JDK-8119390 : JSObject.toString() crashes the VM
  • Type: Bug
  • Component: javafx
  • Sub-Component: web
  • Affected Version: fx2.0
  • Priority: P2
  • Status: Closed
  • Resolution: Incomplete
  • Submitted: 2011-09-23
  • Updated: 2020-11-04
  • Resolved: 2011-10-10
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 7
7-poolResolved
Related Reports
Relates :  
JDK-8088406 - Java crashes when accessing DOM elements from outside of application thread
Description
Hi, 
Could we consider that RT-15811 will also fix this issue?

JSObject.toString() crashes the VM and generates this:


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x6efac920, pid=6908, tid=8776
#
# JRE version: 6.0_23-b05
# Java VM: Java HotSpot(TM) Client VM (19.0-b09 mixed mode, sharing windows-x86 )
# Problematic frame:
# C  [WebPaneJava.dll+0x56c920]
#
# If you would like to submit a bug report, please visit:
#   http://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

---------------  T H R E A D  ---------------

Current thread (0x01dacc00):  JavaThread "AWT-EventQueue-0" [_thread_in_native, id=8776, stack(0x05460000,0x054b0000)]

siginfo: ExceptionCode=0xc0000005, reading address 0x00000000

Registers:
EAX=0x00000000, EBX=0x00000001, ECX=0x067e2690, EDX=0x06800328
ESP=0x054af24c, EBP=0x068003a0, ESI=0x07580038, EDI=0x067e1158
EIP=0x6efac920, EFLAGS=0x00010246

Register to memory mapping:

EAX=0x00000000
0x00000000 is pointing to unknown location

EBX=0x00000001
0x00000001 is pointing to unknown location

ECX=0x067e2690
0x067e2690 is pointing to unknown location

EDX=0x06800328
0x06800328 is pointing to unknown location

ESP=0x054af24c
0x054af24c is pointing into the stack for thread: 0x01dacc00
"AWT-EventQueue-0" prio=6 tid=0x01dacc00 nid=0x2248 runnable [0x054af000]
   java.lang.Thread.State: RUNNABLE

EBP=0x068003a0
0x068003a0 is pointing to unknown location

ESI=0x07580038
0x07580038 is pointing to unknown location

EDI=0x067e1158
0x067e1158 is pointing to unknown location


Top of Stack: (sp=0x054af24c)
0x054af24c:   07580038 6efad069 067e2690 fffffffb
0x054af25c:   6efb375b 0658ffe8 6efb379a fbbaab4d
0x054af26c:   067e2690 054af320 054af348 0658ffe8
0x054af27c:   07580000 06575630 067e1120 067d0fd8
0x054af28c:   0658dd40 065911bc 00000000 054af318
0x054af29c:   fffffffb 054af33c 6f0c7670 00000001
0x054af2ac:   6efa5d4a 054af320 0657563c 067e1158
0x054af2bc:   00000001 054af330 067e2690 fffffffb 

Instructions: (pc=0x6efac920)
0x6efac910:   8b 50 48 ff d2 eb 09 8d 4c 24 0c e8 20 a9 fe ff
0x6efac920:   8b 10 8b 52 58 68 f8 3d 0e 6f 51 8b cc 89 64 24 


Stack: [0x05460000,0x054b0000],  sp=0x054af24c,  free space=316k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [WebPaneJava.dll+0x56c920]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j  com.sun.webpane.webkit.JSObject.toStringImpl(JJ)Ljava/lang/String;+0
j  com.sun.webpane.webkit.JSObject.toString()Ljava/lang/String;+8
j  javax.swing.tree.DefaultMutableTreeNode.toString()Ljava/lang/String;+13
j  javax.swing.JTree.convertValueToText(Ljava/lang/Object;ZZZIZ)Ljava/lang/String;+5
j  javax.swing.tree.DefaultTreeCellRenderer.getTreeCellRendererComponent(Ljavax/swing/JTree;Ljava/lang/Object;ZZZIZ)Ljava/awt/Component;+11
j  javax.swing.plaf.synth.SynthTreeUI$SynthTreeCellRenderer.getTreeCellRendererComponent(Ljavax/swing/JTree;Ljava/lang/Object;ZZZIZ)Ljava/awt/Component;+61
j  javax.swing.plaf.synth.SynthTreeUI.paintRow(Ljavax/swing/tree/TreeCellRenderer;Ljavax/swing/tree/DefaultTreeCellRenderer;Ljavax/swing/plaf/synth/SynthContext;Ljavax/swing/plaf/synth/SynthContext;Ljava/awt/Graphics;Ljava/awt/Rectangle;Ljava/awt/Insets;Ljava/awt/Rectangle;Ljava/awt/Rectangle;Ljavax/swing/tree/TreePath;IZZZ)V+278
j  javax.swing.plaf.synth.SynthTreeUI.paint(Ljavax/swing/plaf/synth/SynthContext;Ljava/awt/Graphics;)V+325
j  javax.swing.plaf.synth.SynthTreeUI.update(Ljava/awt/Graphics;Ljavax/swing/JComponent;)V+33
j  javax.swing.JComponent.paintComponent(Ljava/awt/Graphics;)V+26
j  javax.swing.JComponent.paint(Ljava/awt/Graphics;)V+290
j  javax.swing.JComponent.paintToOffscreen(Ljava/awt/Graphics;IIIIII)V+41
j  javax.swing.RepaintManager$PaintManager.paintDoubleBuffered(Ljavax/swing/JComponent;Ljava/awt/Image;Ljava/awt/Graphics;IIII)V+105
j  javax.swing.RepaintManager$PaintManager.paint(Ljavax/swing/JComponent;Ljavax/swing/JComponent;Ljava/awt/Graphics;IIII)Z+116
j  javax.swing.RepaintManager.paint(Ljavax/swing/JComponent;Ljavax/swing/JComponent;Ljava/awt/Graphics;IIII)V+52
j  javax.swing.JComponent._paintImmediately(IIII)V+679
j  javax.swing.JComponent.paintImmediately(IIII)V+83
j  javax.swing.RepaintManager.paintDirtyRegions(Ljava/util/Map;)V+193
j  javax.swing.RepaintManager.paintDirtyRegions()V+46
j  javax.swing.RepaintManager.seqPaintDirtyRegions()V+73
j  javax.swing.SystemEventQueueUtilities$ComponentWorkRequest.run()V+36
j  java.awt.event.InvocationEvent.dispatch()V+47
J  java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V
J  java.awt.EventDispatchThread.pumpOneEventForFilters(I)Z
j  java.awt.EventDispatchThread.pumpEventsForFilter(ILjava/awt/Conditional;Ljava/awt/EventFilter;)V+30
j  java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V+11
j  java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
j  java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
j  java.awt.EventDispatchThread.run()V+9
v  ~StubRoutines::call_stub

---------------  P R O C E S S  ---------------

Java Threads: ( => current thread )
  0x01db1000 JavaThread "URL-Fetcher-4" daemon [_thread_blocked, id=8960, stack(0x05680000,0x056d0000)]
  0x01db0c00 JavaThread "Prism Font Disposer" daemon [_thread_blocked, id=9040, stack(0x0a180000,0x0a1d0000)]
  0x01daf800 JavaThread "Disposer" daemon [_thread_blocked, id=2960, stack(0x06780000,0x067d0000)]
  0x01daf400 JavaThread "TimerQueue" daemon [_thread_blocked, id=1968, stack(0x066f0000,0x06740000)]
  0x01daec00 JavaThread "Thread-5" daemon [_thread_in_native, id=3920, stack(0x06650000,0x066a0000)]
  0x01dae400 JavaThread "JavaFX Application Thread" [_thread_in_native, id=2788, stack(0x05ce0000,0x05d30000)]
  0x01dae000 JavaThread "Disposer" daemon [_thread_blocked, id=7832, stack(0x05c00000,0x05c50000)]
  0x01dad800 JavaThread "QuantumRenderer-0" daemon [_thread_blocked, id=7440, stack(0x05570000,0x055c0000)]
  0x01dad400 JavaThread "DestroyJavaVM" [_thread_blocked, id=1248, stack(0x002a0000,0x002f0000)]
=>0x01dacc00 JavaThread "AWT-EventQueue-0" [_thread_in_native, id=8776, stack(0x05460000,0x054b0000)]
  0x01dac800 JavaThread "Thread-3" [_thread_in_native, id=2004, stack(0x053b0000,0x05400000)]
  0x01dac000 JavaThread "EventQueueMonitor-ComponentEvtDispatch" [_thread_blocked, id=7588, stack(0x05210000,0x05260000)]
  0x01dabc00 JavaThread "AWT-Windows" daemon [_thread_in_native, id=3076, stack(0x05050000,0x050a0000)]
  0x01dab400 JavaThread "AWT-Shutdown" [_thread_blocked, id=1360, stack(0x04e80000,0x04ed0000)]
  0x01dab000 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=772, stack(0x04dd0000,0x04e20000)]
  0x01daa800 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=8628, stack(0x049d0000,0x04a20000)]
  0x01db5400 JavaThread "CompilerThread0" daemon [_thread_blocked, id=3588, stack(0x04940000,0x04990000)]
  0x01daa400 JavaThread "Attach Listener" daemon [_thread_blocked, id=8800, stack(0x048b0000,0x04900000)]
  0x01da9c00 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=6560, stack(0x04820000,0x04870000)]
  0x01da1000 JavaThread "Finalizer" daemon [_thread_blocked, id=9068, stack(0x04790000,0x047e0000)]
  0x01d9f800 JavaThread "Reference Handler" daemon [_thread_blocked, id=8788, stack(0x04700000,0x04750000)]

Other Threads:
  0x01d9e400 VMThread [stack: 0x04670000,0x046c0000] [id=1476]
  0x01dc3400 WatcherThread [stack: 0x04a60000,0x04ab0000] [id=6888]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
 def new generation   total 8320K, used 4198K [0x28010000, 0x28910000, 0x2d560000)
  eden space 7424K,  56% used [0x28010000, 0x28429b28, 0x28750000)
  from space 896K,   0% used [0x28830000, 0x28830000, 0x28910000)
  to   space 896K,   0% used [0x28750000, 0x28750000, 0x28830000)
 tenured generation   total 18336K, used 9296K [0x2d560000, 0x2e748000, 0x38010000)
   the space 18336K,  50% used [0x2d560000, 0x2de74308, 0x2de74400, 0x2e748000)
 compacting perm gen  total 12288K, used 7718K [0x38010000, 0x38c10000, 0x3c010000)
   the space 12288K,  62% used [0x38010000, 0x38799bd8, 0x38799c00, 0x38c10000)
    ro space 10240K,  54% used [0x3c010000, 0x3c58c6b0, 0x3c58c800, 0x3ca10000)
    rw space 12288K,  55% used [0x3ca10000, 0x3d0b01f0, 0x3d0b0200, 0x3d610000)

Dynamic libraries:
0x00400000 - 0x00424000 	C:\Program Files (x86)\Java\jdk1.6.0_23\bin\javaw.exe
0x77540000 - 0x776c0000 	C:\Windows\SysWOW64\ntdll.dll
0x76680000 - 0x76780000 	C:\Windows\syswow64\kernel32.dll
0x75420000 - 0x75466000 	C:\Windows\syswow64\KERNELBASE.dll
0x74d30000 - 0x74dd0000 	C:\Windows\syswow64\ADVAPI32.dll
0x76490000 - 0x7653c000 	C:\Windows\syswow64\msvcrt.dll
0x753f0000 - 0x75409000 	C:\Windows\SysWOW64\sechost.dll
0x75590000 - 0x75680000 	C:\Windows\syswow64\RPCRT4.dll
0x74c40000 - 0x74ca0000 	C:\Windows\syswow64\SspiCli.dll
0x74c30000 - 0x74c3c000 	C:\Windows\syswow64\CRYPTBASE.dll
0x75050000 - 0x75150000 	C:\Windows\syswow64\USER32.dll
0x74ca0000 - 0x74d30000 	C:\Windows\syswow64\GDI32.dll
0x77510000 - 0x7751a000 	C:\Windows\syswow64\LPK.dll
0x76be0000 - 0x76c7d000 	C:\Windows\syswow64\USP10.dll
0x76b80000 - 0x76be0000 	C:\Windows\system32\IMM32.DLL
0x75320000 - 0x753ec000 	C:\Windows\syswow64\MSCTF.dll
0x10000000 - 0x1000f000 	C:\Windows\system32\PGPmapih.dll
0x7c340000 - 0x7c396000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\msvcr71.dll
0x6d8a0000 - 0x6db4c000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\client\jvm.dll
0x72ad0000 - 0x72b02000 	C:\Windows\system32\WINMM.dll
0x735b0000 - 0x735fb000 	C:\Windows\system32\apphelp.dll
0x6d850000 - 0x6d85c000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\verify.dll
0x6d3d0000 - 0x6d3ef000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\java.dll
0x6d330000 - 0x6d338000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\hpi.dll
0x75150000 - 0x75155000 	C:\Windows\syswow64\PSAPI.DLL
0x6d890000 - 0x6d89f000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\zip.dll
0x6d0b0000 - 0x6d1fa000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\awt.dll
0x734a0000 - 0x734f1000 	C:\Windows\system32\WINSPOOL.DRV
0x767d0000 - 0x7692c000 	C:\Windows\syswow64\ole32.dll
0x6fcf0000 - 0x6fe8e000 	C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\COMCTL32.dll
0x75160000 - 0x751b7000 	C:\Windows\syswow64\SHLWAPI.dll
0x71a00000 - 0x71a13000 	C:\Windows\system32\DWMAPI.DLL
0x71a20000 - 0x71aa0000 	C:\Windows\system32\uxtheme.dll
0x050a0000 - 0x050c9000 	C:\Windows\System32\JavaAccessBridge.DLL
0x6d400000 - 0x6d406000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\jawt.dll
0x04cb0000 - 0x04cb8000 	C:\Windows\System32\JAWTAccessBridge.DLL
0x75680000 - 0x762c9000 	C:\Windows\syswow64\shell32.dll
0x6d2e0000 - 0x6d32f000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\fontmanager.dll
0x5b5e0000 - 0x5b69e000 	C:\work\dev\JavaFX2\build45\rt\bin\msvcr100.dll
0x74670000 - 0x7467e000 	C:\work\dev\JavaFX2\build45\rt\bin\prism-d3d.dll
0x6e2f0000 - 0x6e4b3000 	C:\Windows\system32\d3d9.dll
0x73080000 - 0x73089000 	C:\Windows\system32\VERSION.dll
0x737d0000 - 0x737d6000 	C:\Windows\system32\d3d8thk.dll
0x05b10000 - 0x05ba2000 	C:\Windows\system32\igdumdx32.dll
0x05dc0000 - 0x06343000 	C:\Windows\system32\igdumd32.dll
0x71b40000 - 0x71b65000 	C:\Windows\system32\PowrProf.dll
0x74eb0000 - 0x7504d000 	C:\Windows\syswow64\SETUPAPI.dll
0x76b50000 - 0x76b77000 	C:\Windows\syswow64\CFGMGR32.dll
0x76930000 - 0x769bf000 	C:\Windows\syswow64\OLEAUT32.dll
0x76660000 - 0x76672000 	C:\Windows\syswow64\DEVOBJ.dll
0x74640000 - 0x74664000 	C:\work\dev\JavaFX2\build45\rt\bin\mat.dll
0x76ad0000 - 0x76b4b000 	C:\Windows\syswow64\COMDLG32.dll
0x6d6b0000 - 0x6d6c3000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\net.dll
0x74dd0000 - 0x74e05000 	C:\Windows\syswow64\WS2_32.dll
0x74ea0000 - 0x74ea6000 	C:\Windows\syswow64\NSI.dll
0x72f90000 - 0x72fcc000 	C:\Windows\system32\mswsock.dll
0x71b30000 - 0x71b36000 	C:\Windows\System32\wship6.dll
0x6d6d0000 - 0x6d6d9000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\nio.dll
0x6d250000 - 0x6d273000 	C:\Program Files (x86)\Java\jdk1.6.0_23\jre\bin\dcpr.dll
0x75220000 - 0x752a3000 	C:\Windows\syswow64\CLBCatQ.DLL
0x5b540000 - 0x5b581000 	C:\work\dev\JavaFX2\build45\rt\bin\libxml2.dll
0x6ea40000 - 0x6f32e000 	C:\work\dev\JavaFX2\build45\rt\bin\WebPaneJava.dll
0x74ae0000 - 0x74af6000 	C:\Windows\system32\CRYPTSP.dll
0x74aa0000 - 0x74adb000 	C:\Windows\system32\rsaenh.dll
0x5a760000 - 0x5a79c000 	C:\work\dev\JavaFX2\build45\rt\bin\javafx-font.dll
0x05620000 - 0x05632000 	C:\Program Files\Lenovo\HOTKEY\hkvolkey.DLL

VM Arguments:
jvm_args: -Dfile.encoding=Cp1252 -Xbootclasspath:C:\Program Files (x86)\Java\jdk1.6.0_23\jre\lib\resources.jar;C:\Program Files (x86)\Java\jdk1.6.0_23\jre\lib\rt.jar;C:\Program Files (x86)\Java\jdk1.6.0_23\jre\lib\jsse.jar;C:\Program Files (x86)\Java\jdk1.6.0_23\jre\lib\jce.jar;C:\Program Files (x86)\Java\jdk1.6.0_23\jre\lib\charsets.jar 
java_command: com.....
Launcher Type: SUN_STANDARD


OS=Windows_NT
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 37 Stepping 5, GenuineIntel



---------------  S Y S T E M  ---------------

OS: Windows 7 Build 7600 

CPU:total 4 (2 cores per cpu, 2 threads per core) family 6 model 37 stepping 5, cmov, cx8, fxsr, mmx, sse, sse2, sse3, ssse3, sse4.1, sse4.2, popcnt, ht

Memory: 4k page, physical 3985052k(910356k free), swap 7976752k(4077720k free)

vm_info: Java HotSpot(TM) Client VM (19.0-b09) for windows-x86 JRE (1.6.0_23-b05), built on Nov 12 2010 15:00:43 by "java_re" with MS VC++ 7.1 (VS2003)

time: Thu Sep 22 18:27:10 2011
elapsed time: 76 seconds
Comments
Don't send me code snippets where I have to guess at how to make it work. Of course I can probably probably figure it out, but it's tedious having to put it all together to make a runnable Application - in this case there is missing class structure, methods, imports, and undefined variables (webView, domTree). On top of everything, it's a combined Swing/JavaFX/WebView test, which I've never put together, and figuring that out would be a waste of my time, given that you know how to do it, and can easily put together such a test. Most of all, even I manage to turn your test into something I can run, there is no guarantee it will fail in the same way, because I may have made different assumptions or simplifications than you have. Please, when you submit a bug report send a *complete* standalone testcase, preferably simplified as much as practical, with complete instructions for how to reproduce the problem.
10-10-2011
Here is a code snipet on how to reproduce the problem. I only dump the DOM hierachy into a JTree. Each node of the tree wraps the Node of the DOM, and it calls the toString() method for displaying the text. And "on some" Node, the toString() crashes the VM. If this is not sufficient, I'll attach my HTML page as a test. Thanks. -- JTree domTree = new JTree(); displayDOM(webView.getEngine().getDocument()); void displayDOM(Document dom){ DefaultMutableTreeNode root = new DefaultMutableTreeNode(dom.getNodeName()); fillIn(dom.getChildNodes(),root); domTree.setModel(new DefaultTreeModel(root)); } void fillIn(NodeList node, DefaultMutableTreeNode parent){ for(int i=0;i<node.getLength();i++){ Node currentNode = node.item(i); DefaultMutableTreeNode treeNode = new DefaultMutableTreeNode(currentNode); parent.add(treeNode); if(currentNode.hasChildNodes()) fillIn(currentNode.getChildNodes(), treeNode); } }
28-09-2011
This seems to be missing the "how to reproduce" instructions ... (There are lots of different ways to create a JSObject, and at least some of them seem to create objects where toString *does* work.)
27-09-2011
Not likely. The fix we have for RT-15811 is on the plugin side. This backtrace looks like from webkit and will probably need a similar fix in webkit integration.
23-09-2011