JDK-6744951 : Applets not correctly destroyed after LiveConnect interactions
  • Type: Bug
  • Component: deploy
  • Sub-Component: plugin
  • Affected Version: 6u10
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2008-09-04
  • Updated: 2013-01-09
  • Resolved: 2008-10-02
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6
6u10 b33Fixed
Description
FULL PRODUCT VERSION :
Java(TM) SE Runtime Environment (build 1.6.0_10-rc-b28)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]

EXTRA RELEVANT SYSTEM CONFIGURATION :
Mozilla Firefox 3.0.1

A DESCRIPTION OF THE PROBLEM :
Java applets are not always cleaned up after a LiveConnect interaction in Mozilla Firefox 3.0.1.  This is more noticeable with large applets, but I was able to recreate the problem using the test case below.  I used Yourkit Java Profiler to capture memory state, and the trace suggests that references to the applets are stored in the exportedObjectMap of the sun.plugin2.main.client.LiveConnectSupport class even after I have navigated away from the page.
  I can provide memory dumps from Yourkit if they would be helpful.  The applet references are sometimes cleared with no problem, however, with larger applets, I have found that the applets are often left even after browsing away from the page.  These references eventually cause OutOfMemory exceptions after loading the applet pages several times in one browser session.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Use the applet in the attached test case
Navigate to the included test.html
Click the "Change size" button
Navigate to test2.html
Navigate to test.html
Repeat this back and forth processing (do not use the browsers back button).

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Only the current page applet shows up in the memory output.
ACTUAL -
After 20 or so back and forth cycles, I had 5 applets "stuck" in the exportedObjectMap of the LiveConnectSupport class.  These applets are never removed from memory.

REPRODUCIBILITY :
This bug can be reproduced often.

---------- BEGIN SOURCE ----------
------------------------------TestApplet.java-----------------------------
import javax.swing.JApplet;
public class TestApplet extends JApplet {
	private double[] big_array = new double[100000];
}
------------------------------test2.html----------------------------------
<html>
<head>
<title>
LiveConnect Test
</title>
</head>
<body>
  <div style='border:3px;border-style:solid'>
	<object id="test_applet" height="100" width="100" name="test_applet" >
	  <param value="application/x-java-applet;version=1.6" name="type"/>
	  <param value="true" name="scriptable"/>
	  <param value="TestApplet.class" name="code"/>
	  <comment>
	    <embed
	     id="test_applet"
	     height="100"
	     width="100"
	     mayscript="true"
	     code="TestApplet.class"
	     type="application/x-java-applet;version=1.6"
	     name="test_applet" />
	    <noembed>No Java Plug-in Support</noembed>
	  </comment>
	</object>
  </div>
	No Livescript interaction on this page.
</body>
</html>
---------------------------------test.html--------------------------------
<html>
<head>
  <script type='application/javascript' language='JavaScript'>
	function ResizeMe() {
		document.embeds['test_applet'].height = '500';
	}
  </script>
  <title>LiveConnect Test -- with resize</title>
</head>
<body>
  <div style='border:3px;border-style:solid'>
	<object id="test_applet" height="100" width="100" name="test_applet" >
	  <param value="application/x-java-applet;version=1.6" name="type"/>
	  <param value="true" name="scriptable"/>
	  <param value="TestApplet.class" name="code"/>
	  <comment>
	    <embed
	     id="test_applet"
	     height="100"
	     width="100"
	     mayscript="true"
	     code="TestApplet.class"
	     type="application/x-java-applet;version=1.6"
	     name="test_applet" />
	    <noembed>No Java Plug-in Support</noembed>
	  </comment>
	</object>
  </div>
  <button onclick="ResizeMe();">Change Size</button>
</body>
</html>

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Restarting the browser is the only way I have found to clear the memory.

Comments
EVALUATION It appears that we occasionally aren't receiving notifications from the web browser that a given reference from the JavaScript engine to a Java object has been released. Once an applet has been shut down, all references from the JavaScript engine to objects exposed from that applet's scope are conceptually dead. This change enforces this lifecycle by releasing all references from the LiveConnect subsystem to objects exported from that applet's scope when the applet is shut down.
22-09-2008

SUGGESTED FIX webrev: http://sa.sfbay.sun.com/projects/deployment_data/6u10/6744951.1 testcase: http://j2se.east.sun.com/deployment/www/tests/1.6.0_10/6744951/
22-09-2008

EVALUATION The lifecycle of Java objects returned to the web browser is an area that has never been well specified. Currently we rely on the web browser to provide notifications that each individual JavaScript object referring to a Java object has been released. Instead, upon destruction of a particular applet instance, we should probably forcibly break the references from the JavaScript engine to any Java objects returned from the scope of that instance.
09-09-2008