180995 - nsStatusBarBiffManager::~nsStatusBarBiffManager() unconditionally releases a null member

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[timeless]

+	kBiffStateAtom	0x00000000
    NS_RELEASE(kBiffStateAtom);

nsStatusBarBiffManager::~nsStatusBarBiffManager() line 76 + 6 bytes
nsStatusBarBiffManager::`scalar deleting destructor'(unsigned int 1) + 15 bytes
nsStatusBarBiffManager::Release(nsStatusBarBiffManager * const 0x03d0aca0) line
64 + 179 bytes
nsCOMPtr_base::assign_assuming_AddRef(nsISupports * 0x00000000) line 436
nsCOMPtr_base::assign_with_AddRef(nsISupports * 0x00000000) line 74
nsCOMPtr<nsISupports>::operator=(nsISupports * 0x00000000) line 796
FreeServiceContractIDEntryEnumerate(PLDHashTable * 0x004a676c, PLDHashEntryHdr *
0x010514b4, unsigned int 319, void * 0x00000000) line 1926
PL_DHashTableEnumerate(PLDHashTable * 0x004a676c, int (PLDHashTable *,
PLDHashEntryHdr *, unsigned int, void *)* 0x0029b1f0
FreeServiceContractIDEntryEnumerate(PLDHashTable *, PLDHashEntryHdr *, unsigned
int, void *), void * 0x00000000) line 603 + 34 bytes
nsComponentManagerImpl::FreeServices() line 1938 + 19 bytes
NS_ShutdownXPCOM(nsIServiceManager * 0x00000000) line 723
main(int 2, char * * 0x004a4424) line 949 + 8 bytes
mainCRTStartup() line 338 + 17 bytes
KERNEL32! 77e87903()

Comment 1

[Matthias Versen [:Matti]]

*** Bug 180998 has been marked as a duplicate of this bug. ***

Comment 2

[timeless]

Attachment: patch

Comment 3

[(not reading, please use [e-mail] instead)]

Comment on attachment 106860 [details] [diff] [review]
patch

r=sspitzer, this looks fine.

but how are you hitting this?

this the factory creates this service and calls Init()

from nsMsgFactory.cpp:

NS_GENERIC_FACTORY_CONSTRUCTOR_INIT(nsStatusBarBiffManager, Init)

is the call to NS_NewAtom() failing, and then we crash at shutdown?

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

version 1.25 was checked in, why is this not marked Resolved Fixed?

Comment 5

[timeless]

because i'm not very organized.

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

Timeless, this was a crash, no?

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

I don't see any crashes in http://climate (internal Talkback server), but then
again, that doesn't mean much, as this was probably a very difficult bug to
reproduce.

I'm verifying based on running biff for the past week on all platforms, and
checking Talkback at:
http://climate/reports/VeryFastSearchStackSigNEW.cfm?stacksig=nsStatusBarBiffManager%3A%3A%7EnsStatusBarBiffManager

(also, lxr verification)