287031 - freeing an object that wasn't addref'd

Status: RESOLVED INVALID

(Calendar :: Internal Components, defect)

Description

[timeless]

the code theoretically does:
        NS_ADDREF( observer );
        m_observerArray->AppendElement( observer );
as part of
oeICalContainerImpl::AddObserver(oeIICalObserver *observer)
however, in my case, that code is never called. because it's never called,
oeICalContainerImpl::RemoveObserver(oeIICalObserver *observer)

        m_observerArray->RemoveElement( observer );
	nsSupportsArray::RemoveElement returned	0x00000000	unsigned int

and
        NS_RELEASE( observer );
will release a reference that isn't owned by xpical (and in fact is the
wrapper's internal reference), the result is that the object tears itself down.
it will eventually be torn down *again* by the gc.
>	xpical.dll!oeICalContainerImpl::RemoveObserver(oeIICalObserver *
observer=0x038e5348)  Line 893	C++
 	xpcom_core.dll!XPTC_InvokeByIndex(nsISupports * that=0x087db3b8, unsigned int
methodIndex=0x0000000d, unsigned int paramCount=0x00000001, nsXPTCVariant *
params=0x0012daec)  Line 102	C++
 	xpc3250.dll!XPCWrappedNative::CallMethod(XPCCallContext & ccx={...},
XPCWrappedNative::CallMode mode=CALL_METHOD)  Line 2068 + 0x1e	C++
 	xpc3250.dll!XPC_WN_CallMethod(JSContext * cx=0x08262dc0, JSObject *
obj=0x06b23fc0, unsigned int argc=0x00000001, long * argv=0x08aa55ec, long *
vp=0x0012ddc0)  Line 1311 + 0xb	C++
 	js3250.dll!js_Invoke(JSContext * cx=0x08262dc0, unsigned int argc=0x00000001,
unsigned int flags=0x00000000)  Line 1293 + 0x20	C
 	js3250.dll!js_Interpret(JSContext * cx=0x08262dc0, unsigned char *
pc=0x06fe713a, long * result=0x0012e934)  Line 3566 + 0xf	C
 	js3250.dll!js_Invoke(JSContext * cx=0x08262dc0, unsigned int argc=0x00000001,
unsigned int flags=0x00000002)  Line 1313 + 0x13	C
 	js3250.dll!js_InternalInvoke(JSContext * cx=0x08262dc0, JSObject *
obj=0x032f5b18, long fval=0x03829690, unsigned int flags=0x00000000, unsigned
int argc=0x00000001, long * argv=0x0012ec2c, long * rval=0x0012ec30)  Line
1390 + 0x14	C
 	js3250.dll!JS_CallFunctionValue(JSContext * cx=0x08262dc0, JSObject *
obj=0x032f5b18, long fval=0x03829690, unsigned int argc=0x00000001, long *
argv=0x0012ec2c, long * rval=0x0012ec30)  Line 3831 + 0x1f	C
 	gklayout.dll!nsJSContext::CallEventHandler(JSObject * aTarget=0x032f5b18,
JSObject * aHandler=0x03829690, unsigned int argc=0x00000001, long *
argv=0x0012ec2c, long * rval=0x0012ec30)  Line 1401 + 0x21	C++
 	gklayout.dll!nsJSEventListener::HandleEvent(nsIDOMEvent * aEvent=0x088bdfb8) 
Line 205 + 0x2d	C++
 	gklayout.dll!nsEventListenerManager::HandleEventSubType(nsListenerStruct *
aListenerStruct=0x086e2050, nsIDOMEvent * aDOMEvent=0x088bdfb8,
nsIDOMEventTarget * aCurrentTarget=0x06a8f32c, unsigned int aSubType=0x00000002,
unsigned int aPhaseFlags=0x00000007)  Line 1557 + 0x14	C++
 	gklayout.dll!nsEventListenerManager::HandleEvent(nsPresContext *
aPresContext=0x0309b080, nsEvent * aEvent=0x0012eeb0, nsIDOMEvent * *
aDOMEvent=0x0012ee78, nsIDOMEventTarget * aCurrentTarget=0x06a8f32c, unsigned
int aFlags=0x00000007, nsEventStatus * aEventStatus=0x0012eeac)  Line 1656	C++
 	gklayout.dll!nsGlobalWindow::HandleDOMEvent(nsPresContext *
aPresContext=0x0309b080, nsEvent * aEvent=0x0012eeb0, nsIDOMEvent * *
aDOMEvent=0x0012ee78, unsigned int aFlags=0x00000007, nsEventStatus *
aEventStatus=0x0012eeac)  Line 914	C++
 	gklayout.dll!DocumentViewerImpl::Unload()  Line 1169 + 0x23	C++
 	docshell.dll!nsDocShell::FireUnloadNotification()  Line 871	C++
 	docshell.dll!nsDocShell::Destroy()  Line 3381	C++
 	appshell.dll!nsXULWindow::Destroy()  Line 506	C++
 	appshell.dll!nsWebShellWindow::Destroy()  Line 848 + 0x9	C++
 	appshell.dll!nsWebShellWindow::HandleEvent(nsGUIEvent * aEvent=0x0012f1a0) 
Line 407	C++
 	gkwidget.dll!nsWindow::DispatchEvent(nsGUIEvent * event=0x0012f1a0,
nsEventStatus & aStatus=nsEventStatus_eIgnore)  Line 1150 + 0xa	C++

Comment 1

[Michiel van Leeuwen (email: mvl+moz@)]

libxpical isn't build anymore

Comment 2

[Marcia Knous [:marcia]]

Mass move of libxpical bugs to the Internal Components, per ctalbert.

Comment 3

[Reed Loden [:reed]]

The bugspam monkeys have been set free and are feeding on Calendar :: Internal Components. Be afraid for your sanity!