United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-7148803 access violation in axbridge.dll since JRE 7
JDK-7148803 : access violation in axbridge.dll since JRE 7

Details
Type:
Bug
Submit Date:
2012-02-25
Status:
Closed
Updated Date:
2013-04-20
Project Name:
JDK
Resolved Date:
2012-04-12
Component:
deploy
OS:
generic,windows_xp
Sub-Component:
plugin
CPU:
x86,generic
Priority:
P2
Resolution:
Fixed
Affected Versions:
7
Fixed Versions:

Related Reports
Backport:
Backport:
Duplicate:

Sub Tasks

Description
Access violation in axbridge.dll when running a axbridge demo such as JCalendarPanel.
Customer also reported similar crash issue.

call stack as follows:

ChildEBP RetAddr  Args to Child              
07f6f6d4 6bd4bb8a 00000437 00004000 0ed07a98 axbridge!CAxBridge::OnNotifyEvent+0x76 (FPO: [Non-Fpo]) (CONV: thiscall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\axbridge\core\axbridge.cpp @ 375]
07f6f6fc 6bd49a2c 000104bc 00000437 00004000 axbridge!CAxBridge::ProcessWindowMessage+0x117 (FPO: [Non-Fpo]) (CONV: thiscall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\axbridge\core\axbridge.h @ 202]
07f6f74c 75ec6238 00000000 00000000 00004000 axbridge!ATL::CWindowImplBaseT<ATL::CWindow,ATL::CWinTraits<1442840576,0> >::WindowProc+0x48 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\program files\microsoft visual studio 10.0\vc\atlmfc\include\atlwin.h @ 3508]
07f6f778 75ec68ea 08e70fe0 000104bc 00000437 user32!InternalCallWinProc+0x23
07f6f7f0 75ec7d31 005ebe3c 08e70fe0 000104bc user32!UserCallWinProcCheckWow+0x109 (FPO: [SEH])
07f6f850 75ec7dfa 08e70fe0 00000000 07f6f88c user32!DispatchMessageWorker+0x3bc (FPO: [SEH])
07f6f860 75ee2292 07f6f8d4 00000001 07f6f8d4 user32!DispatchMessageW+0xf (FPO: [1,0,0])
07f6f88c 75ee70a9 000104bc 00000000 00000000 user32!IsDialogMessageW+0x5f6 (FPO: [2,5,4])
Unable to load image C:\Program Files (x86)\Java\jre7\bin\jpicom.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for jpicom.dll
07f6f8b4 6b6c9d89 000104bc 07f6f8d4 a1bef72f user32!IsDialogMessageA+0x199 (FPO: [2,3,4])
07f6f914 6b6ca40b 077115b0 0000093c ffffffff jpicom!CJavaAdapter::WaitForJS+0x12b (FPO: [Non-Fpo]) (CONV: cdecl) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\dispatch\javaadapter.cpp @ 483]
07f6f98c 6bd43745 077115b4 00008008 6b0b30b4 jpicom!CJavaAdapter::Invoke+0x1a5 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\dispatch\javaadapter.cpp @ 267]
Unable to load image C:\Windows\System32\mfc100u.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfc100u.dll
07f6f9c8 6b2c9004 077115b4 00008008 6b0b30b4 axbridge!CAxBridge::Invoke+0xe8 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\jdk7u2_32p\jdk7u4_1028_new\deploy\src\plugin\win32\com\axbridge\core\axbridge.cpp @ 1034]
07f6fa94 07f6fab8 6b2c938d 00008008 00000001 mfc100u!COleDispatchDriver::InvokeHelperV+0x324 (FPO: [6,37,0])
WARNING: Frame IP not in any known module. Following frames may be wrong.
07f6fab0 07f6fad8 07f6fb00 0f981c9c 07f6fb40 0x7f6fab8
00000000 00000000 00000000 00000000 00000000 0x7f6fad8

                                    

Comments
SUGGESTED FIX

webrev: http://sa.us.oracle.com/projects/deployment_data/8/7148803
                                     
2012-02-28
EVALUATION

The crash is in atlcomcli.h when it's trying to AddRef() on an invalid pointer.
	CComPtrBase(_Inout_opt_ T* lp) throw()
	{
		p = lp;
		if (p != NULL)
			p->AddRef();
	}

The cause seems to be the m_ppUnk of CComDynamicUnkArray became invalid due to its destructor was called in atlcom.h
	~CComDynamicUnkArray()
	{
		if (m_nSize > 0)
			free(m_ppUnk);
	}

after the m_vec was returned from the IConnectionPointImpl2 class which subclasses IConnectionPointImpl (see AxBridge.h). In CAxBridge:OnNotifyEvent, after the first call below:
int nConnections = getVec().GetSize();
the ~CComDynamicUnkArray() was called before entering the for loop.

A fix is to avoid returning m_vec to the caller.
                                     
2012-02-28



Hardware and Software, Engineered to Work Together