[Bug 884] New: icedtea-web crashes in PluginRequestProcessor::sendMember

[bugzilla-daemon at icedtea.classpath.org]

http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=884

             Bug #: 884
           Summary: icedtea-web crashes in
                    PluginRequestProcessor::sendMember
    Classification: Unclassified
           Product: IcedTea-Web
           Version: 1.1.4
          Platform: x86_64
        OS/Version: Linux
            Status: NEW
          Severity: critical
          Priority: P3
         Component: Plugin
        AssignedTo: dbhole at redhat.com
        ReportedBy: mvyskocil at suse.cz
                CC: unassigned at icedtea.classpath.org


Created attachment 668
  --> http://icedtea.classpath.org/bugzilla/attachment.cgi?id=668
Full console output of my gdb session

Moved from https://bugzilla.novell.com/show_bug.cgi?id=746895

icedtea-web crashes on Firefox 10 on http://www.kimeng.co.th/

How to reproduce

http://www.kimeng.co.th/

Login: Trial59815
Password: Suse12.1

Click on KELiberty from menu, accepts several dialogs and you've get a crash.
It works well on Firefox 9, so there might be some subtle change between 9 and
10.

gdb says
#0  0x00007ffff76c6adb in raise () from /lib64/libpthread.so.0
#1  0x00007ffff5a86e9e in js_NewContext (rt=0x7fffe6022000,
stackChunkSize=<optimized out>) at
/usr/src/debug/mozilla/js/src/jscntxt.cpp:321
#2  0x00007ffff55adf21 in XPCJSContextStack::GetSafeJSContext
(this=0x7fffcc3eac60, aSafeJSContext=0x7fffc50fbbb8)
    at /usr/src/debug/mozilla/js/xpconnect/src/XPCThreadContext.cpp:236
#3  0x00007ffff571a3ad in mozilla::plugins::parent::_getstringidentifier
(name=0x7fffcec603b8 <Address 0x7fffcec603b8 out of bounds>)
    at /usr/src/debug/mozilla/dom/plugins/base/nsNPAPIPlugin.cpp:1397
#4  0x00007fffca6eee2a in PluginRequestProcessor::sendMember (this=<optimized
out>, message_parts=0x7fffcedc4740)
    at
/usr/src/debug/icedtea-web-1.1.4/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:532
#5  0x00007fffca6f0a1b in queue_processor (data=0x7fffcebecb20) at
/usr/src/debug/icedtea-web-1.1.4/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:724
#6  0x00007ffff76bef66 in start_thread () from /lib64/libpthread.so.0
#7  0x00007ffff73f6bfd in clone () from /lib64/libc.so.6

(gdb) frame 5
#5  0x00007fffca6f0a1b in queue_processor (data=0x7fffcebecb20) at
/usr/src/debug/icedtea-web-1.1.4/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:724
724                    processor->sendMember(message_parts);
(gdb) list
719            {
720                command = *(message_parts->at(4));
721    
722                if (command == "GetMember")
723                {
724                    processor->sendMember(message_parts);
725                } else if (command == "ToString")
726                {
727                    processor->sendString(message_parts);
728                } else if (command == "SetMember")
(gdb) print message_parts

attached output from console

-- 
Configure bugmail: http://icedtea.classpath.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.