370940 - Crash [@ nsRefPtr<nsIDOMEventListener>::~nsRefPtr] [@ nsEventListenerManager::RemoveAllListeners]

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase makes Firefox trunk crash.  I think this is a regression from the last few days.

Nightly: Crash [@ nsEventListenerManager::RemoveAllListeners]

Debug: Crash [@ nsRefPtr<nsIDOMEventListener>::~nsRefPtr]

Comment 1

[Jesse Ruderman]

Regressed between Feb 18 nightly and Feb 19 nightly.

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-02-18+03&maxdate=2007-02-19+05&cvsroot=%2Fcvsroot

Comment 2

[Jesse Ruderman]

Could this be a regression from one of the cycle collector changes?

Comment 3

[Peter Van der Beken [:peterv]]

Could be, though the stack goes through layout code.

Comment 4

[Peter Van der Beken [:peterv]]

I locally backed out the fixes for bug 368549 and for bug 367779 and I can
still reproduce this. See also bug 370967.

Comment 5

[Peter Van der Beken [:peterv]]

Backing out the patch from bug 257868 fixes this for me.

Comment 6

[Nickolay_Ponomarev]

I can't reproduce this, but I think it's the same as bug 370967.

Comment 7

[Nickolay_Ponomarev]

Please test if the fix for bug 370967 also fixed this one.

Comment 8

[Jesse Ruderman]

Yep.  This no longer crashes for me.

Comment 9

[Jesse Ruderman]

Crashtest checked in.