7f6fad8
Comments
EVALUATION The crash is in atlcomcli.h when it's trying to AddRef() on an invalid pointer. CComPtrBase(_Inout_opt_ T* lp) throw() { p = lp; if (p != NULL) p->AddRef(); } The cause seems to be the m_ppUnk of CComDynamicUnkArray became invalid due to its destructor was called in atlcom.h ~CComDynamicUnkArray() { if (m_nSize > 0) free(m_ppUnk); } after the m_vec was returned from the IConnectionPointImpl2 class which subclasses IConnectionPointImpl (see AxBridge.h). In CAxBridge:OnNotifyEvent, after the first call below: int nConnections = getVec().GetSize(); the ~CComDynamicUnkArray() was called before entering the for loop. A fix is to avoid returning m_vec to the caller.
28-02-2012