6998716: client vm crashes making browser fails to respond under some scenarios

Reviewed-by: art, denis, uta

src/windows/native/sun/windows/ObjectList.cpp

@@ -48,7 +48,7 @@ void AwtObjectList::Add(AwtObject* obj)
     m_head = item;
 }
 
-void AwtObjectList::Remove(AwtObject* obj)
+BOOL AwtObjectList::Remove(AwtObject* obj)
 {
     CriticalSection::Lock l(m_lock);
 
@@ -64,11 +64,14 @@ void AwtObjectList::Remove(AwtObject* obj)
             }
             DASSERT(item != NULL);
             delete item;
-            return;
+            return TRUE;
         }
         lastItem = item;
         item = item->next;
     }
+
+    return FALSE;
+
 //    DASSERT(FALSE);  // should never get here...
                       // even if it does it shouldn't be fatal.
 }

src/windows/native/sun/windows/ObjectList.h

@@ -46,7 +46,7 @@ public:
     AwtObjectList();
 
     void Add(AwtObject* obj);
-    void Remove(AwtObject* obj);
+    BOOL Remove(AwtObject* obj);
 #ifdef DEBUG
     /* Used for sanity checks only. */
     AwtObject* LookUp(AwtObject* obj);

src/windows/native/sun/windows/awt_Component.cpp

@@ -1969,7 +1969,9 @@ MsgRouting AwtComponent::WmDestroy()
 {
     // fix for 6259348: we should enter the SyncCall critical section before
     // disposing the native object, that is value 1 of lParam is intended for
-    AwtToolkit::GetInstance().SendMessage(WM_AWT_DISPOSE, (WPARAM)this, (LPARAM)1);
+    if(m_peerObject != NULL) { // is not being terminating
+        AwtToolkit::GetInstance().SendMessage(WM_AWT_DISPOSE, (WPARAM)m_peerObject, (LPARAM)1);
+    }
 
     return mrConsume;
 }
@@ -6534,8 +6536,7 @@ Java_sun_awt_windows_WComponentPeer__1dispose(JNIEnv *env, jobject self)
 {
     TRY_NO_HANG;
 
-    PDATA pData = JNI_GET_PDATA(self);
-    AwtObject::_Dispose(pData);
+    AwtObject::_Dispose(self);
 
     CATCH_BAD_ALLOC;
 }

src/windows/native/sun/windows/awt_MenuItem.cpp

@@ -974,8 +974,7 @@ Java_sun_awt_windows_WMenuItemPeer__1dispose(JNIEnv *env, jobject self)
 {
     TRY_NO_HANG;
 
-    PDATA pData = JNI_GET_PDATA(self);
-    AwtObject::_Dispose(pData);
+    AwtObject::_Dispose(self);
 
     CATCH_BAD_ALLOC;
 }

src/windows/native/sun/windows/awt_Object.cpp

@@ -60,11 +60,20 @@ AwtObject::~AwtObject()
 
 void AwtObject::Dispose()
 {
-    theAwtObjectList.Remove(this);
+    AwtToolkit::GetInstance().PostMessage(WM_AWT_DELETEOBJECT, (WPARAM)this, (LPARAM)0);
+}
+
+void AwtObject::_Dispose(jobject self)
+{
+    TRY_NO_VERIFY;
+
+    CriticalSection::Lock l(AwtToolkit::GetInstance().GetSyncCS());
 
     // value 0 of lParam means that we should not attempt to enter the
     // SyncCall critical section, as it was entered someshere earlier
-    AwtToolkit::GetInstance().PostMessage(WM_AWT_DELETEOBJECT, (WPARAM)this, (LPARAM)0);
+    AwtToolkit::GetInstance().SendMessage(WM_AWT_DISPOSE, (WPARAM)self, (LPARAM)0);
+
+    CATCH_BAD_ALLOC;
 }
 
 void AwtObject::_Dispose(PDATA pData)
@@ -73,14 +82,10 @@ void AwtObject::_Dispose(PDATA pData)
 
     CriticalSection::Lock l(AwtToolkit::GetInstance().GetSyncCS());
 
-    if (pData != NULL) {
-        AwtObject *o = (AwtObject *)pData;
-        AwtToolkit::GetInstance().SendMessage(WM_AWT_DISPOSE, (WPARAM)o, (LPARAM)0);
-    }
+    AwtToolkit::GetInstance().SendMessage(WM_AWT_DISPOSEPDATA, (WPARAM)pData, (LPARAM)0);
 
     CATCH_BAD_ALLOC;
 }
-
 /*
  * Return the peer associated with some target.  This information is
  * maintained in a hashtable at the java level.

src/windows/native/sun/windows/awt_Object.h

@@ -66,6 +66,10 @@ public:
     // After this method has been called, this object must not be used in any way.
     virtual void Dispose();
 
+    // Static method to be called from JNI methods to dispose AwtObject
+    // specified by jobject
+    static void _Dispose(jobject self);
+
     // Static method to be called from JNI methods to dispose AwtObject
     // specified by pData
     static void _Dispose(PDATA pData);

src/windows/native/sun/windows/awt_Robot.cpp

@@ -353,8 +353,7 @@ JNIEXPORT void JNICALL Java_sun_awt_windows_WRobotPeer__1dispose(
 {
     TRY_NO_VERIFY;
 
-    PDATA pData = JNI_GET_PDATA(self);
-    AwtObject::_Dispose(pData);
+    AwtObject::_Dispose(self);
 
     CATCH_BAD_ALLOC;
 }

src/windows/native/sun/windows/awt_Toolkit.cpp

@@ -740,18 +740,34 @@ LRESULT CALLBACK AwtToolkit::WndProc(HWND hWnd, UINT message,
               canDispose = syncCS.TryEnter();
           }
           if (canDispose) {
-              AwtObject *o = (AwtObject *)wParam;
-              o->Dispose();
-              if (shouldEnterCriticalSection) {
-                  syncCS.Leave();
+              if(wParam != NULL) {
+                  AwtObject *o = (AwtObject *) JNI_GET_PDATA((jobject)wParam);
+                  if(o != NULL && theAwtObjectList.Remove(o)) {
+                      o->Dispose();
+                  }
+                  if (shouldEnterCriticalSection) {
+                      syncCS.Leave();
+                  }
               }
           } else {
               AwtToolkit::GetInstance().PostMessage(WM_AWT_DISPOSE, wParam, lParam);
           }
           return 0;
       }
+      case WM_AWT_DISPOSEPDATA: {
+          /*
+           * NOTE: synchronization routine (like in WM_AWT_DISPOSE) was omitted because
+           * this handler is called ONLY while disposing Cursor and Font objects where
+           * synchronization takes place.
+           */
+          AwtObject *o = (AwtObject *) wParam;
+          if(o != NULL && theAwtObjectList.Remove(o)) {
+              o->Dispose();
+          }
+          return 0;
+      }
       case WM_AWT_DELETEOBJECT: {
-          AwtObject *p = (AwtObject *)wParam;
+          AwtObject *p = (AwtObject *) wParam;
           if (p->CanBeDeleted()) {
               // all the messages for this component are processed, so
               // it can be deleted

src/windows/native/sun/windows/awt_TrayIcon.cpp

@@ -926,8 +926,7 @@ Java_sun_awt_windows_WTrayIconPeer__1dispose(JNIEnv *env, jobject self)
 {
     TRY;
 
-    PDATA pData = JNI_GET_PDATA(self);
-    AwtObject::_Dispose(pData);
+    AwtObject::_Dispose(self);
 
     CATCH_BAD_ALLOC;
 }

src/windows/native/sun/windows/awtmsg.h

@@ -219,6 +219,7 @@ enum {
 
     WM_AWT_ENDCOMPOSITION,
     WM_AWT_DISPOSE,
+    WM_AWT_DISPOSEPDATA,
     WM_AWT_DELETEOBJECT,
     WM_AWT_SETCONVERSIONSTATUS,
     WM_AWT_GETCONVERSIONSTATUS,